Malwarebytes can't/won't delete this. [Solved]

dds.txt
DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK
Internet Explorer: 9.0.8112.16464
Run by [removed] at 18:31:57 on 2013-02-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3032.1297 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
\\.\globalroot\systemroot\svchost.exe -netsvcs
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.facebook.com/
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
uProxyOverride = local;192.168.*.*
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} -
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} -
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
uRun: [Facebook Update] "C:\Users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [AdobeBridge]
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1325
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\M_Hadley\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\HAUPPA~1.LNK - C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\IMVU.lnk - C:\Users\M_Hadley\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\M_Hadley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: windowsupdate.com
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
TCP: NameServer = 8.8.8.8 8.8.4.4 209.55.27.13
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35} : DHCPNameServer = 8.8.8.8 8.8.4.4 [removed]
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\037324430343335343532333 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\2556075616475627 : DHCPNameServer = 192.168.100.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\34963736F61353432323 : DHCPNameServer = [removed] [removed] 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\37C6861646C6561405 : DHCPNameServer = 192.168.1.10
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\4646D2772747 : DHCPNameServer = 192.168.69.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\E4544574541425 : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
x64-Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
x64-Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck -
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\M_Hadley\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-1-25 56208]
R2 CLPSLS;COMODO livePCsupport Service;C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-2-19 148744]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-25 215552]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-9-28 395264]
S1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-5-13 591192]
S1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-5-13 304472]
S1 ElRawDisk;ElRawDisk;C:\Windows\System32\drivers\rsdrvx64.sys [2011-4-7 26024]
S2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-5-13 24408]
S2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-5-13 66904]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-1-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 DeviceMonitorService;DeviceMonitorService;C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-9-7 87992]
S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
S2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-2 120728]
S2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-2-10 65657]
S2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-1-25 658656]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]
S3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\System32\drivers\lgandbus64.sys [2010-12-7 19456]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\System32\drivers\lganddiag64.sys [2010-12-7 27648]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\System32\drivers\lgandgps64.sys [2010-12-7 27136]
S3 ANDModem;LGE Android Platform USB Modem;C:\Windows\System32\drivers\lgandmodem64.sys [2010-12-7 34304]
S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\System32\drivers\motfilt.sys [2009-1-29 6144]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2010-1-25 172704]
S3 HcwDevCentralService;HcwDevCentralService;C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [2012-10-18 291736]
S3 hcwE5bda;Hauppauge Siena Video Capture;C:\Windows\System32\drivers\hcwE5bda.sys [2012-10-18 555952]
S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\System32\drivers\motccgp.sys [2012-6-11 22016]
S3 motccgpfl;MotCcgpFlService;C:\Windows\System32\drivers\motccgpfl.sys [2012-1-25 9728]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\System32\drivers\Motousbnet.sys [2012-6-8 27136]
S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\System32\drivers\motusbdevice.sys [2011-11-8 11776]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-5 19456]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-5 57856]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-4-16 50176]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-16 1255736]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-9-22 370024]
.
=============== Created Last 30 ================
.
2013-02-22 18:27:01 20480 —-a-w- C:\Windows\svchost.exe
2013-02-22 09:36:03 76232 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\offreg.dll
2013-02-22 09:31:23 9162192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\mpengine.dll
2013-02-20 08:00:00 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Adobe
2013-02-18 16:06:12 ——– d—–w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-02-14 10:04:04 ——– d-sh–w- C:\found.002
2013-02-14 09:08:46 768000 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:08:45 996352 —-a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:04:01 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2013-02-14 09:04:00 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-13 10:20:50 3153408 —-a-w- C:\Windows\System32\win32k.sys
2013-02-13 10:20:45 215040 —-a-w- C:\Windows\System32\winsrv.dll
2013-02-13 10:20:44 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2013-02-13 10:20:43 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-02-13 10:20:42 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2013-02-13 10:20:42 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2013-02-13 10:20:40 2048 —-a-w- C:\Windows\SysWow64\user.exe
2013-02-13 10:20:33 1913192 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2013-02-13 10:20:32 288088 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2013-02-12 16:46:14 ——– d-sh–w- C:\found.001
2013-02-11 05:57:12 ——– d—–w- C:\Binaries
2013-02-11 05:57:04 ——– d—–w- C:\Program Files (x86)\Motorola Media Link
2013-02-11 05:53:52 ——– d—–w- C:\Program Files\Motorola Inc
2013-02-03 06:12:50 ——– d—–w- C:\components
2013-02-03 05:46:25 ——– d—–w- C:\Users\M_Hadley\AppData\Local\SwvUpdater
2013-02-03 05:46:13 ——– d—–w- C:\Program Files (x86)\Conduit
2013-02-03 05:44:17 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Conduit
2013-02-03 05:43:45 ——– d—–w- C:\Users\M_Hadley\AppData\Local\CRE
2013-01-31 17:47:58 ——– d—–w- C:\Users\M_Hadley\AppData\Local\{6A1AFE86-CEAB-4A82-AF69-915CB7DAAE06}
2013-01-24 17:41:41 ——– d—–w- C:\Users\M_Hadley\AppData\Roaming\Roxio Log Files
2013-01-24 17:37:05 5 —-a-w- C:\Windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
.
==================== Find3M ====================
.
2013-02-19 05:45:25 71024 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-19 05:45:25 691568 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-02-12 02:04:16 861088 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-02-12 02:04:15 782240 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2013-01-17 07:28:58 273840 ——w- C:\Windows\System32\MpSigStub.exe
2013-01-09 01:19:09 2312704 —-a-w- C:\Windows\System32\jscript9.dll
2013-01-09 01:12:03 1392128 —-a-w- C:\Windows\System32\wininet.dll
2013-01-09 01:11:06 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2013-01-09 01:07:51 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:47 599040 —-a-w- C:\Windows\System32\vbscript.dll
2013-01-08 22:11:21 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:03:20 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:12 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 21:59:02 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:29 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll
2013-01-04 04:43:21 44032 —-a-w- C:\Windows\apppatch\acwow64.dll
2012-12-16 17:11:22 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-12-16 14:45:03 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-14 22:49:28 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys
2012-12-07 13:20:16 441856 —-a-w- C:\Windows\System32\Wpc.dll
2012-12-07 13:15:31 2746368 —-a-w- C:\Windows\System32\gameux.dll
2012-12-07 12:26:17 308736 —-a-w- C:\Windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 —-a-w- C:\Windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 —-a-w- C:\Windows\System32\usk.rs
2012-12-07 11:20:03 43520 —-a-w- C:\Windows\System32\csrr.rs
2012-12-07 11:20:03 23552 —-a-w- C:\Windows\System32\oflc.rs
2012-12-07 11:20:01 45568 —-a-w- C:\Windows\System32\oflc-nz.rs
2012-12-07 11:20:01 44544 —-a-w- C:\Windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 —-a-w- C:\Windows\System32\pegi-fi.rs
2012-12-07 11:20:00 20480 —-a-w- C:\Windows\System32\pegi-pt.rs
2012-12-07 11:19:59 20480 —-a-w- C:\Windows\System32\pegi.rs
2012-12-07 11:19:58 46592 —-a-w- C:\Windows\System32\fpb.rs
2012-12-07 11:19:57 40960 —-a-w- C:\Windows\System32\cob-au.rs
2012-12-07 11:19:57 21504 —-a-w- C:\Windows\System32\grb.rs
2012-12-07 11:19:57 15360 —-a-w- C:\Windows\System32\djctq.rs
2012-12-07 11:19:56 55296 —-a-w- C:\Windows\System32\cero.rs
2012-12-07 11:19:55 51712 —-a-w- C:\Windows\System32\esrb.rs
2012-11-30 05:45:35 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-11-30 05:45:35 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-11-30 05:45:35 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-11-30 05:43:12 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-11-30 05:41:07 424448 —-a-w- C:\Windows\System32\KernelBase.dll
2012-11-30 04:53:59 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-11-30 02:38:59 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 18:35:12.11 ===============

