What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

pup.datamngr [Solved]

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi

You have a bit of a collection on there so some work needs to be done.

Note: If you have MalwareBytes Anti-Malware 1.6 or higher installed and are using the Pro version or trial version, please temporarily disable it for the duration of this fix as it may interfere with the successfully execution of the script below.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&am…q={searchTerms}
IE - HKLM\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
IE - HKLM\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o=101881&l…q={SEARCHTERMS}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2464976
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}
IE - HKU\.DEFAULT\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o=101881&l…q={SEARCHTERMS}
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}
IE - HKU\S-1-5-18\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o=101881&l…q={SEARCHTERMS}
IE - HKU\S-1-5-19\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o=101881&l…q={SEARCHTERMS}
IE - HKU\S-1-5-20\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://www.ask.com/web?&o=101881&l…q={SEARCHTERMS}
IE - HKU\S-1-5-21-414133644-2110597950-2255265229-1000\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKU\S-1-5-21-414133644-2110597950-2255265229-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a…q={searchTerms}
IE - HKU\S-1-5-21-414133644-2110597950-2255265229-1000\..\SearchScopes\{a5b9c0f5-5616-47cd-a95f-e43b488faccf}: "URL" = http://search.mywebsearch.com/mywebsearch/…r={searchTerms}
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&gct=ds&appid=418&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=1110433392054701&o=APN10645&q="
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&a…q={searchTerms}
CHR - homepage: http://www.searchnu.com/406
O2:64bit: - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\PROGRA~2\SEARCH~1\Datamngr\x64\BROWSE~1.DLL File not found
O2 - BHO: (no name) - {02287225-7A9F-418E-B528-6F3ACB9D1E3b} - No CLSID value found.
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-414133644-2110597950-2255265229-1000\..\Toolbar\WebBrowser: (no name) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll) - File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll) - File not found


:Files
ipconfig /flushdns /c
c:\program files (x86)\search results toolbar\datamngr\srtool~2\dtuser.exe

:Commands
[purity]
[emptytemp]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done

=========================================

Download and run Junkware Removal Tool

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.
  • shut down your protection software now to avoid potential conflicts.
  • run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
  • the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • on completion, a log (JRT.txt) is saved to your desktop and will automatically open
  • post the contents of JRT.txt into your next message.
=========================================

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.
  • when finished, it will produce a report for you.
  • please post the C:\ComboFix.txt in you next post.
Logs to include in the next post:

OTL fix log
JRT.txt
ComboFix.txt

Thanks

Satchfan
Post #17
Satchfan: I have the free version of Malwarebytes and it can't be disabled. I pasted the codes in custom scan of OTL and clicked Run Fix. The fix started but stopped working. My computer froze and I had to shut it down manually. I found that the free MalwareBytes is version 1.70 so I just uninstalled it and will attempt to run the OTL fix with the codes. If it works, I will continue with the rest of your instructions. If it doesn't, I'll let you know. Thank you.
Post #18
Satchfan: I attempted to run OTL again and the following happened, it stopped working again and a box popped up with a red x that said 'the exception unknown software exception (0xc0020043) occurred in the application at location 0x74f3cd99.' the OTL box sort of whited-out and I was again unable to close it. I couldn't get online or open any desktop icons. I had to manually shut down my computer again. When I cut it back on, a notepad box popped up (it popped up the first time too) with the following heading: 01282013 - 145507.log and the following info in it: Files\Folders moved on Reboot… File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\R0I9CAIO\D1%2525252526dlo%252525253D1%25252526media_subtypes%2525253D1%25252526dlo%2525253D1%252526media_subtypes%25253D1%252526dlo%25253D1%2526media_subtypes%253D1%2526dlo%253D1[1].js not found! File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\R0I9CAIO\e=info;loc=100;target=_blank;grp=82480;misc=1358994591390;size=300x250;nope rf=1;key=Feisty+Clinton_+U.S.+strengthening+embassy+security;kvcw=;kvtitle=Feisty-Clinton_-U.S[1].js not found! File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\LFJ3XXU1\417503_1358906293,12c88e1f6184a6f,fin,ax.-bu.95-bd.9307-cm.fin_l;sz=160x600;env=ifr;ord1=233398;cmw=owl;dcopt=ist;contx=fin;cmd=wiki.ans wers.com;an=;bu=95;br=9307;btg=cm[1].js not found! File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\LFJ3XXU1\admeld_wikianswers;net=cm;u=,cm-21113442231_1358906276,12c88e1f6184a6f,fin,ax.-bu.630-bd.1221;sz=300x250;env=ifr;ord1=773073;cmw=owl;dcopt=ist;contx=fin;cmd=wiki.answ ers[1].js not found! File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\GNEVSJEC\e=info;loc=100;target=_blank;grp=82480;misc=1358994590378;size=300x250;nope rf=1;key=Feisty+Clinton_+U.S.+strengthening+embassy+security;kvcw=;kvtitle=Feisty-Clinton_-U.S[1].js not found! File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\GNEVSJEC\ie=info;loc=100;target=_blank;grp=82480;misc=1358994586947;size=728x90;nope rf=1;key=Feisty+Clinton_+U.S.+strengthening+embassy+security;kvcw=;kvtitle=Feisty-Clinton_-U.S[1].js not found! C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\GNEVSJEC\iframe[2].htm moved successfully. File\Folder C:\Users\Penny Morgan\AppData\Local\Temp\Temporary Internet Files\Content.IE5\GNEVSJEC\s%252Fpolitics%252FUpdate-Inaugural-official-says-Beyonce-did-not-sing-live%252F-%252F1637100%252F18254150%252F-%252Fformat%252Frss_2.0%252F-%252F9523d2z%252F-%252Findex[1].js not found! PendingFileRenameOperations files… Registry entries deleted on Reboot… I will wait for your response before doing anything else. Thank you.
Post #20
