OK! We're moving this right along. However, this PC and my daughter are going to LA tomorrow for a 5 day trip and I am, believe it or not, going to Wisconsin for a 5 day knitting camp! I would bet you've never heard that one before! But I will try to get her to keep up with your instructions . We just won't be as responsive as we could be if we were all at home.
Here is the ESET scan (that was cool) -
C:\Qoobox\Quarantine\C\Users\Maddie\chrome143102.exe.vir a variant of Win32/Kryptik.BDGZ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\csrss306241.exe.vir a variant of Win32/Kryptik.BDTB trojan
C:\Qoobox\Quarantine\C\Users\Maddie\googleupdate.exe.vir a variant of Win32/Injector.AHLQ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\googleupdate475133.exe.vir a variant of Win32/Kryptik.BBRA trojan
C:\Qoobox\Quarantine\C\Users\Maddie\icq.exe.vir a variant of Win32/Injector.AHLQ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\icq488220.exe.vir a variant of Win32/Injector.AHLQ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\icq733930.exe.vir Win32/LockScreen.APR trojan
C:\Qoobox\Quarantine\C\Users\Maddie\teamviewer.exe.vir a variant of Win32/Injector.AHLQ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\AppData\Local\95f8956d-5cfc-4c53-81cb-6e93a0aeb25cad\fdcfcccbeaaebcad.exe.vir a variant of Win32/Injector.AHLQ trojan
C:\Qoobox\Quarantine\C\Users\Maddie\AppData\Roaming\dsnde.dll.vir a variant of Win32/Medfos.RI trojan
C:\Qoobox\Quarantine\C\Users\Maddie\AppData\Roaming\tasrag.dll.vir a variant of Win32/Medfos.RI trojan
C:\Qoobox\Quarantine\C\Users\Maddie\AppData\Roaming\Mozilla\Firefox\Profiles\ycdg6jbp.default\extensions\{27de232a-9f75-4e86-bf4c-044752a3088d}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan
C:\Qoobox\Quarantine\C\Users\Maddie\AppData\Roaming\Mozilla\Firefox\Profiles\ycdg6jbp.default\extensions\{27de232a-9f75-4e86-bf4c-044752a3088d}\chrome\xulcache.jar.vir Win32/TrojanDownloader.Tracur.V trojan
C:\Qoobox\Quarantine\C\Users\Sara\skype.exe.vir a variant of Win32/Kryptik.BESK trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\483fba40-295275d6 multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\639eddca-2378ffec Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\7c6a9e52-5f20757f multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\27b10455-4e5113f4 multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\24657f96-242a7754 Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\30841556-7dc019f4 Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\96a2bd6-5aad7399 multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\580c18d9-321a0e79 multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\7ca2221a-500eb7bf Java/Exploit.Agent.OLM trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\4403be24-7bb3d39d multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\2b399ea5-10f805b6 Java/Exploit.Agent.OKR trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\75a793a8-1b9f5e11 Java/Exploit.Agent.OLM trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\42ac8ded-52645e61 multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\42ac8ded-6631d20e multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\3a4da6af-70c4ef8e Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\61990970-138dfd2f Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\29370205-45465733 Java/Exploit.Agent.OLM trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\63125c34-2aecb5ec Java/Exploit.Agent.OLM trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\3efe71f5-6de44f0b multiple threats
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\3a5988ba-45f86c37 Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\4283c3ba-56e7c251 Java/Exploit.CVE-2012-0507.FY trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\25cdf43f-5da1c1fd Java/Exploit.Agent.OKR trojan
C:\Users\Maddie\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\bca1087-38c1f51f Java/Exploit.Agent.OJI trojan
C:\Users\Maddie\AppData\Roaming\Mozilla\Firefox\Profiles\ycdg6jbp.default\extensions\[removed] Win32/TrojanDownloader.Tracur.AD.Gen trojan
C:\Users\Maddie\AppData\Roaming\wabEventSupport16\{5e4f167b-c822-2d6f-966d-3b14267143ea}.exe a variant of Win32/Kryptik.BCOR trojan
C:\Users\Sara\AppData\Local\WinZip Computing\tdemcnry.dll Win32/Kryptik.BEOX.Gen trojan
C:\Users\Sara\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\37133aae-7fb49e1c multiple threats
C:\Users\Sara\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\7b572306-263bd516 Java/Exploit.Agent.OQR trojan