attach.txt
DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK
Internet Explorer: 9.0.8112.16464
Run by [removed] at 18:31:57 on 2013-02-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3032.1297 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
\\.\globalroot\systemroot\svchost.exe -netsvcs
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.facebook.com/
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
uProxyOverride = local;192.168.*.*
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} -
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} -
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
uRun: [Facebook Update] "C:\Users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [AdobeBridge]
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1325
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\M_Hadley\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\HAUPPA~1.LNK - C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\IMVU.lnk - C:\Users\M_Hadley\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\M_Hadley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: windowsupdate.com
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
TCP: NameServer = 8.8.8.8 8.8.4.4 209.55.27.13
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35} : DHCPNameServer = 8.8.8.8 8.8.4.4 [removed]
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\037324430343335343532333 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\2556075616475627 : DHCPNameServer = 192.168.100.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\34963736F61353432323 : DHCPNameServer = [removed] [removed] 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\37C6861646C6561405 : DHCPNameServer = 192.168.1.10
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\4646D2772747 : DHCPNameServer = 192.168.69.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\E4544574541425 : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
x64-Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
x64-Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck -
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\M_Hadley\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-1-25 56208]
R2 CLPSLS;COMODO livePCsupport Service;C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-2-19 148744]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-25 215552]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-9-28 395264]
S1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-5-13 591192]
S1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-5-13 304472]
S1 ElRawDisk;ElRawDisk;C:\Windows\System32\drivers\rsdrvx64.sys [2011-4-7 26024]
S2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-5-13 24408]
S2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-5-13 66904]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-1-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 DeviceMonitorService;DeviceMonitorService;C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-9-7 87992]
S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
S2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-2 120728]
S2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-2-10 65657]
S2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-1-25 658656]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]
S3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\System32\drivers\lgandbus64.sys [2010-12-7 19456]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\System32\drivers\lganddiag64.sys [2010-12-7 27648]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\System32\drivers\lgandgps64.sys [2010-12-7 27136]
S3 ANDModem;LGE Android Platform USB Modem;C:\Windows\System32\drivers\lgandmodem64.sys [2010-12-7 34304]
S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\System32\drivers\motfilt.sys [2009-1-29 6144]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2010-1-25 172704]
S3 HcwDevCentralService;HcwDevCentralService;C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [2012-10-18 291736]
S3 hcwE5bda;Hauppauge Siena Video Capture;C:\Windows\System32\drivers\hcwE5bda.sys [2012-10-18 555952]
S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\System32\drivers\motccgp.sys [2012-6-11 22016]
S3 motccgpfl;MotCcgpFlService;C:\Windows\System32\drivers\motccgpfl.sys [2012-1-25 9728]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\System32\drivers\Motousbnet.sys [2012-6-8 27136]
S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\System32\drivers\motusbdevice.sys [2011-11-8 11776]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-5 19456]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-5 57856]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-4-16 50176]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-16 1255736]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-9-22 370024]
.
=============== Created Last 30 ================
.
2013-02-22 18:27:01 20480 —-a-w- C:\Windows\svchost.exe
2013-02-22 09:36:03 76232 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\offreg.dll
2013-02-22 09:31:23 9162192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\mpengine.dll
2013-02-20 08:00:00 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Adobe
2013-02-18 16:06:12 ——– d—–w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-02-14 10:04:04 ——– d-sh–w- C:\found.002
2013-02-14 09:08:46 768000 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:08:45 996352 —-a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:04:01 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2013-02-14 09:04:00 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-13 10:20:50 3153408 —-a-w- C:\Windows\System32\win32k.sys
2013-02-13 10:20:45 215040 —-a-w- C:\Windows\System32\winsrv.dll
2013-02-13 10:20:44 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2013-02-13 10:20:43 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-02-13 10:20:42 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2013-02-13 10:20:42 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2013-02-13 10:20:40 2048 —-a-w- C:\Windows\SysWow64\user.exe
2013-02-13 10:20:33 1913192 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2013-02-13 10:20:32 288088 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2013-02-12 16:46:14 ——– d-sh–w- C:\found.001
2013-02-11 05:57:12 ——– d—–w- C:\Binaries
2013-02-11 05:57:04 ——– d—–w- C:\Program Files (x86)\Motorola Media Link
2013-02-11 05:53:52 ——– d—–w- C:\Program Files\Motorola Inc
2013-02-03 06:12:50 ——– d—–w- C:\components
2013-02-03 05:46:25 ——– d—–w- C:\Users\M_Hadley\AppData\Local\SwvUpdater
2013-02-03 05:46:13 ——– d—–w- C:\Program Files (x86)\Conduit
2013-02-03 05:44:17 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Conduit
2013-02-03 05:43:45 ——– d—–w- C:\Users\M_Hadley\AppData\Local\CRE
2013-01-31 17:47:58 ——– d—–w- C:\Users\M_Hadley\AppData\Local\{6A1AFE86-CEAB-4A82-AF69-915CB7DAAE06}
2013-01-24 17:41:41 ——– d—–w- C:\Users\M_Hadley\AppData\Roaming\Roxio Log Files
2013-01-24 17:37:05 5 —-a-w- C:\Windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
.
==================== Find3M ====================
.
2013-02-19 05:45:25 71024 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-19 05:45:25 691568 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-02-12 02:04:16 861088 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-02-12 02:04:15 782240 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2013-01-17 07:28:58 273840 ——w- C:\Windows\System32\MpSigStub.exe
2013-01-09 01:19:09 2312704 —-a-w- C:\Windows\System32\jscript9.dll
2013-01-09 01:12:03 1392128 —-a-w- C:\Windows\System32\wininet.dll
2013-01-09 01:11:06 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2013-01-09 01:07:51 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:47 599040 —-a-w- C:\Windows\System32\vbscript.dll
2013-01-08 22:11:21 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:03:20 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:12 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 21:59:02 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:29 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll
2013-01-04 04:43:21 44032 —-a-w- C:\Windows\apppatch\acwow64.dll
2012-12-16 17:11:22 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-12-16 14:45:03 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-14 22:49:28 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys
2012-12-07 13:20:16 441856 —-a-w- C:\Windows\System32\Wpc.dll
2012-12-07 13:15:31 2746368 —-a-w- C:\Windows\System32\gameux.dll
2012-12-07 12:26:17 308736 —-a-w- C:\Windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 —-a-w- C:\Windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 —-a-w- C:\Windows\System32\usk.rs
2012-12-07 11:20:03 43520 —-a-w- C:\Windows\System32\csrr.rs
2012-12-07 11:20:03 23552 —-a-w- C:\Windows\System32\oflc.rs
2012-12-07 11:20:01 45568 —-a-w- C:\Windows\System32\oflc-nz.rs
2012-12-07 11:20:01 44544 —-a-w- C:\Windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 —-a-w- C:\Windows\System32\pegi-fi.rs
2012-12-07 11:20:00 20480 —-a-w- C:\Windows\System32\pegi-pt.rs
2012-12-07 11:19:59 20480 —-a-w- C:\Windows\System32\pegi.rs
2012-12-07 11:19:58 46592 —-a-w- C:\Windows\System32\fpb.rs
2012-12-07 11:19:57 40960 —-a-w- C:\Windows\System32\cob-au.rs
2012-12-07 11:19:57 21504 —-a-w- C:\Windows\System32\grb.rs
2012-12-07 11:19:57 15360 —-a-w- C:\Windows\System32\djctq.rs
2012-12-07 11:19:56 55296 —-a-w- C:\Windows\System32\cero.rs
2012-12-07 11:19:55 51712 —-a-w- C:\Windows\System32\esrb.rs
2012-11-30 05:45:35 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-11-30 05:45:35 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-11-30 05:45:35 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-11-30 05:43:12 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-11-30 05:41:07 424448 —-a-w- C:\Windows\System32\KernelBase.dll
2012-11-30 04:53:59 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-11-30 02:38:59 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 18:35:12.11 ===============


Eula.txt
ROGUEKILLER SOFTWARE LICENSE TERMS

These license terms are an agreement between I (Tigzy - RogueKiller's developer) and you.
Please read them. They apply to the software you are downloading from sur-la-toile.com (or Geekstogo.com).

for this software, unless other terms accompany those items. If so, those terms apply.

BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.

If you comply with these license terms, you have the rights below.

1. INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software on your devices.

2. SCOPE OF LICENSE. The software is licensed, not sold. This agreement only gives you some rights to use the software. I reserve all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways.

You may not:

* work around any technical limitations in the binary versions of the software;
* reverse engineer, decompile or disassemble the binary versions of the software, except and only to the extent that
applicable law expressly permits, despite this limitation;
* make more copies of the software than specified in this agreement or allowed by applicable law, despite this limitation;
* PUBLISH THE SOFTWARE FOR OTHERS TO COPY without author's agreeement;
* rent, lease or lend the software;
* TRANSFERT THE SOFTWARE OR THIS AGREEMENT TO ANY THIRD PARTY
* USE THE SOFTWARE FOR COMMERCIAL SOFTWARE HOSTING SERVICES

3. SUPPORT SERVICES. Because this software is I may not provide support services for it.

4. ENTIRE AGREEMENT. This agreement, and the terms for supplements, updates, Internet-based services and support services that you use, are the entire agreement for the software and support services.

5. DISCLAIMER OF WARRANTY. THE SOFTWARE IS LICENSED “AS-IS.” YOU BEAR THE RISK OF USING IT.

6. DATA GRABBING. For statistical issue, the software can send data from your computer through the internet. By approving this contract, you agree with this.
Datas are not sensitive, they are related to your computer configuration (language, windows version, session name, …) and to this software's internal datas (build number, pattern of infection, number of registry keys found, …).
Basically, each information contained in the report generated by this software can be sent.
Datas are sent anonymously, it means no IP nor user information are kept.
Datas are used in this webpage : http://www.sur-la-toile.com/RogueKiller/stats.php


°°°°°° Français °°°°°°

Ceci est une version partielle en Français des points les plus cruciaux.

2 - Licence. Vous ne pouvez pas:

* Publier ou mettre à disposition le logiciel sans accord express de l'auteur
* Louer, vendre ou céder le logiciel
* Transférer le logiciel dans un logiciel tierce / repacker le logiciel
* Mettre à disposition ce logiciel dans une banque d'hebergement de logiciels.

6 - Récupération d'informations. Pour des raisons statistiques, le logiciel peut envoyer des données de votre ordinateur à travers internet.
En approuvant ce contrat, vous approuvez ceci. Les données ne sont pas sensibles, elles concernent uniquement la configuration du PC (Operating System, Windows version, Nom de session, …) et les données internes au logiciel (infection trouvée, numéro de version, langue, …).
Les données sont envoyées de manière anonyme. Aucune IP et aucune information utilisateur sont sauvegardées.
Les statistiques sont utilisées dans cette page : http://www.sur-la-toile.com/RogueKiller/stats.php