Hello. I uninstalled MalwareBytes & disabled Avast Pro. Here is the log from JRT. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.5.2 (01.26.2013:2) OS: Windows 7 Ultimate x64 Ran by [removed] on Mon 01/28/2013 at 19:28:52.53 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] hkey_current_user\software\microsoft\internet explorer\toolbar\webbrowser\\{90b49673-5506-483e-b92b-ca0265bd9ca8} ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_current_user\software\conduit Successfully deleted: [Registry Key] hkey_local_machine\software\conduit Successfully deleted: [Registry Key] hkey_current_user\software\datamngr Successfully deleted: [Registry Key] hkey_local_machine\software\datamngr Successfully deleted: [Registry Key] hkey_current_user\software\datamngr_toolbar Successfully deleted: [Registry Key] hkey_local_machine\software\freeze.com Successfully deleted: [Registry Key] hkey_current_user\software\ilivid Successfully deleted: [Registry Key] hkey_current_user\software\ilividtoolbarguid Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\pricegong Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\browserconnection.dll Successfully deleted: [Registry Key] hkey_local_machine\software\classes\applications\ilividsetup.exe Successfully deleted: [Registry Key] hkey_local_machine\software\classes\ilividiehelper.dnsguard Successfully deleted: [Registry Key] hkey_local_machine\software\classes\ilividiehelper.dnsguard.1 Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\ilividsrtb Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividmediabar_rasapi32 Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividmediabar_rasmancs Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividsetup_rasapi32 Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividsetup_rasmancs ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess" Successfully deleted: [Folder] "C:\Users\Penny Morgan\appdata\locallow\datamngr" Successfully deleted: [Folder] "C:\Users\Penny Morgan\appdata\locallow\pricegong" Successfully deleted: [Folder] "C:\Users\Penny Morgan\appdata\locallow\televisionfanaticei" Successfully deleted: [Folder] "C:\Windows\freecorder" ~~~ FireFox Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\search_results.xml" Successfully deleted: [File] C:\Users\Penny Morgan\AppData\Roaming\mozilla\firefox\profiles\us0nla4v.default\searchplugins\search_results.xml Failed to delete: [Folder] "C:\Program Files (x86)\Mozilla Firefox\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}" Successfully deleted: [Folder] C:\Users\Penny Morgan\AppData\Roaming\mozilla\firefox\profiles\us0nla4v.default\ilividtoolbarguid Failed to delete: [Folder] C:\Users\Penny Morgan\AppData\Roaming\mozilla\firefox\profiles\us0nla4v.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433} Successfully deleted: [Folder] C:\Users\Penny Morgan\AppData\Roaming\mozilla\firefox\profiles\us0nla4v.default\extensions\{f34c9277-6577-4dff-b2d7-7d58092f272f} Successfully deleted the following from C:\Users\Penny Morgan\AppData\Roaming\mozilla\firefox\profiles\us0nla4v.default\prefs.js user_pref("browser.search.selectedEngine", "Search Results"); user_pref("browser.search.defaultenginename", "Search Results"); user_pref("browser.search.order.1", "Search Results"); ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Mon 01/28/2013 at 19:47:37.84 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Post #21
Good morning Satchfan. I have business today and will be gone most of the day. I don't know if my computer clean-up is complete, but I will reply when I return home and hopefully we can connect later today. Thank you very much for your assistance. Have a blessed day.
Post #22
Good morning, (afternoon here :) )