C:\_OTL\MovedFiles\07032013_110600\C_Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\waesa4h3.default\extensions\[removed] Win32/TrojanDownloader.Tracur.AD trojan
Here is the latest OTL report:
OTL logfile created on: 7/4/2013 12:27:52 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sara\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.80 Gb Total Physical Memory | 1.54 Gb Available Physical Memory | 40.54% Memory free
7.60 Gb Paging File | 5.26 Gb Available in Paging File | 69.16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 444.16 Gb Total Space | 269.81 Gb Free Space | 60.75% Space Free | Partition Type: NTFS
Drive D: | 21.31 Gb Total Space | 3.10 Gb Free Space | 14.56% Space Free | Partition Type: NTFS
Drive E: | 99.02 Mb Total Space | 83.96 Mb Free Space | 84.79% Space Free | Partition Type: FAT32
Computer Name: 13-15-17 | User Name: Sara | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Sara\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe (Giraffic)
PRC - C:\Program Files (x86)\Giraffic\Veoh_Giraffic.exe (Giraffic)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Secunia\CSI\csia-v5.0.1.1004.exe (Secunia)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.EXE (Intel Corporation)
PRC - C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
========== Modules (No Company Name) ==========
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\af525b4bec3b9941b7be8ffbf813da80\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7eac0dbe9aa20b55e37235f8ee030e6b\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\716959df79685a1eae0fc14275a32b0f\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\302207b4fa3083899fd8ab4db98cecc5\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d7d20811a7ce7cc589153648cbb1ce5c\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\dd20416f723ee13ffb4173ec1afc4ec4\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\HP.ActiveSupportLibrary\2.0.0.1__01a974bc1760f423\HP.ActiveSupportLibrary.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingServer.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingClients.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\RemotingClient.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingMessages.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\MessagingInterface.dll ()
MOD - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll ()
MOD - C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()
========== Services (SafeList) ==========
SRV:
64bit: - (MSSQL$IDIS) – C:\Program Files\Microsoft SQL Server 2008\MSSQL10.IDIS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV:
64bit: - (SQLAgent$IDIS) – C:\Program Files\Microsoft SQL Server 2008\MSSQL10.IDIS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV:
64bit: - (STacSV) – C:\Program Files\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV:
64bit: - (AESTFilters) – C:\Program Files\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)
SRV:
64bit: - (HPWMISVC) – C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe ()
SRV:
64bit: - (vcsFPService) – C:\Windows\SysNative\vcsFPService.exe (Validity Sensors, Inc.)
SRV:
64bit: - (DpHost) – C:\Program Files\DigitalPersona\Bin\DpHostW.exe (DigitalPersona, Inc.)
SRV:
64bit: - (HP Wireless Assistant Service) – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard)
SRV:
64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:
64bit: - (hpsrv) – C:\Windows\SysNative\hpservice.exe (Hewlett-Packard)
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Giraffic) – C:\Program Files (x86)\Giraffic\Veoh_GirafficWatchdog.exe (Giraffic)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) – C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (Secunia CSI Agent) – C:\Program Files (x86)\Secunia\CSI\csia-v5.0.1.1004.exe (Secunia)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (Symantec Corporation)
SRV - (BBSvc) – C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (Secunia PSI Agent) – C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (GameConsoleService) – C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (AdobeActiveFileMonitor9.0) – C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (UNS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.EXE (Intel Corporation)
SRV - (CinemaNow Service) – C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
SRV - (vcsFPService) – C:\Windows\SysWOW64\vcsFPService.exe (Validity Sensors, Inc.)
SRV - (LMS) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:
64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:
64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:
64bit: - (ctxusbm) – C:\Windows\SysNative\drivers\ctxusbm.sys (Citrix Systems, Inc.)