Sorry about that. My bad. Lets try that again. Lol

dds.txt

DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK
Internet Explorer: 9.0.8112.16464
Run by [removed] at 18:31:57 on 2013-02-22
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3032.1297 [GMT -6:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
\\.\globalroot\systemroot\svchost.exe -netsvcs
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.facebook.com/
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
uProxyOverride = local;192.168.*.*
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} -
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} -
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
uRun: [Facebook Update] "C:\Users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [AdobeBridge]
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallati…t;ver=10.0.1325
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\M_Hadley\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\HAUPPA~1.LNK - C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe
StartupFolder: C:\Users\M_Hadley\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\IMVU.lnk - C:\Users\M_Hadley\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\M_Hadley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: windowsupdate.com
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
TCP: NameServer = 8.8.8.8 8.8.4.4 209.55.27.13
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35} : DHCPNameServer = 8.8.8.8 8.8.4.4 [removed]
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\037324430343335343532333 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\2556075616475627 : DHCPNameServer = 192.168.100.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\34963736F61353432323 : DHCPNameServer = [removed] [removed] 192.168.1.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\37C6861646C6561405 : DHCPNameServer = 192.168.1.10
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\4646D2772747 : DHCPNameServer = 192.168.69.1
TCP: Interfaces\{99607A83-EA44-4AE3-B2B3-968DD8A8DA35}\E4544574541425 : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
x64-Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
x64-Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck -
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\M_Hadley\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-1-25 56208]
R2 CLPSLS;COMODO livePCsupport Service;C:\Program Files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-2-19 148744]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-1-25 215552]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-9-28 395264]
S1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-5-13 591192]
S1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-5-13 304472]
S1 ElRawDisk;ElRawDisk;C:\Windows\System32\drivers\rsdrvx64.sys [2011-4-7 26024]
S2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-5-13 24408]
S2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-5-13 66904]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-1-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 DeviceMonitorService;DeviceMonitorService;C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-9-7 87992]
S2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
S2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-2 120728]
S2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-2-10 65657]
S2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-1-25 658656]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-1-8 161536]
S3 Andbus;LGE Android Platform Composite USB Device;C:\Windows\System32\drivers\lgandbus64.sys [2010-12-7 19456]
S3 AndDiag;LGE Android Platform USB Serial Port;C:\Windows\System32\drivers\lganddiag64.sys [2010-12-7 27648]
S3 AndGps;LGE Android Platform USB GPS NMEA Port;C:\Windows\System32\drivers\lgandgps64.sys [2010-12-7 27136]
S3 ANDModem;LGE Android Platform USB Modem;C:\Windows\System32\drivers\lgandmodem64.sys [2010-12-7 34304]
S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\System32\drivers\motfilt.sys [2009-1-29 6144]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2010-1-25 172704]
S3 HcwDevCentralService;HcwDevCentralService;C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [2012-10-18 291736]
S3 hcwE5bda;Hauppauge Siena Video Capture;C:\Windows\System32\drivers\hcwE5bda.sys [2012-10-18 555952]
S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\System32\drivers\motccgp.sys [2012-6-11 22016]
S3 motccgpfl;MotCcgpFlService;C:\Windows\System32\drivers\motccgpfl.sys [2012-1-25 9728]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\System32\drivers\Motousbnet.sys [2012-6-8 27136]
S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\System32\drivers\motusbdevice.sys [2011-11-8 11776]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-5 19456]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-5 57856]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-4-16 50176]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-16 1255736]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqladhlp.exe [2008-7-10 47128]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-9-22 370024]
.
=============== Created Last 30 ================
.
2013-02-22 18:27:01 20480 —-a-w- C:\Windows\svchost.exe
2013-02-22 09:36:03 76232 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\offreg.dll
2013-02-22 09:31:23 9162192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\mpengine.dll
2013-02-20 08:00:00 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Adobe
2013-02-18 16:06:12 ——– d—–w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-02-14 10:04:04 ——– d-sh–w- C:\found.002
2013-02-14 09:08:46 768000 —-a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:08:45 996352 —-a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:04:01 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2013-02-14 09:04:00 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-02-13 10:20:50 3153408 —-a-w- C:\Windows\System32\win32k.sys
2013-02-13 10:20:45 215040 —-a-w- C:\Windows\System32\winsrv.dll
2013-02-13 10:20:44 25600 —-a-w- C:\Windows\SysWow64\setup16.exe
2013-02-13 10:20:43 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll
2013-02-13 10:20:42 7680 —-a-w- C:\Windows\SysWow64\instnm.exe
2013-02-13 10:20:42 5120 —-a-w- C:\Windows\SysWow64\wow32.dll
2013-02-13 10:20:40 2048 —-a-w- C:\Windows\SysWow64\user.exe
2013-02-13 10:20:33 1913192 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2013-02-13 10:20:32 288088 —-a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2013-02-12 16:46:14 ——– d-sh–w- C:\found.001
2013-02-11 05:57:12 ——– d—–w- C:\Binaries
2013-02-11 05:57:04 ——– d—–w- C:\Program Files (x86)\Motorola Media Link
2013-02-11 05:53:52 ——– d—–w- C:\Program Files\Motorola Inc
2013-02-03 06:12:50 ——– d—–w- C:\components
2013-02-03 05:46:25 ——– d—–w- C:\Users\M_Hadley\AppData\Local\SwvUpdater
2013-02-03 05:46:13 ——– d—–w- C:\Program Files (x86)\Conduit
2013-02-03 05:44:17 ——– d—–w- C:\Users\M_Hadley\AppData\Local\Conduit
2013-02-03 05:43:45 ——– d—–w- C:\Users\M_Hadley\AppData\Local\CRE
2013-01-31 17:47:58 ——– d—–w- C:\Users\M_Hadley\AppData\Local\{6A1AFE86-CEAB-4A82-AF69-915CB7DAAE06}
2013-01-24 17:41:41 ——– d—–w- C:\Users\M_Hadley\AppData\Roaming\Roxio Log Files
2013-01-24 17:37:05 5 —-a-w- C:\Windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
.
==================== Find3M ====================
.
2013-02-19 05:45:25 71024 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-19 05:45:25 691568 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-02-12 02:04:16 861088 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-02-12 02:04:15 782240 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2013-01-17 07:28:58 273840 ——w- C:\Windows\System32\MpSigStub.exe
2013-01-09 01:19:09 2312704 —-a-w- C:\Windows\System32\jscript9.dll
2013-01-09 01:12:03 1392128 —-a-w- C:\Windows\System32\wininet.dll
2013-01-09 01:11:06 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl
2013-01-09 01:07:51 173056 —-a-w- C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:47 599040 —-a-w- C:\Windows\System32\vbscript.dll
2013-01-08 22:11:21 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:03:20 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:12 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 21:59:02 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:29 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll
2013-01-04 04:43:21 44032 —-a-w- C:\Windows\apppatch\acwow64.dll
2012-12-16 17:11:22 46080 —-a-w- C:\Windows\System32\atmlib.dll
2012-12-16 14:45:03 367616 —-a-w- C:\Windows\System32\atmfd.dll
2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll
2012-12-14 22:49:28 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys
2012-12-07 13:20:16 441856 —-a-w- C:\Windows\System32\Wpc.dll
2012-12-07 13:15:31 2746368 —-a-w- C:\Windows\System32\gameux.dll
2012-12-07 12:26:17 308736 —-a-w- C:\Windows\SysWow64\Wpc.dll
2012-12-07 12:20:43 2576384 —-a-w- C:\Windows\SysWow64\gameux.dll
2012-12-07 11:20:04 30720 —-a-w- C:\Windows\System32\usk.rs
2012-12-07 11:20:03 43520 —-a-w- C:\Windows\System32\csrr.rs
2012-12-07 11:20:03 23552 —-a-w- C:\Windows\System32\oflc.rs
2012-12-07 11:20:01 45568 —-a-w- C:\Windows\System32\oflc-nz.rs
2012-12-07 11:20:01 44544 —-a-w- C:\Windows\System32\pegibbfc.rs
2012-12-07 11:20:01 20480 —-a-w- C:\Windows\System32\pegi-fi.rs
2012-12-07 11:20:00 20480 —-a-w- C:\Windows\System32\pegi-pt.rs
2012-12-07 11:19:59 20480 —-a-w- C:\Windows\System32\pegi.rs
2012-12-07 11:19:58 46592 —-a-w- C:\Windows\System32\fpb.rs
2012-12-07 11:19:57 40960 —-a-w- C:\Windows\System32\cob-au.rs
2012-12-07 11:19:57 21504 —-a-w- C:\Windows\System32\grb.rs
2012-12-07 11:19:57 15360 —-a-w- C:\Windows\System32\djctq.rs
2012-12-07 11:19:56 55296 —-a-w- C:\Windows\System32\cero.rs
2012-12-07 11:19:55 51712 —-a-w- C:\Windows\System32\esrb.rs
2012-11-30 05:45:35 362496 —-a-w- C:\Windows\System32\wow64win.dll
2012-11-30 05:45:35 243200 —-a-w- C:\Windows\System32\wow64.dll
2012-11-30 05:45:35 13312 —-a-w- C:\Windows\System32\wow64cpu.dll
2012-11-30 05:43:12 16384 —-a-w- C:\Windows\System32\ntvdm64.dll
2012-11-30 05:41:07 424448 —-a-w- C:\Windows\System32\KernelBase.dll
2012-11-30 04:53:59 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48 338432 —-a-w- C:\Windows\System32\conhost.exe
2012-11-30 02:38:59 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 18:35:12.11 ===============


attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 5/15/2010 10:45:53 PM
System Uptime: 2/22/2013 5:52:39 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0G848F
Processor: Pentium® Dual-Core CPU T4400 @ 2.20GHz | Microprocessor | 2194/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 218 GiB total, 103.927 GiB free.
D: is CDROM ()
Z: is NetworkDisk (NTFS) - 189 GiB total, 51.422 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: avast! Network Shield Support
Device ID: ROOT\LEGACY_ASWTDI\0000
Manufacturer:
Name: avast! Network Shield Support
PNP Device ID: ROOT\LEGACY_ASWTDI\0000
Service: aswTdi
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer:
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
==== System Restore Points ===================
.
RP408: 2/15/2013 9:19:29 PM - Windows Update
RP409: 2/16/2013 3:00:28 AM - Windows Update
RP410: 2/17/2013 3:00:15 AM - Windows Update
RP411: 2/17/2013 10:29:05 PM - Windows Update
RP412: 2/17/2013 10:31:47 PM - Windows Update
RP413: 2/18/2013 3:00:12 AM - Windows Update
RP414: 2/18/2013 1:29:16 PM - Windows Update
RP415: 2/19/2013 3:00:22 AM - Windows Update
RP416: 2/20/2013 3:00:17 AM - Windows Update
RP417: 2/21/2013 3:00:14 AM - Windows Update
RP418: 2/22/2013 3:00:15 AM - Windows Update
RP419: 2/22/2013 9:10:56 AM - Installed Java 7 Update 15
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
ACID Xpress 7.0
Adobe AIR
Adobe Download Assistant
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Help Manager
Adobe Premiere Pro CS6
Adobe Reader XI (11.0.01)
Advanced Audio FX Engine
Amazon MP3 Downloader 1.0.12
Apple Application Support
Apple Software Update
ArcSoft ShowBiz
avast! Free Antivirus
AVS Audio Converter 7
AVS Audio Editor 7.1
AVS Audio Recorder version 4.0
AVS Photo Editor
AVS Screen Capture version 2.0.1
AVS Update Manager 1.0
AVS Video Converter 8
AVS Video Editor 6
AVS Video Recorder 2.5
AVS4YOU Software Navigator 1.4
Bandisoft MPEG-1 Decoder
BioShock 2
bl
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
CleanUp!
COMODO livePCsupport
Compatibility Pack for the 2007 Office system
D3DX10
dcmsvc 1.0
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell Dock
Dell Edoc Viewer
Dell Touchpad
Dell Webcam Central
Dell Wireless WLAN Card Utility
Dropbox
Epson Print CD
EPSON Printer Software
ESET Online Scanner v3
Facebook Video Calling 1.2.0.159
Facebook Video Calling 1.2.0.287
GimpShop 2.8
Google Chrome
Google Update Helper
GoToAssist 8.0.0.514
Hauppauge Device Central
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB945282)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946040)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB946308)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947540)
Hotfix for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB947789)
Hotfix for Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU (KB944899)
Intel® Graphics Media Accelerator Driver
Intel® Rapid Storage Technology
Intel® Matrix Storage Manager
Java 7 Update 15
Java Auto Updater
Junk Mail filter update
LG United Mobile Drivers
Live! Cam Avatar Creator
Malwarebytes Anti-Malware version 1.70.0.1100
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Management Objects
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server Compact 3.5 SP1 Design Tools English
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server VSS Writer
Microsoft VC9 runtime libraries
Microsoft Visual C# 2008 Express Edition with SP1 - ENU
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU
Microsoft Visual Studio 2008 Remote Debugger Light (x64) - ENU Service Pack 1 (KB945140)
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
Microsoft XNA Framework Redistributable 3.0
Microsoft XNA Framework Redistributable 3.1
Microsoft XNA Game Studio 3.1
Microsoft XNA Game Studio 3.1 (ARP entry)
Microsoft XNA Game Studio 3.1 (Platformer)
Microsoft XNA Game Studio 3.1 (Redists)
Microsoft XNA Game Studio 3.1 (Shared Components)
Microsoft XNA Game Studio 3.1 (VCSExpress)
Microsoft XNA Game Studio 3.1 (XnaLiveProxy)
Microsoft XNA Game Studio 3.1 Documentation
Microsoft XNA Game Studio 3.1 Zune Extensions
Microsoft XNA Game Studio Platform Tools
Microsoft_VC80_ATL_x86
Microsoft_VC80_ATL_x86_x64
Microsoft_VC80_CRT_x86
Microsoft_VC80_CRT_x86_x64
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFC_x86_x64
Microsoft_VC80_MFCLOC_x86
Microsoft_VC80_MFCLOC_x86_x64
Microsoft_VC90_ATL_x86
Microsoft_VC90_ATL_x86_x64
Microsoft_VC90_CRT_x86
Microsoft_VC90_CRT_x86_x64
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFC_x86_x64
MotoCast
MotoConnect
MotoHelper MergeModules
Motorola Device Manager
Motorola Device Software Update
MOTOROLA MEDIA LINK
Motorola Mobile Drivers Installation 5.9.0
Mozilla Firefox 18.0.2 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT Redists
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
ooVoo
Pando
Pando Media Booster
ph
PowerDVD DX
QuickTime
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Microsoft Visual C# 2008 Express Edition with SP1 - ENU (KB2251487)
Service Pack 3 for SQL Server 2008 (KB2546951)
Skype™ 6.1
Sql Server Customer Experience Improvement Program
SQL Server System CLR Types
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Visual C++ 8.0 Runtime Setup Package (x64)
Visual Studio 2008 x64 Redistributables
Warner Bros. Digital Copy Manager
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live OneCare safety scanner
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Mobile Device Updater Component
Yahoo! Messenger
Zune
Zune Language Pack (CHS)
Zune Language Pack (CHT)
Zune Language Pack (CSY)
Zune Language Pack (DAN)
Zune Language Pack (DEU)
Zune Language Pack (ELL)
Zune Language Pack (ESP)
Zune Language Pack (FIN)
Zune Language Pack (FRA)
Zune Language Pack (HUN)
Zune Language Pack (IND)
Zune Language Pack (ITA)
Zune Language Pack (JPN)
Zune Language Pack (KOR)
Zune Language Pack (MSL)
Zune Language Pack (NLD)
Zune Language Pack (NOR)
Zune Language Pack (PLK)
Zune Language Pack (PTB)
Zune Language Pack (PTG)
Zune Language Pack (RUS)
Zune Language Pack (SVE)
.
==== Event Viewer Messages From Past Week ========
.
2/22/2013 6:31:58 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
2/22/2013 5:55:45 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
2/22/2013 5:54:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2/22/2013 5:54:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
2/22/2013 5:54:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/22/2013 5:54:18 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
2/22/2013 5:53:59 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21
2/22/2013 5:53:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx aswSP aswTdi discache ElRawDisk spldr Wanarpv6
2/22/2013 5:53:28 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff800030abba0, 0xfffff880069d9a28, 0xfffff880069d9280). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022213-34491-01.
2/22/2013 3:06:21 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2799494).
2/22/2013 12:33:15 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800031c763a, 0x0000000000000001, 0x0000000000000018). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022213-41636-01.
2/22/2013 1:16:03 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff80002ed163f, 0xfffff88006c33a38, 0xfffff88006c33290). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022213-33103-01.
2/18/2013 1:39:54 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the HcwDevCentralService service to connect.
2/18/2013 1:39:54 PM, Error: Service Control Manager [7000] - The HcwDevCentralService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/18/2013 1:39:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service HcwDevCentralService with arguments "" in order to run the server: {91629C9E-A6A9-4F6A-8FD4-DD8EE54FEC19}
.
==== End Of File ===========================


RKreport

RogueKiller V8.5.1 [Feb 21 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Safe mode with network support
User : M_Hadley [Admin rights]
Mode : Scan – Date : 02/22/2013 19:45:23
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SVCHOST] svchost.exe – C:\Windows\\svchost.exe [x] -> KILLED [TermProc]

¤¤¤ Registry Entries : 6 ¤¤¤
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowUser (0) -> FOUND
[HJ SMENU] HKCU\[…]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ DESK] HKCU\[…]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts

ÿþ1

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HM250HI +++++
— User —
[MBR] 714008eb6e9f24a4e2f0143b58463179
[BSP] 9fb90d3ffbbd9dd65be595685260bd2d : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 223434 Mo
User != LL1 … KO!
— LL1 —
[MBR] 81a3dfa603382fe7b309e617742ea814
[BSP] 9fb90d3ffbbd9dd65be595685260bd2d : Windows Vista MBR Code
Partition table:
1 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 223434 Mo
User != LL2 … KO!
— LL2 —
[MBR] f422c3a2e25804b54a2e495407f8f578
[BSP] 7d12ba7f0c72df697c5b2a28b89020cb : TDL4 MBR Code!
Partition table:

Finished : << RKreport[1]_S_02222013_02d1945.txt >>
RKreport[1]_S_02222013_02d1945.txt



I also attached the 3 files incase i screwed up again. lol

From your RogueKiller log:

¤¤¤ Infection : Root.MBR ¤¤¤ <–that's the problem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please read the directions carefully so you don't end up deleting something that is good!!

If in doubt about an entry….please ask or choose Skip!!!!

Don't Delete anything unless instructed to!

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

If a suspicious object is detected, the default action will be Skip, click on Continue

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:
How To Run TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  [external image: Posted Image]
  
• Put a checkmark beside loaded modules.
  
  [external image: Posted Image]
  
• A reboot will be needed to apply the changes. Do it.
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
• Then click on Change parameters in TDSSKiller.
• Check all boxes then click OK.
  