When you return, please run OTL again to see if it actually completed the "fix".
  • open OTL again and click the Quick Scan button
  • post the OTL.txt log it produces in your next reply.
Please post back with the log.

Thanks.
Post #23
Hello Satchfan. I just noted you live in Devon, UK when you said it was afternoon where you live when it is the am where I live. Here is the log from the OTL quickscan. Thank you.

TL logfile created on: 1/29/2013 8:21:08 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Penny Morgan\Desktop\VIRUS REMOVAL TOOLS AND DISK CLEANUP
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.30 Gb Available Physical Memory | 43.31% Memory free
4.50 Gb Paging File | 2.60 Gb Available in Paging File | 57.83% Paging File free
Paging file location(s): c:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 289.08 Gb Free Space | 62.08% Space Free | Partition Type: NTFS

Computer Name: PENNYMORGAN-PC | User Name: Penny Morgan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/28 08:28:15 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Penny Morgan\Desktop\VIRUS REMOVAL TOOLS AND DISK CLEANUP\OTL.exe
PRC - [2013/01/05 00:27:04 | 000,109,496 | —- | M] (Glarysoft Ltd) – C:\Program Files (x86)\Glary Utilities\memdefrag.exe
PRC - [2012/12/18 09:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/12/17 12:55:30 | 000,308,368 | —- | M] (Google Inc.) – C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
PRC - [2012/12/16 08:40:28 | 000,295,072 | —- | M] (RealNetworks, Inc.) – C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2012/11/29 20:31:04 | 000,038,608 | —- | M] () – C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
PRC - [2012/10/30 17:50:59 | 004,297,136 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/10/30 17:50:59 | 000,044,808 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/10/23 04:47:48 | 002,848,168 | —- | M] (TeamViewer GmbH) – C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2010/03/04 12:00:56 | 000,025,704 | R— | M] (Amazon.com) – C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV:64bit: - [2012/10/30 17:50:59 | 000,044,808 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV:64bit: - [2012/07/27 21:09:44 | 000,239,616 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2010/09/22 17:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV - [2013/01/08 23:15:17 | 000,251,400 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/18 09:28:08 | 000,065,192 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2012/11/29 20:31:04 | 000,038,608 | —- | M] () [Auto | Running] – C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe – (RealNetworks Downloader Resolver Service)
SRV - [2012/10/23 04:47:48 | 002,848,168 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe – (TeamViewer7)
SRV - [2012/09/05 20:26:40 | 000,114,144 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/03/04 12:00:56 | 000,025,704 | R— | M] (Amazon.com) [Auto | Running] – C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe – (ADVService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/02 15:38:36 | 000,050,856 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64.sys – (Point64)
DRV:64bit: - [2012/11/01 21:52:50 | 000,075,928 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\dc3d.sys – (dc3d)
DRV:64bit: - [2012/10/30 17:51:56 | 000,059,728 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswTdi.sys – (aswTdi)
DRV:64bit: - [2012/10/30 17:51:55 | 000,984,144 | —- | M] (AVAST Software) [File_System | System | Running] – C:\Windows\SysNative\drivers\aswSnx.sys – (aswSnx)
DRV:64bit: - [2012/10/30 17:51:55 | 000,370,288 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswSP.sys – (aswSP)
DRV:64bit: - [2012/10/30 17:51:55 | 000,071,600 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\aswMonFlt.sys – (aswMonFlt)
DRV:64bit: - [2012/10/30 17:51:55 | 000,021,136 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswKbd.sys – (aswKbd)
DRV:64bit: - [2012/10/30 17:51:53 | 000,025,232 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\aswFsBlk.sys – (aswFsBlk)
DRV:64bit: - [2012/10/15 10:59:28 | 000,054,072 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswRdr2.sys – (aswRdr)
DRV:64bit: - [2012/07/27 23:07:44 | 010,278,912 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (amdkmdag)
DRV:64bit: - [2012/07/27 20:14:46 | 000,368,640 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2012/05/14 01:12:30 | 000,096,896 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AtihdW76.sys – (AtiHDAudioService)
DRV:64bit: - [2012/03/08 17:40:52 | 000,048,488 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\fssfltr.sys – (fssfltr)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 06:03:42 | 000,020,992 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\rdpvideominiport.sys – (RdpVideoMiniport)
DRV:64bit: - [2010/03/30 22:35:04 | 000,020,968 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\cpuz133_x64.sys – (cpuz133)
DRV:64bit: - [2009/09/23 18:23:02 | 006,180,832 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/06/10 15:35:42 | 000,187,392 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2007/05/14 15:06:18 | 000,027,520 | —- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimUsb_AMD64.sys – (RimUsb)
DRV:64bit: - [2005/03/29 01:30:38 | 000,008,192 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.freep.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D5 19 7B A4 AC 70 CC 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{180780f0-b348-4b44-8210-94a8f3ee15b2}: "URL" = http://search.comcast.net/search/?cat=Web&…q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: ""
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.0.282: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.0: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.0.282: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/11/02 19:08:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{34712C68-7391-4c47-94F3-8F88D49AD632}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2012/12/16 08:42:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/04 13:16:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013/01/18 23:50:36 | 000,000,000 | —D | M] (No name found) – C:\Users\Penny Morgan\AppData\Roaming\Mozilla\Extensions
[2011/02/14 20:36:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Penny Morgan\AppData\Roaming\Mozilla\Extensions\[removed]
[2013/01/28 19:46:50 | 000,000,000 | —D | M] (No name found) – C:\Users\Penny Morgan\AppData\Roaming\Mozilla\Firefox\Profiles\us0nla4v.default\extensions
[2013/01/18 23:50:36 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) – C:\PROGRAM FILES (X86)\SEARCH RESULTS TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012/09/05 20:27:05 | 000,266,720 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/09/05 20:26:22 | 000,002,465 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/09/05 20:26:22 | 000,002,253 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2012/02/28 15:04:46 | 000,020,569 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\xfinity.xml