DRV:
64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:
64bit: - (RsFx0105) – C:\Windows\SysNative\drivers\RsFx0105.sys (Microsoft Corporation)
DRV:
64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:
64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symnets.sys (Symantec Corporation)
DRV:
64bit: - (BCM43XX) – C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:
64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtsp64.sys (Symantec Corporation)
DRV:
64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\NISx64\1207020.003\srtspx64.sys (Symantec Corporation)
DRV:
64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symefa64.sys (Symantec Corporation)
DRV:
64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:
64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:
64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1207020.003\symds64.sys (Symantec Corporation)
DRV:
64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1207020.003\ironx64.sys (Symantec Corporation)
DRV:
64bit: - (STHDA) – C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:
64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:
64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:
64bit: - (sdbus) – C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:
64bit: - (PSI) – C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:
64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:
64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:
64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:
64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:
64bit: - (DVMIO) – C:\Windows\SysNative\drivers\dvmio.sys (DeviceVM, Inc.)
DRV:
64bit: - (RSUSBSTOR) – C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:
64bit: - (IntcDAud) – C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:
64bit: - (Impcd) – C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:
64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:
64bit: - (HECIx64) – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:
64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:
64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:
64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:
64bit: - (hpdskflt) – C:\Windows\SysNative\drivers\hpdskflt.sys (Hewlett-Packard)
DRV:
64bit: - (Accelerometer) – C:\Windows\SysNative\drivers\Accelerometer.sys (Hewlett-Packard)
DRV:
64bit: - (SrvHsfV92) – C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:
64bit: - (SrvHsfWinac) – C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:
64bit: - (SrvHsfHDA) – C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:
64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:
64bit: - (netw5v64) – C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:
64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:
64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:
64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:
64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:
64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.009\ex64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.009\eng64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130702.001\BHDrvx64.sys (Symantec Corporation)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130703.001\IDSviA64.sys (Symantec Corporation)
DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) – c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl (CyberLink Corp.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:
64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE:
64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:
64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{BEC014D1-5C38-497B-914B-9C67BBBB7081}: "URL" =
http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
http://hp-notebook.us.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AC 05 AE 63 5D 77 CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" =
http://www.google.com/search?q={searchTerm…1I7WZPG_enUS428
IE - HKCU\..\SearchScopes\{B0F6A9E6-A20E-2078-1826-6C700C6E8C1D}: "URL" =
http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "
http://forums.whatthetech.com/index.php?showforum=27"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..extensions.enabledItems: [removed]:5.0.0.4248
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - user.js - File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:
64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:
64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Citrix.com/npican: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@hulu.com/Hulu Desktop: C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.11.1\npHDPlg.dll ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2012/01/31 11:05:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2010/07/11 05:12:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2 [2013/07/03 21:12:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/03 11:01:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/07/03 11:51:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/03 11:01:56 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/07/03 11:51:33 | 000,000,000 | —D | M]
[2010/11/03 21:33:28 | 000,000,000 | —D | M] (No name found) – C:\Users\Sara\AppData\Roaming\Mozilla\Extensions
[2013/07/03 11:06:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\waesa4h3.default\extensions
[2013/06/28 09:56:58 | 000,000,000 | —D | M] (New Tab) – C:\Users\Sara\AppData\Roaming\Mozilla\Firefox\Profiles\waesa4h3.default\extensions\{17B006F7-9D17-AFD7-4E0E-2A1EE4CCCF94}
[2013/07/03 11:50:36 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/07/03 11:01:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/07/03 11:02:03 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/10/21 15:21:02 | 000,003,803 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\MyHeritage.xml
O1 HOSTS File: ([2013/07/02 12:16:34 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:
64bit: - BHO: (HP SimplePass Identity Protection Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2:
64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (CtxIEInterceptorBHO Class) - {2C4631FF-5CC8-4EBC-A0DF-34C92291759E} - C:\Program Files (x86)\Citrix\ICA Client\IEInterceptor.dll (Citrix Systems, Inc.)