  [external image: Posted Image]
  
• Click the Start Scan button.
  
  [external image: Posted Image]
  
• The scan should take no longer than 2 minutes.
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  [external image: Posted Image]
  
  Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  
  If in doubt about an entry….please ask or choose Skip
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  [external image: Posted Image]
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
• Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If in doubt about an entry….please ask or choose Skip

Don't Delete anything unless instructed to!

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

MrC

Alright, did that, here are the 4 logs that it gave. 19:39:38.0227 1836 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 19:39:38.0882 1836 ============================================================ 19:39:38.0882 1836 Current date / time: 2013/02/22 19:39:38.0882 19:39:38.0882 1836 SystemInfo: 19:39:38.0882 1836 19:39:38.0882 1836 OS Version: 6.1.7601 ServicePack: 1.0 19:39:38.0882 1836 Product type: Workstation 19:39:38.0882 1836 ComputerName: MATTS_PC 19:39:38.0882 1836 UserName: M_Hadley 19:39:38.0882 1836 Windows directory: C:\Windows 19:39:38.0882 1836 System windows directory: C:\Windows 19:39:38.0882 1836 Running under WOW64 19:39:38.0882 1836 Processor architecture: Intel x64 19:39:38.0882 1836 Number of processors: 2 19:39:38.0882 1836 Page size: 0x1000 19:39:38.0882 1836 Boot type: Safe boot with network 19:39:38.0882 1836 ============================================================ 19:39:40.0629 1836 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 19:39:40.0645 1836 ============================================================ 19:39:40.0645 1836 \Device\Harddisk0\DR0: 19:39:40.0645 1836 MBR partitions: 19:39:40.0645 1836 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000 19:39:40.0645 1836 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x1B465170 19:39:40.0645 1836 ============================================================ 19:39:40.0770 1836 C: <-> \Device\Harddisk0\DR0\Partition2 19:39:40.0770 1836 ============================================================ 19:39:40.0770 1836 Initialize success 19:39:40.0770 1836 ============================================================ 19:41:00.0807 1280 Deinitialize success 19:39:38.0227 1836 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 19:39:38.0882 1836 ============================================================ 19:39:38.0882 1836 Current date / time: 2013/02/22 19:39:38.0882 19:39:38.0882 1836 SystemInfo: 19:39:38.0882 1836 19:39:38.0882 1836 OS Version: 6.1.7601 ServicePack: 1.0 19:39:38.0882 1836 Product type: Workstation 19:39:38.0882 1836 ComputerName: MATTS_PC 19:39:38.0882 1836 UserName: M_Hadley 19:39:38.0882 1836 Windows directory: C:\Windows 19:39:38.0882 1836 System windows directory: C:\Windows 19:39:38.0882 1836 Running under WOW64 19:39:38.0882 1836 Processor architecture: Intel x64 19:39:38.0882 1836 Number of processors: 2 19:39:38.0882 1836 Page size: 0x1000 19:39:38.0882 1836 Boot type: Safe boot with network 19:39:38.0882 1836 ============================================================ 19:39:40.0629 1836 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 19:39:40.0645 1836 ============================================================ 19:39:40.0645 1836 \Device\Harddisk0\DR0: 19:39:40.0645 1836 MBR partitions: 19:39:40.0645 1836 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000 19:39:40.0645 1836 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x1B465170 19:39:40.0645 1836 ============================================================ 19:39:40.0770 1836 C: <-> \Device\Harddisk0\DR0\Partition2 19:39:40.0770 1836 ============================================================ 19:39:40.0770 1836 Initialize success 19:39:40.0770 1836 ============================================================ 19:41:00.0807 1280 Deinitialize success 20:02:13.0478 3292 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 20:02:13.0540 3292 ============================================================ 20:02:13.0540 3292 Current date / time: 2013/02/22 20:02:13.0540 20:02:13.0540 3292 SystemInfo: 20:02:13.0540 3292 20:02:13.0540 3292 OS Version: 6.1.7601 ServicePack: 1.0 20:02:13.0540 3292 Product type: Workstation 20:02:13.0540 3292 ComputerName: MATTS_PC 20:02:13.0540 3292 UserName: M_Hadley 20:02:13.0540 3292 Windows directory: C:\Windows 20:02:13.0540 3292 System windows directory: C:\Windows 20:02:13.0540 3292 Running under WOW64 20:02:13.0540 3292 Processor architecture: Intel x64 20:02:13.0540 3292 Number of processors: 2 20:02:13.0540 3292 Page size: 0x1000 20:02:13.0540 3292 Boot type: Normal boot 20:02:13.0540 3292 ============================================================ 20:02:13.0774 3292 BG loaded 20:02:14.0398 3292 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 20:02:14.0429 3292 ============================================================ 20:02:14.0429 3292 \Device\Harddisk0\DR0: 20:02:14.0461 3292 MBR partitions: 20:02:14.0461 3292 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000 20:02:14.0461 3292 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x1B465170 20:02:14.0461 3292 ============================================================ 20:02:14.0570 3292 C: <-> \Device\Harddisk0\DR0\Partition2 20:02:14.0570 3292 ============================================================ 20:02:14.0570 3292 Initialize success 20:02:14.0570 3292 ============================================================ 20:46:38.0345 1168 Deinitialize success 20:02:13.0478 3292 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 20:02:13.0540 3292 ============================================================ 20:02:13.0540 3292 Current date / time: 2013/02/22 20:02:13.0540 20:02:13.0540 3292 SystemInfo: 20:02:13.0540 3292 20:02:13.0540 3292 OS Version: 6.1.7601 ServicePack: 1.0 20:02:13.0540 3292 Product type: Workstation 20:02:13.0540 3292 ComputerName: MATTS_PC 20:02:13.0540 3292 UserName: M_Hadley 20:02:13.0540 3292 Windows directory: C:\Windows 20:02:13.0540 3292 System windows directory: C:\Windows 20:02:13.0540 3292 Running under WOW64 20:02:13.0540 3292 Processor architecture: Intel x64 20:02:13.0540 3292 Number of processors: 2 20:02:13.0540 3292 Page size: 0x1000 20:02:13.0540 3292 Boot type: Normal boot 20:02:13.0540 3292 ============================================================ 20:02:13.0774 3292 BG loaded 20:02:14.0398 3292 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 20:02:14.0429 3292 ============================================================ 20:02:14.0429 3292 \Device\Harddisk0\DR0: 20:02:14.0461 3292 MBR partitions: 20:02:14.0461 3292 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000 20:02:14.0461 3292 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x1B465170 20:02:14.0461 3292 ============================================================ 20:02:14.0570 3292 C: <-> \Device\Harddisk0\DR0\Partition2 20:02:14.0570 3292 ============================================================ 20:02:14.0570 3292 Initialize success 20:02:14.0570 3292 ============================================================ 20:46:38.0345 1168 Deinitialize success Again, I attached them all incase I doubled posted one.