========== Chrome ==========

CHR - homepage: http://www.searchnu.com/406
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = http://dts.search-results.com/sr?src=crb&a…q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://www.searchnu.com/406
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.56\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - Extension: YouTube = C:\Users\Penny Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google Search = C:\Users\Penny Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: avast! WebRep = C:\Users\Penny Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\
CHR - Extension: RealDownloader = C:\Users\Penny Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.0_0\
CHR - Extension: Gmail = C:\Users\Penny Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliType Pro] c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Glary Memory Optimizer] C:\Program Files (x86)\Glary Utilities\memdefrag.exe (Glarysoft Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O9 - Extra Button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Penny Morgan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s…tel_4.5.9.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} http://www.shockwave.com/content/feedingfr…outLauncher.cab (SproutLauncherCtrl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9113D34B-B58B-4291-9E1C-CE5C58684F1E}: DhcpNameServer = 75.75.76.76 75.75.75.75
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - AppInit_DLLs: (c:\progra~3\wincert\win64c~1.dll) - c:\ProgramData\Wincert\win64cert.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/01/28 20:02:28 | 000,000,000 | —D | C] – C:\Users\Penny Morgan\Desktop\VIRUS REMOVAL TOOLS AND DISK CLEANUP
[2013/01/28 19:28:50 | 000,000,000 | —D | C] – C:\Windows\ERUNT
[2013/01/28 19:28:40 | 000,000,000 | —D | C] – C:\JRT
[2013/01/28 14:31:32 | 000,000,000 | —D | C] – C:\_OTL
[2013/01/27 13:51:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center
[2013/01/27 13:51:13 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Mouse and Keyboard Center
[2013/01/24 22:31:39 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2013/01/24 22:31:27 | 000,000,000 | —D | C] – C:\ProgramData\AMD
[2013/01/24 22:31:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\AMD AVT
[2013/01/24 22:31:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\AMD APP
[2013/01/24 22:30:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2013/01/24 22:28:45 | 000,534,528 | —- | C] (AMD) – C:\Windows\SysNative\atieclxx.exe
[2013/01/24 22:28:45 | 000,239,616 | —- | C] (AMD) – C:\Windows\SysNative\atiesrxx.exe
[2013/01/24 22:28:45 | 000,021,504 | —- | C] (AMD) – C:\Windows\SysNative\atimuixx.dll
[2013/01/24 22:28:44 | 000,120,320 | —- | C] (AMD) – C:\Windows\SysNative\atitmm64.dll
[2013/01/18 23:50:41 | 000,000,000 | —D | C] – C:\ProgramData\Wincert
[2013/01/17 11:26:37 | 000,000,000 | —D | C] – C:\ProgramData\Geek Squad
[2013/01/07 21:48:26 | 000,000,000 | —D | C] – C:\Users\Penny Morgan\AppData\Local\Programs
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/29 20:14:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/29 19:56:16 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/29 09:54:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/28 16:17:40 | 000,000,255 | —- | M] () – C:\Users\Penny Morgan\Desktop\What the Tech - Free Tech Support.url
[2013/01/28 15:11:15 | 000,015,328 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 15:11:15 | 000,015,328 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 15:02:15 | 000,000,338 | —- | M] () – C:\Windows\tasks\GlaryInitialize.job
[2013/01/28 15:01:46 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/01/28 15:01:38 | 2415,271,936 | -HS- | M] () – C:\hiberfil.sys
[2013/01/27 20:27:36 | 000,002,002 | —- | M] () – C:\Users\Public\Desktop\avast! Pro Antivirus.lnk
[2013/01/27 14:51:39 | 000,135,530 | —- | M] () – C:\Users\Penny Morgan\Desktop\HUD 24 CFR PART 245.pdf
[2013/01/27 13:56:22 | 000,422,360 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/27 13:54:00 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2013/01/27 13:46:39 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2013/01/22 19:25:40 | 000,001,133 | —- | M] () – C:\Users\Penny Morgan\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2013/01/21 18:06:41 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2013/01/20 01:13:02 | 000,869,376 | —- | M] () – C:\Windows\is-7C4HS.exe