O2 - BHO: (HP SimplePass Identity Protection Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3:
64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:
64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O4:
64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:
64bit: - HKLM..\Run: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Company)
O4:
64bit: - HKLM..\Run: [HPToneControl] C:\Program Files\Hewlett-Packard\HPToneControl\HPToneCtl.exe (Hewlett-Packard )
O4:
64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:
64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe ()
O4:
64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files (x86)\HP\HP UT\bin\hppusg.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NOBuActivation.exe (Symantec Corporation)
O4 - HKCU..\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DD-ConsentPromptBehaviorAdmin = 5
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O10:
64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16:
64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16:
64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16:
64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Reg Error: Key error. (Java Plug-in 1.6.0_17)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} http://trial.trymicrosoftoffice.com/trialo…osoft/wrc32.ocx (WRC Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08F97A27-E31A-4CAB-AD5F-0CD0193A7436}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B27D8C6B-A7FF-4220-AB94-5943AE1DD670}: DhcpNameServer = [removed] [removed] [removed]
O18:
64bit: - Protocol\Handler\livecall - No CLSID value found
O18:
64bit: - Protocol\Handler\mhtb - No CLSID value found
O18:
64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:
64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:
64bit: - Protocol\Handler\msnim - No CLSID value found
O18:
64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:
64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\mhtb - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:
64bit: - Protocol\Filter\application/x-ica - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found
O18:
64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found
O18:
64bit: - Protocol\Filter\ica - No CLSID value found
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll) - C:\Program Files (x86)\Citrix\ICA Client\RSHook.dll (Citrix Systems, Inc.)
O20:
64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:
64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:
64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:
64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:
64bit: - HKLM\..comfile [open] – "%1" %*
O35:
64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:
64bit: - HKLM\…com [@ = ComFile] – "%1" %*
O37:
64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013/07/03 21:21:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\ESET
[2013/07/03 21:21:27 | 002,347,384 | —- | C] (ESET) – C:\Users\Sara\Desktop\esetsmartinstaller_enu.exe
[2013/07/03 11:51:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/07/03 11:51:33 | 000,867,240 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2013/07/03 11:51:33 | 000,263,592 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/07/03 11:51:26 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/07/03 11:51:26 | 000,175,016 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/07/03 11:51:26 | 000,096,168 | —- | C] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/07/03 11:23:18 | 000,000,000 | —D | C] – C:\ProgramData\McAfee
[2013/07/03 11:06:00 | 000,000,000 | —D | C] – C:\_OTL
[2013/07/03 11:01:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/07/02 12:40:59 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2013/07/01 12:05:54 | 000,000,000 | —D | C] – C:\Users\Sara\Desktop\RK_Quarantine
[2013/07/01 12:00:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\SafePCRepair_89EI
[2013/06/29 00:14:17 | 000,000,000 | —D | C] – C:\Users\Sara\Documents\Webcam
[2013/06/28 10:50:14 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2013/06/28 10:50:14 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2013/06/28 10:50:14 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2013/06/28 10:46:34 | 000,000,000 | —D | C] – C:\Qoobox
[2013/06/28 10:45:48 | 000,000,000 | —D | C] – C:\Windows\erdnt
[2013/06/28 10:32:48 | 005,084,517 | R— | C] (Swearware) – C:\Users\Sara\Desktop\ComboFix.exe
[2013/06/28 10:03:45 | 002,237,968 | —- | C] (Kaspersky Lab ZAO) – C:\Users\Sara\Desktop\TDSSKiller.exe
[2013/06/28 09:57:29 | 000,000,000 | —D | C] – C:\ProgramData\Wincert
[2013/06/28 09:54:46 | 000,000,000 | —D | C] – C:\Program Files (x86)\jZip
[2013/06/25 17:50:59 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Sara\Desktop\OTL.exe
[2013/06/23 01:46:53 | 000,000,000 | —D | C] – C:\Users\Sara\AppData\Local\HP
[2013/06/19 01:19:31 | 000,000,000 | —D | C] – C:\Users\Sara\AppData\Local\WinZip Computing
[2013/06/16 03:34:31 | 000,000,000 | —D | C] – C:\446d8c07b494da7e8d3b3634b5
[2013/06/15 16:55:07 | 000,000,000 | —D | C] – C:\ProgramData\oud
[2013/06/15 02:22:39 | 000,000,000 | —D | C] – C:\784485b5165376ca42
[2013/06/14 03:01:10 | 000,000,000 | —D | C] – C:\Windows\CheckSur
[2013/06/12 03:05:26 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2013/06/12 03:05:26 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2013/06/12 03:05:24 | 000,248,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/06/12 03:05:24 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2013/06/12 03:05:24 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2013/06/12 03:05:24 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/06/12 03:05:24 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2013/06/12 03:05:24 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2013/06/12 03:05:23 | 001,494,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2013/06/12 03:05:23 | 001,427,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2013/06/12 03:05:22 | 002,312,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/06/12 03:05:22 | 000,729,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/06/12 03:05:21 | 000,816,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/06/12 03:05:21 | 000,717,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/06/12 03:05:21 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2013/06/12 03:01:58 | 000,751,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\win32spl.dll
[2013/06/12 03:01:58 | 000,492,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\win32spl.dll
[2013/06/12 03:01:08 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\certenc.dll
[2013/06/12 03:01:08 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\certenc.dll
[2013/06/12 03:01:02 | 000,139,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2013/06/12 03:01:01 | 001,464,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013/06/12 03:01:01 | 001,192,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\certutil.exe
[2013/06/12 03:01:00 | 000,903,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\certutil.exe
[2013/06/12 02:08:45 | 000,000,000 | —D | C] – C:\found.001
========== Files - Modified Within 30 Days ==========
File not found – C:\Windows\SysNative\
[2013/07/04 00:21:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/04 00:17:02 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/03 23:08:00 | 000,000,932 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1011038383-1616736820-2125191817-1001UA.job
[2013/07/03 21:21:27 | 002,347,384 | —- | M] (ESET) – C:\Users\Sara\Desktop\esetsmartinstaller_enu.exe
[2013/07/03 21:19:54 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 21:19:54 | 000,023,248 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 21:12:57 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/03 21:12:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2013/07/03 21:12:13 | 3062,255,616 | -HS- | M] () – C:\hiberfil.sys
[2013/07/03 16:22:03 | 000,000,095 | —- | M] () – C:\Windows\DeleteOnReboot.bat
[2013/07/03 16:19:02 | 000,650,027 | —- | M] () – C:\Users\Sara\Desktop\AdwCleaner.exe
[2013/07/03 13:23:26 | 000,819,436 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/07/03 13:23:26 | 000,690,550 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/07/03 13:23:26 | 000,131,504 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/07/03 11:51:22 | 000,096,168 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013/07/03 11:51:21 | 000,263,592 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaws.exe
[2013/07/03 11:51:21 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\javaw.exe
[2013/07/03 11:51:21 | 000,175,016 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\java.exe
[2013/07/03 11:51:20 | 000,867,240 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\npDeployJava1.dll
[2013/07/03 11:51:20 | 000,789,416 | —- | M] (Oracle Corporation) – C:\Windows\SysWow64\deployJava1.dll
[2013/07/03 11:15:22 | 000,002,048 | —- | M] () – C:\Users\Sara\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/07/02 17:08:00 | 000,000,910 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1011038383-1616736820-2125191817-1001Core.job
[2013/07/02 12:16:34 | 000,000,027 | —- | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2013/07/02 11:50:08 | 000,914,944 | —- | M] () – C:\Users\Sara\Desktop\RogueKiller.exe
[2013/07/01 12:15:13 | 005,084,517 | R— | M] (Swearware) – C:\Users\Sara\Desktop\ComboFix.exe
[2013/06/28 10:03:34 | 000,000,999 | —- | M] () – C:\Users\Sara\Application Data\Microsoft\Internet Explorer\Quick Launch\jZip.lnk
[2013/06/26 02:33:09 | 000,000,786 | —- | M] () – C:\Users\Sara\Desktop\Internet Security Pro.lnk
[2013/06/25 17:51:00 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Sara\Desktop\OTL.exe
[2013/06/22 14:07:32 | 000,002,984 | —- | M] () – C:\{211BBA13-BC5A-4153-ABBD-3BBE095337C6}
[2013/06/22 13:38:49 | 000,002,712 | —- | M] () – C:\{80ABAF77-329C-4343-B5C1-6288D294C488}
[2013/06/20 17:55:30 | 000,002,448 | —- | M] () – C:\{828C86EE-3AC6-4960-88F5-C51F4F0B12D8}
[2013/06/15 18:31:19 | 000,002,968 | —- | M] () – C:\{418E483D-30C9-4EAF-AC97-4A881ECBF13A}
[2013/06/12 02:40:17 | 000,002,568 | —- | M] () – C:\{49362698-4FD8-44C3-9CEE-3F4E4B541CBC}
[2013/06/12 00:17:38 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 00:17:38 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/11 02:48:00 | 000,003,000 | —- | M] () – C:\{99AD3361-ED19-4C13-B578-9A2D66EB7FBD}
[2013/06/11 02:32:09 | 000,002,992 | —- | M] () – C:\{AAC57FFA-BACF-4548-84C6-189027B2AB91}
[2013/06/11 02:18:30 | 000,002,976 | —- | M] () – C:\{D3D33118-C2F4-4B17-9BBC-0026A3B53F24}
[2013/06/08 14:28:07 | 000,000,336 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForMaddie.job
[2013/06/07 02:56:34 | 000,003,056 | —- | M] () – C:\{39FE4522-2BCF-46B2-9351-26F81B36E5B3}
[2013/06/07 02:56:33 | 000,002,224 | —- | M] () – C:\{AA87CF32-AE69-4D12-A3C2-F183A0DA3D56}
========== Files Created - No Company Name ==========
File not found – C:\Windows\SysNative\
[2013/07/03 16:21:56 | 000,000,095 | —- | C] () – C:\Windows\DeleteOnReboot.bat
[2013/07/03 16:19:02 | 000,650,027 | —- | C] () – C:\Users\Sara\Desktop\AdwCleaner.exe
[2013/07/02 11:50:00 | 000,914,944 | —- | C] () – C:\Users\Sara\Desktop\RogueKiller.exe
[2013/06/28 10:50:14 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2013/06/28 10:50:14 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2013/06/28 10:50:14 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2013/06/28 10:50:14 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2013/06/28 10:50:14 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2013/06/28 10:03:34 | 000,000,999 | —- | C] () – C:\Users\Sara\Application Data\Microsoft\Internet Explorer\Quick Launch\jZip.lnk
[2013/06/24 17:01:47 | 000,000,786 | —- | C] () – C:\Users\Sara\Desktop\Internet Security Pro.lnk
[2013/06/22 14:07:30 | 000,002,984 | —- | C] () – C:\{211BBA13-BC5A-4153-ABBD-3BBE095337C6}
[2013/06/22 13:38:48 | 000,002,712 | —- | C] () – C:\{80ABAF77-329C-4343-B5C1-6288D294C488}
[2013/06/20 17:55:30 | 000,002,448 | —- | C] () – C:\{828C86EE-3AC6-4960-88F5-C51F4F0B12D8}
[2013/06/15 18:31:19 | 000,002,968 | —- | C] () – C:\{418E483D-30C9-4EAF-AC97-4A881ECBF13A}
[2013/06/12 02:40:17 | 000,002,568 | —- | C] () – C:\{49362698-4FD8-44C3-9CEE-3F4E4B541CBC}
[2013/06/11 02:47:59 | 000,003,000 | —- | C] () – C:\{99AD3361-ED19-4C13-B578-9A2D66EB7FBD}
[2013/06/11 02:32:08 | 000,002,992 | —- | C] () – C:\{AAC57FFA-BACF-4548-84C6-189027B2AB91}
[2013/06/11 02:18:30 | 000,002,976 | —- | C] () – C:\{D3D33118-C2F4-4B17-9BBC-0026A3B53F24}
[2013/06/07 02:56:33 | 000,003,056 | —- | C] () – C:\{39FE4522-2BCF-46B2-9351-26F81B36E5B3}
[2013/06/07 02:56:33 | 000,002,224 | —- | C] () – C:\{AA87CF32-AE69-4D12-A3C2-F183A0DA3D56}
[2010/12/19 02:04:34 | 000,150,016 | —- | C] () – C:\Users\Sara\10356187.pot
========== ZeroAccess Check ==========
[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/02/27 00:52:56 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/02/26 23:55:05 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/13 20:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 03:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/13 20:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== Alternate Data Streams ==========
@Alternate Data Stream - 99 bytes -> C:\ProgramData\Temp:346465CA
< End of report >
Thanks for all your help! This is really progressing! I'll check in the morning before I leave.
It's important that you follow through with the remainder of the steps I will outline. Absence of symptoms doesn't necessarily translate into malware free. 
![[external image: Posted Image]](http://s1269.photobucket.com/user/OCD-WTT/media/start.jpg.html){kind=link}
![[external image: Posted Image]](http://s1269.photobucket.com/user/OCD-WTT/media/CFwindows-7-start-menu_zps188282d2.jpg.html){kind=link}