Run TDSSKiller again and choose Delete for this one only if found: (no need to post the log)

19:54:27.0939 3028 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
19:54:27.0939 3028 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

——————————

Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

———->NOTE<———-

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix….please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

here's the combofix log

ComboFix.txt
ComboFix 13-02-23.01 - M_Hadley 02/23/2013 9:54.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3032.1656 [GMT -6:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\M_Hadley\AppData\Roaming\Start
c:\users\M_Hadley\AppData\Roaming\Start\temp_20E5ACDA\flash.10.0.32.18.ocx
c:\users\Public\invokesi.exe
c:\windows\svchost.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-01-23 to 2013-02-23 )))))))))))))))))))))))))))))))
.
.
2013-02-23 16:05 . 2013-02-23 16:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-02-23 15:57 . 2013-02-23 15:57 76232 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\offreg.dll
2013-02-23 01:54 . 2013-02-23 15:44 ——– d—–w- C:\TDSSKiller_Quarantine
2013-02-22 09:31 . 2013-02-08 00:28 9162192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{04B50849-81CE-4127-8EC8-1673A8B3DDC8}\mpengine.dll
2013-02-20 08:00 . 2013-02-23 08:00 ——– d—–w- c:\users\M_Hadley\AppData\Local\Adobe
2013-02-18 16:06 . 2013-02-22 15:16 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service
2013-02-15 22:04 . 2013-02-15 22:04 208448 —-a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
2013-02-14 10:04 . 2013-02-14 10:04 ——– d—–w- C:\found.002
2013-02-14 09:08 . 2013-01-08 22:01 768000 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:08 . 2013-01-09 01:10 996352 —-a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 09:04 . 2013-01-09 01:04 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2013-02-14 09:04 . 2013-01-08 21:56 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb
2013-02-13 10:21 . 2013-01-05 05:53 5553512 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-02-13 10:21 . 2013-01-05 05:00 3967848 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-02-13 10:20 . 2013-01-05 05:00 3913064 —-a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-02-13 10:20 . 2013-01-04 03:26 3153408 —-a-w- c:\windows\system32\win32k.sys
2013-02-13 10:20 . 2013-01-04 05:46 215040 —-a-w- c:\windows\system32\winsrv.dll
2013-02-13 10:20 . 2013-01-04 02:47 25600 —-a-w- c:\windows\SysWow64\setup16.exe
2013-02-13 10:20 . 2013-01-04 02:47 14336 —-a-w- c:\windows\SysWow64\ntvdm64.dll
2013-02-13 10:20 . 2013-01-04 04:51 5120 —-a-w- c:\windows\SysWow64\wow32.dll
2013-02-13 10:20 . 2013-01-04 02:47 7680 —-a-w- c:\windows\SysWow64\instnm.exe
2013-02-13 10:20 . 2013-01-04 02:47 2048 —-a-w- c:\windows\SysWow64\user.exe
2013-02-13 10:20 . 2013-01-03 06:00 1913192 —-a-w- c:\windows\system32\drivers\tcpip.sys
2013-02-13 10:20 . 2013-01-03 06:00 288088 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-12 16:46 . 2013-02-12 16:46 ——– d—–w- C:\found.001
2013-02-11 05:57 . 2013-02-11 05:57 ——– d—–w- C:\Binaries
2013-02-11 05:57 . 2013-02-11 05:57 ——– d—–w- c:\program files (x86)\Motorola Media Link
2013-02-11 05:53 . 2013-02-11 05:53 ——– d—–w- c:\program files\Motorola Inc
2013-02-03 06:12 . 2013-02-03 06:12 ——– d—–w- C:\components
2013-02-03 05:46 . 2013-02-12 21:19 ——– d—–w- c:\users\M_Hadley\AppData\Local\SwvUpdater
2013-02-03 05:46 . 2013-02-03 05:46 ——– d—–w- c:\program files (x86)\Conduit
2013-02-03 05:44 . 2013-02-03 06:13 ——– d—–w- c:\users\M_Hadley\AppData\Local\Conduit
2013-02-03 05:43 . 2013-02-03 05:43 ——– d—–w- c:\users\M_Hadley\AppData\Local\CRE
2013-02-02 06:22 . 2013-02-02 06:22 ——– d—–w- c:\program files (x86)\Common Files\Skype
2013-01-24 18:43 . 2013-01-24 18:43 ——– d—–w- c:\program files (x86)\Common Files\Java
2013-01-24 17:41 . 2013-01-24 17:41 ——– d—–w- c:\users\M_Hadley\AppData\Roaming\Roxio Log Files
2013-01-24 17:37 . 2013-02-11 05:55 5 —-a-w- c:\windows\SysWow64\lMMLDeleteUserData42107612FX.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-19 05:45 . 2012-04-06 20:25 691568 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-02-19 05:45 . 2011-10-03 04:37 71024 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 09:22 . 2010-05-24 03:10 70004024 —-a-w- c:\windows\system32\MRT.exe
2013-02-12 02:04 . 2012-06-26 23:22 861088 —-a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-02-12 02:04 . 2010-05-16 14:53 782240 —-a-w- c:\windows\SysWow64\deployJava1.dll
2013-01-17 07:28 . 2010-05-23 05:26 273840 ——w- c:\windows\system32\MpSigStub.exe
2013-01-04 04:43 . 2013-02-13 10:20 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-12-16 17:11 . 2012-12-21 17:13 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-21 17:13 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 17:13 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-21 17:13 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-14 22:49 . 2010-07-31 21:50 24176 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-12-07 13:20 . 2013-01-09 14:50 441856 —-a-w- c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-09 14:50 2746368 —-a-w- c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-09 14:50 308736 —-a-w- c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-09 14:50 2576384 —-a-w- c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-09 14:50 30720 —-a-w- c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-09 14:50 43520 —-a-w- c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-09 14:49 23552 —-a-w- c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-09 14:50 45568 —-a-w- c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-09 14:50 44544 —-a-w- c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-09 14:49 20480 —-a-w- c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-09 14:50 20480 —-a-w- c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-09 14:50 20480 —-a-w- c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-09 14:50 46592 —-a-w- c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-09 14:50 40960 —-a-w- c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-09 14:50 15360 —-a-w- c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-09 14:50 21504 —-a-w- c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-09 14:49 55296 —-a-w- c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-09 14:49 51712 —-a-w- c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-09 14:50 43520 —-a-w- c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-09 14:50 30720 —-a-w- c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-09 14:50 45568 —-a-w- c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-09 14:50 44544 —-a-w- c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-09 14:50 20480 —-a-w- c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-09 14:49 23552 —-a-w- c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-09 14:49 20480 —-a-w- c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-09 14:50 46592 —-a-w- c:\windows\SysWow64\fpb.rs
2012-12-07 10:46 . 2013-01-09 14:50 20480 —-a-w- c:\windows\SysWow64\pegi.rs
2012-12-07 10:46 . 2013-01-09 14:50 21504 —-a-w- c:\windows\SysWow64\grb.rs
2012-12-07 10:46 . 2013-01-09 14:50 40960 —-a-w- c:\windows\SysWow64\cob-au.rs
2012-12-07 10:46 . 2013-01-09 14:50 15360 —-a-w- c:\windows\SysWow64\djctq.rs
2012-12-07 10:46 . 2013-01-09 14:49 51712 —-a-w- c:\windows\SysWow64\esrb.rs
2012-12-07 10:46 . 2013-01-09 14:49 55296 —-a-w- c:\windows\SysWow64\cero.rs
2012-11-30 05:45 . 2013-01-09 14:49 362496 —-a-w- c:\windows\system32\wow64win.dll
2012-11-30 05:45 . 2013-01-09 14:49 243200 —-a-w- c:\windows\system32\wow64.dll
2012-11-30 05:45 . 2013-01-09 14:49 13312 —-a-w- c:\windows\system32\wow64cpu.dll
2012-11-30 05:43 . 2013-01-09 14:49 16384 —-a-w- c:\windows\system32\ntvdm64.dll
2012-11-30 05:41 . 2013-01-09 14:49 424448 —-a-w- c:\windows\system32\KernelBase.dll
2012-11-30 05:41 . 2013-01-09 14:49 1161216 —-a-w- c:\windows\system32\kernel32.dll
2012-11-30 05:38 . 2013-01-09 14:49 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:49 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 14:48 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-11-30 04:53 . 2013-01-09 14:49 274944 —-a-w- c:\windows\SysWow64\KernelBase.dll
2012-11-30 04:45 . 2013-01-09 14:49 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:49 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2012-11-30 04:45 . 2013-01-09 14:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-09-28 3077528]
"Facebook Update"="c:\users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]
"MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2013-02-11 2091]
"GoogleChromeAutoLaunch_9BE7B010AAB8FBB8FCEC93D0C0889376"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-01-26 1248208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...10.0.1325" [?]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2010-02-11 165184]
.
c:\users\M_Hadley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
Hauppauge Device Central Tray Tool.lnk - c:\program files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe [2012-10-18 578456]
IMVU.lnk - c:\users\M_Hadley\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe [N/A]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-9-21 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus64.sys [2010-12-07 19456]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag64.sys [2010-12-07 27648]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps64.sys [2010-12-07 27136]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem64.sys [2010-12-07 34304]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2009-01-30 6144]
R3 hcwE5bda;Hauppauge Siena Video Capture;c:\windows\system32\drivers\hcwE5bda.sys [2012-08-24 555952]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2012-06-11 22016]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2012-01-25 9728]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2012-06-08 27136]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2011-11-08 11776]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2010-10-21 82816]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-04-16 50176]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-16 1255736]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 370024]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\rsdrvx64.sys [2009-02-12 26024]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-11-28 66904]
S2 CLPSLS;COMODO livePCsupport Service;c:\program files (x86)\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-02-19 148744]
S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-09-08 87992]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-02 120728]
S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2011-09-02 65657]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-03-04 658656]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-06-15 172704]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-05-08 215552]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 09851698
*NewlyCreated* - 72318954
*Deregistered* - 09851698
*Deregistered* - 72318954
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-31 23:57 1607120 —-a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 05:45]
.
2013-02-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2960987146-3138209481-2465001290-1000Core.job
- c:\users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-29 22:17]
.
2013-02-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2960987146-3138209481-2465001290-1000UA.job
- c:\users\M_Hadley\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-29 22:17]
.
2013-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-03 20:29]
.
2013-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-03 20:29]
.
2013-02-22 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 134384 —-a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 —-a-w- c:\users\M_Hadley\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-01-23 305664]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-30 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-30 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-30 365080]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.facebook.com/
mDefault_Page_URL = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = local;192.168.*.*
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\M_Hadley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: microsoft.com\*.windowsupdate
Trusted Zone: microsoft.com\update
Trusted Zone: windowsupdate.com
TCP: DhcpNameServer = 8.8.8.8 8.8.4.4 [removed]
FF - ProfilePath - c:\users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{7F6AFBF1-E065-4627-A2FD-810366367D01} - c:\users\M_Hadley\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-ArcSoft Connection Service - c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
SafeBoot-09851698.sys
SafeBoot-21497578.sys
SafeBoot-88801330.sys
SafeBoot-99164432.sys
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-10 - (no file)
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2960987146-3138209481-2465001290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2960987146-3138209481-2465001290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_168_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_168.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-02-23 10:10:13
ComboFix-quarantined-files.txt 2013-02-23 16:10
.
Pre-Run: 111,263,772,672 bytes free
Post-Run: 110,761,656,320 bytes free
.
- - End Of File - - 30CC929C1CEE4D77A7CC223540AF0976

# AdwCleaner v2.112 - Logfile created 02/23/2013 at 12:36:23 # Updated 10/02/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : M_Hadley - MATTS_PC # Boot Mode : Normal # Running from : C:\Users\M_Hadley\Desktop\adwcleaner0.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** File Found : C:\END Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\ProgramData\boost_interprocess Folder Found : C:\Users\M_Hadley\AppData\Local\Conduit Folder Found : C:\Users\M_Hadley\AppData\Local\SwvUpdater Folder Found : C:\Users\M_Hadley\AppData\LocalLow\Conduit Folder Found : C:\Users\M_Hadley\AppData\LocalLow\PriceGong Folder Found : C:\Users\M_Hadley\AppData\LocalLow\ShoppingReport2 ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Found : HKCU\Software\AppDataLow\Software\Crossrider Key Found : HKCU\Software\AppDataLow\Software\PriceGong Key Found : HKCU\Software\AppDataLow\Software\ShoppingReport2 Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKCU\Software\Softonic Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3279141 Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Freeze.com Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B4DE90BB-150D-4B33-95FE-6BAAC97E1C21} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} Key Found : HKLM\SOFTWARE\Classes\Interface\{030C9927-10FC-4169-97A2-55BECD5D88D8} Key Found : HKLM\SOFTWARE\Classes\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} Key Found : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} Key Found : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C} Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16464 [OK] Registry is clean. -\\ Mozilla Firefox v18.0.2 (en-US) File : C:\Users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\prefs.js [OK] File is clean. -\\ Google Chrome v24.0.1312.57 File : C:\Users\M_Hadley\AppData\Local\Google\Chrome\User Data\Default\Preferences Found [l.8] : homepage = "hxxp://search.conduit.com/?CUI=UN32351292281003813&ctid=CT3279141&SearchSource=48&sspv=SP_CHWSP06", Found [l.1720] : homepage = "hxxp://search.conduit.com/?CUI=UN32351292281003813&ctid=CT3279141&SearchSource=48&sspv=SP_CHWSP06", -\\ Opera v [Unable to get version] File : C:\Users\M_Hadley\AppData\Roaming\Opera\Opera\operaprefs.ini [OK] File is clean. ************************* AdwCleaner[R1].txt - [4517 octets] - [23/02/2013 12:36:23] ########## EOF - C:\AdwCleaner[R1].txt - [4577 octets] ##########

AdwCleaner[S1].txt
# AdwCleaner v2.112 - Logfile created 02/23/2013 at 14:06:43
# Updated 10/02/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : M_Hadley - MATTS_PC
# Boot Mode : Normal
# Running from : C:\Users\M_Hadley\Desktop\adwcleaner0.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\END
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\Users\M_Hadley\AppData\Local\Conduit
Folder Deleted : C:\Users\M_Hadley\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\M_Hadley\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\M_Hadley\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\M_Hadley\AppData\LocalLow\ShoppingReport2

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport2
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3279141
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B4DE90BB-150D-4B33-95FE-6BAAC97E1C21}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{030C9927-10FC-4169-97A2-55BECD5D88D8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A1F1ECD3-4806-44C6-A869-F0DADF11C57C}
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Registry is clean.

-\\ Mozilla Firefox v18.0.2 (en-US)

File : C:\Users\M_Hadley\AppData\Roaming\Mozilla\Firefox\Profiles\h4m1eqba.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v24.0.1312.57

File : C:\Users\M_Hadley\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.8] : homepage = "hxxp://search.conduit.com/?CUI=UN32351292281003813&ctid=CT3279141&SearchSource=48[…]
Deleted [l.1720] : homepage = "hxxp://search.conduit.com/?CUI=UN32351292281003813&ctid=CT3279141&SearchSource=48&ss[…]

-\\ Opera v [Unable to get version]

File : C:\Users\M_Hadley\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4638 octets] - [23/02/2013 12:36:23]
AdwCleaner[R2].txt - [4698 octets] - [23/02/2013 14:06:26]
AdwCleaner[S1].txt - [4704 octets] - [23/02/2013 14:06:43]

########## EOF - C:\AdwCleaner[S1].txt - [4764 octets] ##########








checkup.txt
Results of screen317's Security Check version 0.99.59
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.70.0.1100
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox 18.0.2 Firefox out of Date!
Google Chrome 24.0.1312.56
Google Chrome 24.0.1312.57
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````