[2013/01/20 01:13:02 | 000,001,066 | —- | M] () – C:\Users\Penny Morgan\Desktop\Glary Utilities.lnk
[2013/01/19 02:15:31 | 000,002,279 | —- | M] () – C:\Users\Penny Morgan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/19 02:15:31 | 000,002,255 | —- | M] () – C:\Users\Penny Morgan\Desktop\Google Chrome.lnk
[2013/01/17 15:15:50 | 000,736,642 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/17 15:15:50 | 000,631,208 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/01/17 15:15:50 | 000,109,326 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/01/06 17:44:40 | 000,000,000 | —- | M] () – C:\Windows\ativpsrm.bin
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/01/28 16:17:40 | 000,000,255 | —- | C] () – C:\Users\Penny Morgan\Desktop\What the Tech - Free Tech Support.url
[2013/01/27 14:51:39 | 000,135,530 | —- | C] () – C:\Users\Penny Morgan\Desktop\HUD 24 CFR PART 245.pdf
[2013/01/27 13:54:00 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_point64_01011.Wdf
[2013/01/27 13:46:39 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_dc3d_01011.Wdf
[2013/01/24 22:29:03 | 000,268,728 | —- | C] () – C:\Windows\SysWow64\atiapfxx.blb
[2013/01/24 22:29:03 | 000,038,557 | —- | C] () – C:\Windows\atiogl.xml
[2013/01/24 22:28:55 | 003,187,136 | —- | C] () – C:\Windows\SysWow64\atiumdva.cap
[2013/01/24 22:28:51 | 000,268,728 | —- | C] () – C:\Windows\SysNative\atiapfxx.blb
[2013/01/24 22:28:45 | 003,150,560 | —- | C] () – C:\Windows\SysNative\atiumd6a.cap
[2013/01/24 22:28:44 | 000,637,743 | —- | C] () – C:\Windows\SysNative\atiicdxx.dat
[2013/01/20 01:13:02 | 000,869,376 | —- | C] () – C:\Windows\is-7C4HS.exe
[2013/01/20 00:53:44 | 000,002,002 | —- | C] () – C:\Users\Public\Desktop\avast! Pro Antivirus.lnk
[2013/01/20 00:53:41 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt
[2013/01/16 12:24:24 | 000,002,279 | —- | C] () – C:\Users\Penny Morgan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/06 17:44:40 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2012/11/18 15:40:02 | 000,000,268 | RH– | C] () – C:\ProgramData\Nature
[2012/11/18 15:40:02 | 000,000,012 | RH– | C] () – C:\ProgramData\Overdrive
[2012/07/27 20:39:50 | 000,204,952 | —- | C] () – C:\Windows\SysWow64\ativvsvl.dat
[2012/07/27 20:39:50 | 000,157,144 | —- | C] () – C:\Windows\SysWow64\ativvsva.dat
[2012/05/02 13:58:10 | 000,029,184 | —- | C] () – C:\Windows\SysWow64\kdbsdk32.dll
[2011/09/12 17:06:16 | 000,003,917 | —- | C] () – C:\Windows\SysWow64\atipblag.dat
[2011/07/28 08:17:23 | 000,015,636 | -HS- | C] () – C:\Users\Penny Morgan\AppData\Local\2qx40tw0135t8fr027e36257xjgwl8585
[2011/07/28 08:17:23 | 000,015,636 | -HS- | C] () – C:\ProgramData\2qx40tw0135t8fr027e36257xjgwl8585
[2011/07/28 07:46:33 | 000,015,752 | -HS- | C] () – C:\Users\Penny Morgan\AppData\Local\uwl5jl73bkn5baix3w36826l27g5ugw
[2011/07/28 07:46:33 | 000,015,752 | -HS- | C] () – C:\ProgramData\uwl5jl73bkn5baix3w36826l27g5ugw
[2011/07/28 07:46:33 | 000,000,000 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\vynd.exe
[2011/07/28 07:46:33 | 000,000,000 | —- | C] () – C:\ProgramData\mpol.exe
[2011/07/28 07:46:33 | 000,000,000 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\fucp.exe
[2011/07/28 07:46:33 | 000,000,000 | —- | C] () – C:\ProgramData\dbaw.exe
[2011/07/28 07:46:32 | 000,000,000 | —- | C] () – C:\ProgramData\xhhy.exe
[2011/07/28 07:46:32 | 000,000,000 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\vbcx.exe
[2011/07/28 07:46:32 | 000,000,000 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\upkx.exe
[2011/07/28 07:46:32 | 000,000,000 | —- | C] () – C:\ProgramData\qenl.exe
[2010/06/02 07:34:13 | 000,000,268 | RH– | C] () – C:\Users\Penny Morgan\AppData\Roaming\Master
[2010/06/02 07:34:13 | 000,000,020 | -H– | C] () – C:\ProgramData\PKP_DLdu.DAT
[2010/05/25 17:01:10 | 000,022,155 | —- | C] () – C:\Users\Penny Morgan\AppData\Roaming\UserTile.png
[2009/12/26 14:29:44 | 000,009,728 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/14 22:00:19 | 000,007,597 | —- | C] () – C:\Users\Penny Morgan\AppData\Local\Resmon.ResmonCfg

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2012/06/09 00:43:10 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2012/06/08 23:41:00 | 012,873,728 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 07:19:02 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/03/07 19:34:20 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\Catalina Marketing Corp
[2010/05/01 08:25:14 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\Dream Aquarium
[2012/11/16 06:14:11 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\GetRightToGo
[2013/01/20 01:12:56 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\GlarySoft
[2011/02/22 15:42:43 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\IMVU
[2011/02/14 20:34:21 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\IMVUClient
[2010/11/24 10:20:38 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\LaunchPad
[2011/06/10 08:43:44 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\Nikon
[2012/02/08 22:12:33 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\PeerNetworking
[2011/02/14 21:14:20 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\Vivox
[2011/04/01 15:49:17 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\vomba
[2011/03/27 20:14:10 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\Vomba Network
[2011/03/27 19:57:47 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\VombaNetwork
[2011/03/27 20:14:01 | 000,000,000 | —D | M] – C:\Users\Penny Morgan\AppData\Roaming\VombaSavers

========== Purity Check ==========



< End of report >
Post #24 last edited
Morning!!

IMPORTANT: If you downloaded ComboFix as I previously asked you to, DO NOT RUN IT. Please delete it from your desktop and remove it from the recycle bin. Thanks.


Good news; it seems that OTL did its job but still a couple of entries in Chrome that I’d like to purge. Unfortunately, the easiest way to do so with Google Chrome is to uninstall and re-install it.
.
Uninstall Chrome and, if asked about user data or settings, remove those also.

Restart the computer and re-install Chrome

======================================

Submit a file to VirusTotal

These may be nothing but I’d be happier if we checked them.

Go to VirusTotal and submit these files for analysis:

C:\ProgramData\2qx40tw0135t8fr027e36257xjgwl8585
C:\ProgramData\uwl5jl73bkn5baix3w36826l27g5ugw
  • click on Browse
  • click on the arrow and choose Local Disc (C:)
    🖼Click to load external image (Posted Image)
  • below, double-click on ProgramData
  • locate the file 2qx40tw0135t8fr027e36257xjgwl8585, click on it and then on Open
  • click on Send File
  • if you get a message saying File has already been analyzed, click Reanalyze file now.
You will get a report back; post the report into this thread for me to see.

Repeat this for C:\ProgramData\uwl5jl73bkn5baix3w36826l27g5ugw

=====================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.
  • run AdwCleaner and select Delete
  • when it has finished it will ask to reboot - allow the reboot
  • on reboot a log will be produced; please attach the content of the log to your next reply
=====================================================

Run Malwarebytes’ Anti-Malware

Please re-install it, allow it to update and then run a scan.

Can you tell me how your computer is running and if there are any outstanding problems.

Thanks

Satchfan
Post #25
Good morning/afternoon :) Satchfan. I never downloaded ComboFix after the issues with OTL. I have to leave again this morning, but hopefully will not be gone for 10 hours like yesterday. I will follow your instructions when I return home today. I've never used Google Chrome, It was installed by the vendors when I purchased Windows 7. When I delete it, do I HAVE to reinstall it? Is it necessary for my system to work? I will reply later today. Thank you for your assistance and have a blessed day.
Post #26
Another question sweetie. Do you feel as a computer person that I should use Google Chrome instead of IE? I think I recall the vendors saying it was safer and better than IE, but I've used IE for at least 15 years and am used to it. Your knowledgable opinion please. :)
Post #27

will follow your instructions when I return home today.

OK

I've never used Google Chrome, It was installed by the vendors when I purchased Windows 7. When I delete it, do I HAVE to reinstall it? Is it necessary for my system to work?

No, you do not have to re-install it. As it has nothing to do with the operating system, (Windows), your system does not need it.

Do you feel as a computer person that I should use Google Chrome instead of IE? I think I recall the vendors saying it was safer and better than IE,

No again.There are pros and cons about using IE as there are with Chrome but no browser is 100% safe..

I've used IE for at least 15 years and am used to it

I'm also an IE user although I do use Firefox from time to time. As far as Chrome is concerned I'm a bit biased because I'm not a fan of Google anything so wouldn't use it on principle.

I have installed and tried Chrome in the interest of knowledge and research. It works well and does have some advantages but those are minimal as far as the everyday user is concerned. All-in-all, you should stick to what you feel comfortable with.
Post #28
Hello Satchfan. I just got home and am WORN OUT. Very rough couple of days. I can only stretch out and relax for the rest of this evening. I will uninstall Google Chrome first thing in MY morning :), and will follow up with you then. Please bear with me and again, thank you so very much for your assistance. Good night.
Post #30
Good afternoon Satchfan. I located those 2 files in C:/programdata, but when I right click them the only choice is a bolded 'open with'. When I choose 'open with' a box pops up asking me to 'choose the program you want to use to open this file'. I don't see a way to send the files to VirusTotal. Please advise. Thank you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI