Computer Way too Slow [Solved]

I did the scans and here are my logs. THANKS!!!

OTL Log

%USERPROFILE%\..|smtmp;true;true;true /FP
%temp%\smtmp\*.* /s >
/md5start
iexplore.*
explorer.*
winlogon.*
dll
zx.dll
hlp.dat
consrv.dll
services.*
/md5stop
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

EXTRAS LOG from OTL

OTL Extras logfile created on: 7/13/2013 12:32:33 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Heather\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

6.00 Gb Total Physical Memory | 3.24 Gb Available Physical Memory | 54.06% Memory free
11.99 Gb Paging File | 9.21 Gb Available in Paging File | 76.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 62.05 Gb Free Space | 20.82% Space Free | Partition Type: NTFS

Computer Name: GALACTICA | User Name: Heather | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] – C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistUMP] – "C:\Program Files (x86)\UMPlayer\umplayer.exe" -add-to-playlist "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithUMP] – "C:\Program Files (x86)\UMPlayer\umplayer.exe" -play-dir "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistUMP] – "C:\Program Files (x86)\UMPlayer\umplayer.exe" -add-to-playlist "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithUMP] – "C:\Program Files (x86)\UMPlayer\umplayer.exe" -play-dir "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0281A428-1A1A-419A-B130-09FFEF3988B9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{073B9B05-BFBD-4A78-8CB1-FAD33C331E51}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0D03DC3A-12D5-453B-9599-54560B73055E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0F135789-2370-45DD-A994-36A18170DCDD}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{131F2080-D192-4632-92F2-45F69F061EB4}" = lport=138 | protocol=17 | dir=in | app=system |
"{16B78F47-33E1-4059-97E4-572CB1775B4A}" = lport=137 | protocol=17 | dir=in | app=system |
"{1D36688E-BF31-4646-AFA1-B4F8FF572197}" = rport=445 | protocol=6 | dir=out | app=system |
"{2310FA4D-2F9B-4AB5-802B-8E479AE997AA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3F0E0CF4-59C3-4607-B3EC-C5BAB33BE911}" = rport=138 | protocol=17 | dir=out | app=system |
"{46367368-5E1C-4162-8448-E2896A8CFC56}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5AE31918-0E25-4D6E-A12E-E0EF8E232C41}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6FDEEACB-A525-48AC-B5D8-0CDD28A0D44D}" = rport=137 | protocol=17 | dir=out | app=system |
"{717CDF79-1129-49D1-A134-7403BD4A6AAC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7C12F3F2-183C-4422-BB6E-0017B12FDF9A}" = rport=139 | protocol=6 | dir=out | app=system |
"{820E74A8-9564-481F-A5B9-797E9EF92A84}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{949F2A39-CD1A-4057-89BE-426B36429A3A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A838CCAE-D002-43DA-85CA-09CCC1684E68}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B87ED3FE-56AD-42FE-8AD8-35F916279FEB}" = rport=10243 | protocol=6 | dir=out | app=system |
"{C25661D3-A895-462D-A90D-158B1E575C48}" = lport=445 | protocol=6 | dir=in | app=system |
"{DDD5D959-1BCD-4ECE-A679-77E4AD747DD9}" = lport=139 | protocol=6 | dir=in | app=system |
"{E8CC2DC6-099F-42E2-A673-9BDB241B8F13}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EB8C253D-F8F8-4E7C-B045-7E5C485B5E0C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F50A1C95-350A-4FE7-B37A-3AE62DD5BFEF}" = lport=10243 | protocol=6 | dir=in | app=system |
"{FFD978A2-0191-4DE6-9818-C0297FCD8117}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0037749C-1E25-420E-80C7-ED0BF70617A6}" = protocol=6 | dir=in | app=c:\program files (x86)\goforfiles\goforfilesdl.exe |
"{00E8C365-02C1-4B4C-BF0C-571C7549555E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{0AEDA4AC-0177-4684-AFFD-BF7DFB77C016}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{0B9B3A00-C51F-405B-B11C-2387F03D0865}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{125B8A36-E0B5-4F08-8B79-65FD257E1356}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{132BDD39-46B1-43B5-A00E-1F038B3D9137}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{170BE018-E245-48EC-B0CD-8112C8E90BF7}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{1832AC81-2600-41F4-9ADB-BBC26BA39854}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{18A394D7-BB57-4812-ACD7-C55E59295033}" = protocol=17 | dir=in | app=c:\program files (x86)\goforfiles\goforfiles.exe |
"{19EF106E-85AE-4DB6-9159-CCB788D84F14}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{1B98D29C-F0AE-4B77-9193-7193E63A631F}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe |
"{1C66F2FC-77E6-42E6-BD15-A81F0E4CE89E}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{2F17E334-848E-4588-842F-4711AF391167}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{37463F9B-9103-4CFB-AA31-5A9E7FD3FD6D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{391C96A4-FFE8-4D92-95E7-4649CE79B1A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{41ECFB72-82DB-4A29-8EA2-6B4264708E48}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4245723E-6115-432C-BB32-A3E8637A6F52}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{49C1C632-10A9-40F4-96C0-25C85B8B938A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{52EB1BA3-25F0-450F-8E8F-DBF88B3BFF8A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5C1FC979-3AF7-4508-BD6C-0654AFE10225}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{5F77E5EF-7661-4ED0-93C2-41C30577D338}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6204459D-0A45-4FF6-BD25-1871FFB4C6F8}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{62410B5E-E323-4F44-B844-189D0CB1A195}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6E5D490F-1AD5-456D-B11A-94C70BC84A0E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7057DB54-3EA2-4871-A20A-5F8B882ABD4F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{769AB587-BE67-4FFC-A7D6-65EAAE4DB0C2}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe |
"{76C9581E-F313-4760-8DAE-433ADE298433}" = dir=in | app=c:\program files (x86)\motorola mobility\motocast\bin\motocast-thumbnailer.exe |
"{76E50C1E-1AAD-4CAD-A8AD-59252D8F3868}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{7FE7997E-A134-4A8E-AA86-284234A91D91}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{806EE75A-4A58-414E-81A3-16C6153AC9D6}" = protocol=6 | dir=out | app=system |
"{836A2ECC-1A14-4436-858A-BB157445CDE7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{8BAE2F38-35E9-4952-8C44-0BD0C8F32288}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8D256AA8-C98F-4913-9724-D4F48915C95E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{958EBDA1-C09C-42BE-909D-ADB4B74B829E}" = dir=in | app=c:\program files (x86)\motorola mobility\motocast\motocast.exe |
"{97DB1462-7736-4835-8F71-0C26940F41B6}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe |
"{9A9F03D0-28BF-4B03-845C-B4ECB15562F0}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{9F1142FD-A62F-4EF1-B138-38354232B08C}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{A10C1A80-26C9-4467-A9F5-D731389879F5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A5FE92E6-449B-4384-BFD4-481DA0F1AD07}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A908D3FD-6534-4957-ACDB-6EEDF6AB918D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{AA26FC7C-9CC6-4504-9D43-9BD760605FE4}" = protocol=6 | dir=in | app=c:\program files (x86)\goforfiles\goforfiles.exe |
"{BDDAAFDE-3B41-449E-BDBD-D80444957A6D}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{C1994594-79E6-4580-B8D8-499638E591FE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CAAB5F25-E1CE-4C71-9170-0B9114D628D3}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{CE70F9D5-5EAD-4165-8A40-E59BDF677890}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{D56FD8D6-CBB6-4B5F-9907-5EDBD41197D1}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{D61D70BC-F767-4244-BD54-7A3385A12B6C}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{E1117D56-924A-4B41-89D2-5BBC7EDEFB74}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{E15C521E-FBDA-4EC6-B303-06BA6606832F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E43DEA91-4409-45DB-89BE-230CB2BDD7BD}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E85AE0FD-B13E-4CA7-B09B-CE3F34B4E8B9}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe |
"{E9BDE0F5-7A52-4EFC-B75B-69DBCA9946DB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EA92A6AF-17FF-47CD-8D29-59B2B5F32CF2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F0048F15-08EB-449A-B8E9-8FA22050AC57}" = dir=in | app=c:\program files (x86)\motorola media link\lite\mml.exe |
"{F1076453-47B6-4967-A646-C2015B797333}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F59E23F5-2413-4F87-8EEB-E031BA25137A}" = protocol=17 | dir=in | app=c:\program files (x86)\goforfiles\goforfilesdl.exe |
"{FAB5A45A-B2CC-4FB1-9DDB-163328EC6979}" = dir=out | app=c:\program files (x86)\motorola mobility\motocast\bin\motocast-thumbnailer.exe |
"{FD291FCD-2E0E-461A-92F1-B74E6705A188}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe |
"{FF384417-1B28-4826-AAB1-F6C81D471051}" = dir=out | app=c:\program files (x86)\motorola mobility\motocast\motocast.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{26A24AE4-039D-4CA4-87B4-2F86416031FF}" = Java™ 6 Update 31 (64-bit)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{4E7CCB76-687B-4C53-9A5E-08780AF3A551}" = Motorola Mobile Drivers Installation 5.9.0
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{76FF0F03-B707-4332-B5D1-A56C8303514E}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{AE7891D8-2340-4CD6-BA0A-6C8C01F7B4B4}" = AVG 2013
"{F5AA006A-1ABE-4F16-B6E1-FEE1F7D38102}" = AVG 2013
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AVG" = AVG 2013
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserDefender
"{177CD779-4EEC-43C5-8DEA-4E0EC103624B}" = Driver Manager
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F22808B-156F-44FB-B56B-9E8F8C8DC8F5}" = Motorola Device Software Update
"{21593B51-6838-41A1-A420-7283B4E02A33}" = SavvyConnect
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{28DB8373-C1BB-444F-A427-A55585A12ED7}" = Motorola Device Manager
"{378397D6-FD32-4092-A854-6A75CB7EDA46}" = MOTOROLA MEDIA LINK
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5401CEE8-3C2D-4835-A802-213306537FF4}" = MotoCast
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISER_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{CEF7211D-CE3A-44C4-B321-D84A2099AE94}" = Comcast Desktop Software (v1.2.0.9)
"{D07205E7-F6D3-4333-AFCC-782A07685B72}" = OverDrive Media Console
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"appbario12 Toolbar" = appbario12 Toolbar
"AVG Secure Search" = AVG Security Toolbar
"Bejeweled Deluxe 1.862" = Bejeweled Deluxe 1.862
"delta" = Delta toolbar
"Delta Chrome Toolbar" = Delta Chrome Toolbar
"ENTERPRISER" = Microsoft Office Enterprise 2007
"Hoyle Crosswords-Sudoku" = Hoyle Crosswords-Sudoku
"I Want This" = I Want This
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 14.0.1 (x86 en-US)" = Mozilla Firefox 14.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Norton PC Checkup_is1" = Norton PC Checkup
"NortonPCCheckup" = Norton PC Checkup
"UMPlayer" = UMPlayer 0.98 [P4]

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/16/2013 7:01:58 PM | Computer Name = Galactica | Source = CltMngSvc | ID = 1000
Description =

Error - 6/16/2013 7:02:04 PM | Computer Name = Galactica | Source = Application Error | ID = 1000
Description = Faulting application name: CltMngSvc.exe, version: 1.5.0.71, time
stamp: 0x5189ee17 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting process
id: 0x1954 Faulting application start time: 0x01ce6ae580fb30ce Faulting application
path: C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe Faulting module path:
C:\Windows\SysWOW64\ntdll.dll Report Id: c2864c88-d6d8-11e2-891a-002564420e46

Error - 6/16/2013 7:02:30 PM | Computer Name = Galactica | Source = CltMngSvc | ID = 1000
Description =

Error - 6/16/2013 7:02:30 PM | Computer Name = Galactica | Source = Application Error | ID = 1000
Description = Faulting application name: CltMngSvc.exe, version: 1.5.0.71, time
stamp: 0x5189ee17 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting process
id: 0x1424 Faulting application start time: 0x01ce6ae59413edb3 Faulting application
path: C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe Faulting module path:
C:\Windows\SysWOW64\ntdll.dll Report Id: d1d2ff11-d6d8-11e2-891a-002564420e46

Error - 6/16/2013 7:02:46 PM | Computer Name = Galactica | Source = CltMngSvc | ID = 1000
Description =

Error - 6/16/2013 7:02:46 PM | Computer Name = Galactica | Source = Application Error | ID = 1000
Description = Faulting application name: CltMngSvc.exe, version: 1.5.0.71, time
stamp: 0x5189ee17 Faulting module name: ntdll.dll, version: 6.1.7601.17725, time
stamp: 0x4ec49b8f Exception code: 0xc0000374 Fault offset: 0x000ce6c3 Faulting process
id: 0x1894 Faulting application start time: 0x01ce6ae59d8f486e Faulting application
path: C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe Faulting module path:
C:\Windows\SysWOW64\ntdll.dll Report Id: db49ecec-d6d8-11e2-891a-002564420e46

Error - 6/16/2013 7:06:42 PM | Computer Name = Galactica | Source = Application Hang | ID = 1002
Description = The program iLividSetup-r390-n-bc.exe version 4.0.0.2901 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 1ac4 Start
Time: 01ce6ae5853b5b6d Termination Time: 6 Application Path: C:\Users\Heather\Downloads\iLividSetup-r390-n-bc.exe

Report
Id:

Error - 6/16/2013 7:08:09 PM | Computer Name = Galactica | Source = CltMngSvc | ID = 1000
Description =

Error - 6/16/2013 7:27:54 PM | Computer Name = Galactica | Source = Microsoft-Windows-CAPI2 | ID = 513
Description = Cryptographic Services failed while processing the OnIdentity() call
in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image
of binary COMODO Internet Security Eradication Driver. System Error: The system cannot
find the file specified. .

Error - 6/16/2013 7:27:54 PM | Computer Name = Galactica | Source = Microsoft-Windows-CAPI2 | ID = 513
Description = Cryptographic Services failed while processing the OnIdentity() call
in the System Writer Object. Details: AddWin32ServiceFiles: Unable to back up image
of service COMODO Internet Security Helper Service since QueryServiceConfig API
failed System Error: The system cannot find the file specified. .

[ Media Center Events ]
Error - 6/8/2011 5:32:53 PM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 4:32:53 PM - Failed to retrieve SportsSchedule (Error: The underlying
connection was closed: Could not establish trust relationship for the SSL/TLS secure
channel.)

Error - 6/8/2011 5:32:53 PM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 4:32:53 PM - Failed to retrieve SportsV2 (Error: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS secure channel.)


Error - 6/8/2011 5:32:53 PM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 4:32:53 PM - Failed to retrieve Broadband (Error: The underlying connection
was closed: Could not establish trust relationship for the SSL/TLS secure channel.)


Error - 6/11/2011 5:19:31 PM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 4:19:31 PM - Failed to retrieve Directory (Error: The underlying connection
was closed: An unexpected error occurred on a receive.)

Error - 6/15/2011 10:48:46 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 9:47:55 AM - Error connecting to the internet. 9:48:07 AM - Unable
to contact server..

Error - 6/16/2011 5:20:34 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 4:20:32 AM - Error connecting to the internet. 4:20:32 AM - Unable
to contact server..

Error - 6/16/2011 11:05:16 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 10:05:13 AM - Error connecting to the internet. 10:05:13 AM - Unable
to contact server..

Error - 6/17/2011 11:07:34 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 10:05:17 AM - Failed to retrieve SportsSchedule (Error: The operation
has timed out)

Error - 6/18/2012 8:00:21 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 8:00:20 AM - Error connecting to the internet. 8:00:20 AM - Unable
to contact server..

Error - 8/10/2012 8:27:38 AM | Computer Name = Galactica | Source = MCUpdate | ID = 0
Description = 8:26:34 AM - Error connecting to the internet. 8:26:42 AM - Unable
to contact server..

[ OSession Events ]
Error - 6/2/2011 5:49:24 PM | Computer Name = Galactica | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 6343
seconds with 5520 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/23/2013 12:41:51 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7022
Description = The Windows Update service hung on starting.

Error - 6/24/2013 10:07:05 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the avgwd service.

Error - 6/24/2013 10:07:51 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7043
Description = The AVGIDSAgent service did not shut down properly after receiving
a preshutdown control.

Error - 6/26/2013 7:33:44 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/26/2013 7:33:48 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 6/26/2013 7:39:22 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7022
Description = The Windows Update service hung on starting.

Error - 7/4/2013 7:17:48 PM | Computer Name = Galactica | Source = DCOM | ID = 10010
Description =

Error - 7/4/2013 7:19:13 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7034
Description = The vToolbarUpdater15.3.0 service terminated unexpectedly. It has
done this 1 time(s).

Error - 7/4/2013 10:05:36 PM | Computer Name = Galactica | Source = DCOM | ID = 10010
Description =

Error - 7/13/2013 12:33:02 PM | Computer Name = Galactica | Source = Service Control Manager | ID = 7000
Description = The Symantec Eraser Control driver service failed to start due to
the following error: %%2


< End of report >

Hijack This Log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:18:15 PM, on 7/13/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16611)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scui\SavvyConnectUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\McUicnt.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406?appid=390
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;192.168.*.*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll
O2 - BHO: CrossriderApp0002258 - {11111111-1111-1111-1111-110011221158} - C:\Program Files (x86)\I Want This\I Want This.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SavvyConnect IE Extension - {E6C6EC35-C04A-42CD-A3A7-4F09FB0F1B76} - C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\ieplugin\LuthIEPlugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [SavvyConnectMenu] "C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scui\SavvyConnectUI.exe" -a
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden
O4 - HKCU\..\Run: [Google Update] "C:\Users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Driver Manager] C:\Program Files (x86)\Driver Manager\Driver Manager\DriverManager.exe /applicationMode:systemTray /showWelcome:false
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [MotoCast] "C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk"
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device… - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (file missing)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: DeviceMonitorService - Nero AG - C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
O23 - Service: Motorola Device Manager Service (Motorola Device Manager) - Unknown owner - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton PC Checkup Application Launcher - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
O23 - Service: Common Client Job Manager Service (PCCUJobMgr) - Symantec Corporation - C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PST Service - Motorola - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SavvyConnect Desktop Service (SCService) - Unknown owner - C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scservice\SCService.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater15.3.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 14029 bytes

DDS Log

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by [removed] at 13:19:05.17 on Sat 07/13/2013
Internet Explorer: 9.10.9200.16614 BrowserJavaVersion: 10.25.2
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6140.2664 [GMT -4:00]
.
AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\STacSV64.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scservice\SCService.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\loggingserver.exe
C:\Windows\system32\conhost.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files (x86)\Driver Manager\Driver Manager\DriverManager.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scui\SavvyConnectUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\McUicnt.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\Downloads\OTL.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Users\Heather\Downloads\HiJackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Heather\Desktop\dds.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchnu.com/406?appid=390
uInternet Settings,ProxyOverride = *.local;192.168.*.*
uURLSearchHooks: H - No File
mURLSearchHooks: H - No File
mWinlogon: Userinit=userinit.exe
BHO: MSS+ Identifier: {0e8a89ad-95d7-40eb-8d9d-083ef7066a01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll
BHO: I Want This: {11111111-1111-1111-1111-110011221158} - C:\Program Files (x86)\I Want This\I Want This.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: SavvyConnect IE Extension: {e6c6ec35-c04a-42cd-a3a7-4f09fb0f1b76} - C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\ieplugin\LuthIEPlugin.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden
uRun: [Google Update] "C:\Users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Driver Manager] C:\Program Files (x86)\Driver Manager\Driver Manager\DriverManager.exe /applicationMode:systemTray /showWelcome:false
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [MotoCast] "C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
mRun: [SavvyConnectMenu] "C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scui\SavvyConnectUI.exe" -a
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll
AppInit_DLLs:
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
BHO-X64: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll
BHO-X64: WormRadar.com IESiteBlocker.NavFilter - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
BHO-X64: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
BHO-X64: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB-X64: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
mRun-x64: [Apoint] C:\Program Files\DellTPad\Apoint.exe
mRun-x64: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
mRun-x64: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
AppInit_DLLs-X64:
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Heather\AppData\Roaming\Mozilla\Firefox\Profiles\u6k3h4gr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN20463168086412132&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Delta Search
FF - prefs.js: browser.startup.homepage - hxxp://www.delta-search.com/?affID=119294&tt=120613_ndt&babsrc=HP_ss&mntrId=3EAC0024D651CD15
FF - component: C:\Program Files (x86)\AVG\AVG10\Firefox4\components\avgssff4.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: C:\Program Files (x86)\AVG\AVG10\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: C:\Program Files (x86)\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\npsitesafety.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
FF - plugin: C:\Users\Heather\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
—- FIREFOX POLICIES —-
FF - user.js: extensions.privitize.hpOld0 - hxxp://searchou.com/?id=3eacb7ea0000000000000024d651cd15&affilt=5
FF - user.js: extensions.privitize.tlbrSrchUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5&q=
FF - user.js: extensions.privitize.id - 3eacb7ea00000000000000ff40e49dc2
FF - user.js: extensions.privitize.appId - {301966DF-A84B-4255-AAB9-574B5CE237E4}
FF - user.js: extensions.privitize.instlDay - 15872
FF - user.js: extensions.privitize.vrsn - [removed]
FF - user.js: extensions.privitize.vrsni - [removed]
FF - user.js: extensions.privitize.vrsnTs - 1.8.21.617:44:17
FF - user.js: extensions.privitize.prtnrId - privitize
FF - user.js: extensions.privitize.prdct - privitize
FF - user.js: extensions.privitize.aflt - 5
FF - user.js: extensions.privitize.smplGrp - none
FF - user.js: extensions.privitize.tlbrId - base
FF - user.js: extensions.privitize.instlRef -
FF - user.js: extensions.privitize.dfltLng -
FF - user.js: extensions.privitize.excTlbr - false
FF - user.js: extensions.privitize.ffxUnstlRst - false
FF - user.js: extensions.privitize.admin - false
FF - user.js: extensions.privitize.autoRvrt - false
FF - user.js: extensions.privitize.rvrt - false
FF - user.js: extensions.privitize.hmpg - true
FF - user.js: extensions.privitize.hmpgUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5
FF - user.js: extensions.privitize.dfltSrch - true
FF - user.js: extensions.privitize.srchPrvdr - Search The Web (privitize)
FF - user.js: extensions.privitize.kw_url - hxxp://searchou.com/?q={searchTerms}&id=3eacb7ea00000000000000ff40e49dc2&affilt=5
FF - user.js: extensions.privitize.dnsErr - true
FF - user.js: extensions.privitize.newTab - true
FF - user.js: extensions.privitize.newTabUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 3eacb7ea0000000000000024d651cd15
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15872
FF - user.js: extensions.delta.vrsn - [removed]
FF - user.js: extensions.delta.vrsni - [removed]
FF - user.js: extensions.delta.vrsnTs - 1.8.21.519:25:47
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119294&tt=120613_ndt
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-16 111968]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]
R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-2-15 45856]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-13 59904]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe [2010-11-23 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-11-23 203264]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-16 5814904]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
R2 DeviceMonitorService;DeviceMonitorService;C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [2012-9-7 87992]
R2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-2 120728]
R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [2013-6-24 132504]
R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [2012-6-30 126392]
R2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-5-6 65657]
R2 SCService;SavvyConnect Desktop Service;C:\Program Files (x86)\Luth Research\SavvyConnectFramework\bin\scservice\SCService.exe [2013-1-8 1892352]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-5-14 3289208]
R3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\System32\drivers\NETw5s64.sys [2010-1-14 6952960]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-11-23 215552]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\System32\drivers\vwifimp.sys [2009-7-13 17920]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2010-11-23 393728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]
S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-6-26 1598128]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-5-12 256904]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-4-10 1025352]
S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2010-1-15 35104]
S3 itecir;ITECIR Infrared Receiver;C:\Windows\System32\drivers\itecir.sys [2009-10-8 60416]
S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2009-6-10 270848]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-12 113120]
S3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\drivers\taphss6.sys [2013-1-10 42184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-4 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-11-29 1255736]
.
=============== Created Last 30 ================
.
2013-06-26 23:46:16 96168 —-a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-16 23:25:47 ——– d—–w- C:\PROGRA~3\BrowserDefender
2013-06-16 23:25:46 ——– d—–w- C:\Program Files (x86)\Delta
2013-06-16 23:25:45 ——– d—–w- C:\Users\Heather\AppData\Roaming\Delta
2013-06-16 23:25:44 ——– d—–w- C:\Users\Heather\AppData\Roaming\BabSolution
2013-06-16 23:25:34 ——– d—–w- C:\Users\Heather\AppData\Roaming\Babylon
2013-06-16 23:25:34 ——– d—–w- C:\PROGRA~3\Babylon
2013-06-16 23:25:32 ——– d—–w- C:\Users\Heather\AppData\Roaming\GoforFiles
2013-06-16 23:25:32 ——– d—–w- C:\Program Files (x86)\GoforFiles
2013-06-16 23:20:33 ——– d—–w- C:\PROGRA~3\StarApp
2013-06-16 23:19:58 ——– d—–w- C:\PROGRA~3\InstallMate
2013-06-16 23:02:45 ——– d—–w- C:\Program Files (x86)\Conduit
2013-06-16 23:02:42 ——– d—–w- C:\Users\Heather\AppData\Local\Conduit
2013-06-16 23:02:42 ——– d—–w- C:\Program Files (x86)\appbario12
2013-06-16 23:02:26 ——– d—–w- C:\Users\Heather\AppData\Local\CRE
2013-06-16 23:02:08 ——– d—–w- C:\Users\Heather\AppData\Local\iLivid
2013-06-16 23:01:36 ——– d—–w- C:\Program Files (x86)\MyPC Backup
2013-06-16 23:01:15 ——– d—–w- C:\Users\Heather\AppData\Roaming\SpeedAnalysis2
2013-06-16 23:00:59 ——– d—–w- C:\Users\Heather\AppData\Roaming\File Scout
2013-06-16 23:00:58 ——– d—–w- C:\PROGRA~3\IBUpdaterService
2013-06-16 21:20:54 ——– d—–w- C:\Users\Heather\AppData\Roaming\DownLite
2013-06-16 21:20:37 ——– d—–w- C:\Users\Heather\AppData\Roaming\OpenCandy
.
==================== Find3M ====================
.
2013-06-26 23:46:12 867240 —-a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-06-26 23:46:12 789416 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2013-06-26 23:34:13 45856 —-a-w- C:\Windows\System32\drivers\avgtpx64.sys
2013-06-12 03:15:30 71048 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 03:15:30 692104 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-08 12:28:46 2706432 —-a-w- C:\Windows\System32\mshtml.tlb
2013-06-08 11:13:19 2706432 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2013-06-04 23:48:13 9728 —ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-17 01:25:57 1767936 —-a-w- C:\Windows\SysWow64\wininet.dll
2013-05-17 01:25:27 2877440 —-a-w- C:\Windows\SysWow64\jscript9.dll
2013-05-17 01:25:26 61440 —-a-w- C:\Windows\SysWow64\iesetup.dll
2013-05-17 01:25:26 109056 —-a-w- C:\Windows\SysWow64\iesysprep.dll
2013-05-17 00:59:03 2241024 —-a-w- C:\Windows\System32\wininet.dll
2013-05-17 00:58:10 3958784 —-a-w- C:\Windows\System32\jscript9.dll
2013-05-17 00:58:08 67072 —-a-w- C:\Windows\System32\iesetup.dll
2013-05-17 00:58:08 136704 —-a-w- C:\Windows\System32\iesysprep.dll
2013-05-14 12:23:25 89600 —-a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-14 08:40:13 71680 —-a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-05-13 05:51:01 184320 —-a-w- C:\Windows\System32\cryptsvc.dll
2013-05-13 05:51:00 1464320 —-a-w- C:\Windows\System32\crypt32.dll
2013-05-13 05:51:00 139776 —-a-w- C:\Windows\System32\cryptnet.dll
2013-05-13 05:50:40 52224 —-a-w- C:\Windows\System32\certenc.dll
2013-05-13 04:45:55 140288 —-a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55 1160192 —-a-w- C:\Windows\SysWow64\crypt32.dll
2013-05-13 04:45:55 103936 —-a-w- C:\Windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55 1192448 —-a-w- C:\Windows\System32\certutil.exe
2013-05-13 03:08:10 903168 —-a-w- C:\Windows\SysWow64\certutil.exe
2013-05-13 03:08:06 43008 —-a-w- C:\Windows\SysWow64\certenc.dll
2013-05-10 05:49:27 30720 —-a-w- C:\Windows\System32\cryptdlg.dll
2013-05-10 03:20:54 24576 —-a-w- C:\Windows\SysWow64\cryptdlg.dll
2013-05-08 06:39:01 1910632 —-a-w- C:\Windows\System32\drivers\tcpip.sys
2013-05-01 07:59:12 94208 —-a-w- C:\Windows\SysWow64\QuickTimeVR.qtx
2013-05-01 07:59:12 69632 —-a-w- C:\Windows\SysWow64\QuickTime.qts
2013-04-26 05:51:36 751104 —-a-w- C:\Windows\System32\win32spl.dll
2013-04-26 04:55:21 492544 —-a-w- C:\Windows\SysWow64\win32spl.dll
2013-04-25 23:30:32 1505280 —-a-w- C:\Windows\SysWow64\d3d11.dll
2013-04-17 07:02:06 1230336 —-a-w- C:\Windows\SysWow64\WindowsCodecs.dll
2013-04-17 06:24:46 1424384 —-a-w- C:\Windows\System32\WindowsCodecs.dll
2010-10-28 19:10:46 166 —-a-w- C:\Program Files\MapScript.bat
.
============= FINISH: 13:19:38.18 ===============

Attach Log from DDS

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/29/2010 10:54:06 AM
System Uptime: 7/13/2013 10:50:19 AM (3 hours ago)
.
Motherboard: Dell Inc. | |
Processor: Intel® Core™2 Duo CPU P8700 @ 2.53GHz | Microprocessor | 785/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 298 GiB total, 61.429 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP185: 6/4/2013 7:37:47 PM - Windows Update
RP186: 6/4/2013 7:38:25 PM - Scheduled Checkpoint
RP187: 6/4/2013 7:44:20 PM - Windows Modules Installer
RP189: 6/16/2013 5:14:40 PM - Windows Update
RP190: 6/16/2013 6:39:44 PM - Device Driver Package Install: COMODO Network Service
RP191: 6/16/2013 7:27:35 PM - Windows Update
RP192: 6/24/2013 9:39:10 PM - Scheduled Checkpoint
RP193: 6/26/2013 7:43:03 PM - Installed Java 7 Update 25
RP194: 7/4/2013 10:05:37 PM - Scheduled Checkpoint
RP195: 7/13/2013 12:38:06 PM - OTL Restore Point - 7/13/2013 12:38:05 PM
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.1)
appbario12 Toolbar
Apple Application Support
Apple Software Update
AVG Security Toolbar
Bejeweled Deluxe 1.862
BrowserDefender
Comcast Desktop Software (v1.2.0.9)
Delta Chrome Toolbar
Delta toolbar
Driver Manager
Google Chrome
Hoyle Crosswords-Sudoku
I Want This
Java 7 Update 25
Java Auto Updater
Java™ 6 Update 31
JavaFX 2.1.1
McAfee Security Scan Plus
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MotoCast
Motorola Device Manager
Motorola Device Software Update
MOTOROLA MEDIA LINK
Mozilla Firefox 14.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
Norton PC Checkup
OverDrive Media Console
QuickTime
SavvyConnect
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Skype Click to Call
Skype™ 6.3
UMPlayer 0.98 [P4]
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Visual Studio 2008 x64 Redistributables
.
==== Event Viewer Messages From Past Week ========
.
7/13/2013 12:33:02 PM, Error: Service Control Manager [7000] - The Symantec Eraser Control driver service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================

Thanks so much for the help! I removed the programs you listed.

The only problem was with appbario12 toolbar.

I removed it from Firefox and Chrome but it won't let me uninstall it under Control Panel -> Programs Features
When I click on uninstall nothing happens.

I downloaded the program and the results are listed below. Thanks again!

Diagnostic Report (1.9.0027.0):
—————————————–
Windows Validation Data–>

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
Windows Product ID: 00359-OEM-8992687-00095
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {220D6F3A-D1B6-42EB-BD8F-ED213C199738}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130318-1533
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data–>
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data–>
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data–>
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data–>
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data–>
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Heather\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data–>

Other data–>
Office Details: {220D6F3A-D1B6-42EB-BD8F-ED213C199738}1.9.0027.06.1.7601.2.00010300.1.0.003x64*****-*****-*****-*****-RMV8200359-OEM-8992687-000952S-1-5-21-3027918190-1659419789-3035849352Dell Inc.Inspiron 1545 Dell Inc.A1420091207000000.000000+000AB803107018400F804090409Eastern Standard Time(GMT-05:00)03DELL WN09 100

Spsys.log Content: 0x80070002

Licensing Data–>
Software licensing service version: 6.1.7601.17514

Name: Windows® 7, HomePremium edition
Description: Windows Operating System - Windows® 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800095-02-1033-7600.0000-0152010
Installation ID: 015690147750358605846446405280600386964362706470925256
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: RMV82
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 7/15/2013 8:13:01 PM

Windows Activation Technologies–>
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 5:4:2013 13:15
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data–>
HWID Hash Current: LgAAAAEAAQABAAEAAAABAAAAAwABAAEAonbaWvrA2jO25eYmVG0QkYy2FPJGyg==

OEM Activation 1.0 Data–>
N/A

OEM Activation 2.0 Data–>
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL WN09
FACP DELL WN09
HPET DELL WN09
MCFG DELL WN09
SLIC DELL WN09
SSDT PmRef CpuPm

Thanks, and here is the log. ComboFix 13-07-15.01 - Heather 07/16/2013 20:02:07.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6140.4431 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-06-17 to 2013-07-17 ))))))))))))))))))))))))))))))) . . 2013-07-17 00:09 . 2013-07-17 00:09 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-07-16 00:29 . 2013-07-16 00:29 ——– d—–w- c:\program files\Enigma Software Group 2013-07-16 00:28 . 2013-07-16 01:01 ——– d—–w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP 2013-07-16 00:28 . 2013-07-16 00:28 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-07-15 23:53 . 2013-07-16 00:13 ——– d—–w- C:\MGADiagToolOutput 2013-07-15 23:52 . 2013-07-15 23:52 ——– d—–w- c:\programdata\Office Genuine Advantage 2013-07-14 23:45 . 2013-06-11 23:25 15404032 —-a-w- c:\windows\system32\ieframe.dll 2013-07-14 23:45 . 2013-06-11 23:25 19238912 —-a-w- c:\windows\system32\mshtml.dll 2013-07-13 16:45 . 2013-05-27 05:50 1011712 —-a-w- c:\program files\Windows Defender\MpSvc.dll 2013-07-13 16:45 . 2013-05-27 05:50 571904 —-a-w- c:\program files\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 04:57 392704 —-a-w- c:\program files (x86)\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 05:50 314880 —-a-w- c:\program files\Windows Defender\MpCommu.dll 2013-07-13 16:45 . 2013-05-27 04:57 54784 —-a-w- c:\program files (x86)\Windows Defender\MpOAV.dll 2013-07-13 16:45 . 2013-05-27 03:15 9216 —-a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll 2013-07-13 16:45 . 2013-05-27 04:57 4608 —-a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll 2013-07-13 16:45 . 2013-06-04 06:00 624128 —-a-w- c:\windows\system32\qedit.dll 2013-07-13 16:45 . 2013-06-04 04:53 509440 —-a-w- c:\windows\SysWow64\qedit.dll 2013-07-13 16:45 . 2013-05-06 06:03 1887744 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-13 16:45 . 2013-05-06 04:56 1620480 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-07-13 16:44 . 2013-06-05 03:34 3153920 —-a-w- c:\windows\system32\win32k.sys 2013-07-13 16:44 . 2013-04-10 05:48 1732608 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-13 16:44 . 2013-04-10 05:46 1367040 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:44 . 2013-04-10 05:46 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-13 16:44 . 2013-04-10 05:46 1393152 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-13 16:44 . 2013-04-10 05:03 936448 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:43 . 2013-04-09 23:34 1247744 —-a-w- c:\windows\SysWow64\DWrite.dll 2013-07-13 16:43 . 2013-04-02 22:51 1643520 —-a-w- c:\windows\system32\DWrite.dll 2013-06-26 23:46 . 2013-06-26 23:46 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-06-26 23:46 . 2013-06-26 23:46 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-16 00:08 . 2012-05-13 02:38 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-16 00:08 . 2011-06-25 14:47 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-14 23:47 . 2010-01-15 16:40 78185248 —-a-w- c:\windows\system32\MRT.exe 2013-06-26 23:46 . 2012-07-21 21:00 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-06-26 23:46 . 2011-04-06 01:54 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-06-04 23:50 . 2013-06-04 23:50 226304 —-a-w- c:\windows\system32\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 185344 —-a-w- c:\windows\SysWow64\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 158720 —-a-w- c:\windows\SysWow64\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-06-04 23:50 . 2013-06-04 23:50 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 523264 —-a-w- c:\windows\SysWow64\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 138752 —-a-w- c:\windows\SysWow64\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 38400 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\SysWow64\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 61952 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-06-04 23:50 . 2013-06-04 23:50 361984 —-a-w- c:\windows\SysWow64\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 452096 —-a-w- c:\windows\system32\dxtmsft.dll 2013-06-04 23:50 . 2013-06-04 23:50 441856 —-a-w- c:\windows\system32\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 281600 —-a-w- c:\windows\system32\dxtrans.dll 2013-06-04 23:50 . 2013-06-04 23:50 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 216064 —-a-w- c:\windows\system32\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 197120 —-a-w- c:\windows\system32\msrating.dll 2013-06-04 23:50 . 2013-06-04 23:50 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 81408 —-a-w- c:\windows\system32\icardie.dll 2013-06-04 23:50 . 2013-06-04 23:50 762368 —-a-w- c:\windows\system32\ieapfltr.dll 2013-06-04 23:50 . 2013-06-04 23:50 270848 —-a-w- c:\windows\system32\iedkcs32.dll 2013-06-04 23:50 . 2013-06-04 23:50 235008 —-a-w- c:\windows\system32\url.dll 2013-06-04 23:50 . 2013-06-04 23:50 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-06-04 23:50 . 2013-06-04 23:50 97280 —-a-w- c:\windows\system32\mshtmled.dll 2013-06-04 23:50 . 2013-06-04 23:50 27648 —-a-w- c:\windows\system32\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 247296 —-a-w- c:\windows\system32\webcheck.dll 2013-06-04 23:50 . 2013-06-04 23:50 1509376 —-a-w- c:\windows\system32\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 102912 —-a-w- c:\windows\system32\inseng.dll 2013-06-04 23:50 . 2013-06-04 23:50 599552 —-a-w- c:\windows\system32\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 167424 —-a-w- c:\windows\system32\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 144896 —-a-w- c:\windows\system32\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 62976 —-a-w- c:\windows\system32\pngfilt.dll 2013-06-04 23:50 . 2013-06-04 23:50 52224 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-06-04 23:50 . 2013-06-04 23:50 51200 —-a-w- c:\windows\system32\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 173568 —-a-w- c:\windows\system32\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 149504 —-a-w- c:\windows\system32\occache.dll 2013-06-04 23:50 . 2013-06-04 23:50 13824 —-a-w- c:\windows\system32\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 136192 —-a-w- c:\windows\system32\iepeers.dll 2013-06-04 23:50 . 2013-06-04 23:50 135680 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\system32\msfeedssync.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 77312 —-a-w- c:\windows\system32\tdc.ocx 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 465920 —-a-w- c:\windows\system32\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 1682432 —-a-w- c:\windows\system32\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 1158144 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 3928064 —-a-w- c:\windows\system32\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 2565120 —-a-w- c:\windows\system32\d3d10warp.dll 2013-06-04 23:48 . 2013-06-04 23:48 2284544 —-a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 363008 —-a-w- c:\windows\system32\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 220160 —-a-w- c:\windows\SysWow64\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 207872 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1175552 —-a-w- c:\windows\system32\FntCache.dll 2013-06-04 23:48 . 2013-06-04 23:48 1080832 —-a-w- c:\windows\SysWow64\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 333312 —-a-w- c:\windows\system32\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 296960 —-a-w- c:\windows\system32\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 194560 —-a-w- c:\windows\system32\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1238528 —-a-w- c:\windows\system32\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 648192 —-a-w- c:\windows\system32\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 293376 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 221184 —-a-w- c:\windows\system32\UIAnimation.dll 2013-06-04 23:48 . 2013-06-04 23:48 1988096 —-a-w- c:\windows\SysWow64\d3d10warp.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2013-05-07 2055] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-18 1080096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [x] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x] S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x] S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [x] S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x] S4 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x] S4 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x] S4 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - ESGIGUARD *Deregistered* - Avgldx64 *Deregistered* - Avgloga . Contents of the 'Scheduled Tasks' folder . 2013-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 00:08] . 2013-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000Core.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . 2013-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000UA.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-04-05 384296] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-11-07 487424] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.searchnu.com/406?appid=390 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 FF - ProfilePath - c:\users\Heather\AppData\Roaming\Mozilla\Firefox\Profiles\u6k3h4gr.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN20463168086412132&UM=2&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - about:home FF - user.js: extensions.privitize.hpOld0 - hxxp://searchou.com/?id=3eacb7ea0000000000000024d651cd15&affilt=5 FF - user.js: extensions.privitize.tlbrSrchUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5&q= FF - user.js: extensions.privitize.id - 3eacb7ea00000000000000ff40e49dc2 FF - user.js: extensions.privitize.appId - {301966DF-A84B-4255-AAB9-574B5CE237E4} FF - user.js: extensions.privitize.instlDay - 15872 FF - user.js: extensions.privitize.vrsn - [removed] FF - user.js: extensions.privitize.vrsni - [removed] FF - user.js: extensions.privitize.vrsnTs - 1.8.21.617:44 FF - user.js: extensions.privitize.prtnrId - privitize FF - user.js: extensions.privitize.prdct - privitize FF - user.js: extensions.privitize.aflt - 5 FF - user.js: extensions.privitize.smplGrp - none FF - user.js: extensions.privitize.tlbrId - base FF - user.js: extensions.privitize.instlRef - FF - user.js: extensions.privitize.dfltLng - FF - user.js: extensions.privitize.excTlbr - false FF - user.js: extensions.privitize.ffxUnstlRst - false FF - user.js: extensions.privitize.admin - false FF - user.js: extensions.privitize.autoRvrt - false FF - user.js: extensions.privitize.rvrt - false FF - user.js: extensions.privitize.hmpg - true FF - user.js: extensions.privitize.hmpgUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dfltSrch - true FF - user.js: extensions.privitize.srchPrvdr - Search The Web (privitize) FF - user.js: extensions.privitize.kw_url - hxxp://searchou.com/?q={searchTerms}&id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dnsErr - true FF - user.js: extensions.privitize.newTab - true FF - user.js: extensions.privitize.newTabUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - 3eacb7ea0000000000000024d651cd15 FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} FF - user.js: extensions.delta.instlDay - 15872 FF - user.js: extensions.delta.vrsn - [removed] FF - user.js: extensions.delta.vrsni - [removed] FF - user.js: extensions.delta.vrsnTs - 1.8.21.519:25 FF - user.js: extensions.delta.prtnrId - delta FF - user.js: extensions.delta.prdct - delta FF - user.js: extensions.delta.aflt - babsst FF - user.js: extensions.delta.smplGrp - none FF - user.js: extensions.delta.tlbrId - base FF - user.js: extensions.delta.instlRef - sst FF - user.js: extensions.delta.dfltLng - en FF - user.js: extensions.delta.excTlbr - false FF - user.js: extensions.delta.ffxUnstlRst - true FF - user.js: extensions.delta.admin - false FF - user.js: extensions.delta_i.babTrack - affID=119294&tt=120613_ndt FF - user.js: extensions.delta_i.babExt - FF - user.js: extensions.delta_i.srcExt - ss FF - user.js: extensions.delta.autoRvrt - false FF - user.js: extensions.delta.rvrt - false FF - user.js: extensions.delta.newTab - false . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll Toolbar-10 - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-07-16 20:12:27 ComboFix-quarantined-files.txt 2013-07-17 00:12 . Pre-Run: 71,934,386,176 bytes free Post-Run: 74,246,307,840 bytes free . - - End Of File - - 765F760918435880C612B856867898B9 5C616939100B85E558DA92B899A0FC36

Thanks again, and here is the ComboFix.txt ComboFix 13-07-15.01 - Heather 07/16/2013 20:02:07.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6140.4431 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-06-17 to 2013-07-17 ))))))))))))))))))))))))))))))) . . 2013-07-17 00:09 . 2013-07-17 00:09 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-07-16 00:29 . 2013-07-16 00:29 ——– d—–w- c:\program files\Enigma Software Group 2013-07-16 00:28 . 2013-07-16 01:01 ——– d—–w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP 2013-07-16 00:28 . 2013-07-16 00:28 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-07-15 23:53 . 2013-07-16 00:13 ——– d—–w- C:\MGADiagToolOutput 2013-07-15 23:52 . 2013-07-15 23:52 ——– d—–w- c:\programdata\Office Genuine Advantage 2013-07-14 23:45 . 2013-06-11 23:25 15404032 —-a-w- c:\windows\system32\ieframe.dll 2013-07-14 23:45 . 2013-06-11 23:25 19238912 —-a-w- c:\windows\system32\mshtml.dll 2013-07-13 16:45 . 2013-05-27 05:50 1011712 —-a-w- c:\program files\Windows Defender\MpSvc.dll 2013-07-13 16:45 . 2013-05-27 05:50 571904 —-a-w- c:\program files\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 04:57 392704 —-a-w- c:\program files (x86)\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 05:50 314880 —-a-w- c:\program files\Windows Defender\MpCommu.dll 2013-07-13 16:45 . 2013-05-27 04:57 54784 —-a-w- c:\program files (x86)\Windows Defender\MpOAV.dll 2013-07-13 16:45 . 2013-05-27 03:15 9216 —-a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll 2013-07-13 16:45 . 2013-05-27 04:57 4608 —-a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll 2013-07-13 16:45 . 2013-06-04 06:00 624128 —-a-w- c:\windows\system32\qedit.dll 2013-07-13 16:45 . 2013-06-04 04:53 509440 —-a-w- c:\windows\SysWow64\qedit.dll 2013-07-13 16:45 . 2013-05-06 06:03 1887744 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-13 16:45 . 2013-05-06 04:56 1620480 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-07-13 16:44 . 2013-06-05 03:34 3153920 —-a-w- c:\windows\system32\win32k.sys 2013-07-13 16:44 . 2013-04-10 05:48 1732608 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-13 16:44 . 2013-04-10 05:46 1367040 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:44 . 2013-04-10 05:46 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-13 16:44 . 2013-04-10 05:46 1393152 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-13 16:44 . 2013-04-10 05:03 936448 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:43 . 2013-04-09 23:34 1247744 —-a-w- c:\windows\SysWow64\DWrite.dll 2013-07-13 16:43 . 2013-04-02 22:51 1643520 —-a-w- c:\windows\system32\DWrite.dll 2013-06-26 23:46 . 2013-06-26 23:46 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-06-26 23:46 . 2013-06-26 23:46 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-16 00:08 . 2012-05-13 02:38 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-16 00:08 . 2011-06-25 14:47 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-14 23:47 . 2010-01-15 16:40 78185248 —-a-w- c:\windows\system32\MRT.exe 2013-06-26 23:46 . 2012-07-21 21:00 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-06-26 23:46 . 2011-04-06 01:54 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-06-04 23:50 . 2013-06-04 23:50 226304 —-a-w- c:\windows\system32\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 185344 —-a-w- c:\windows\SysWow64\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 158720 —-a-w- c:\windows\SysWow64\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-06-04 23:50 . 2013-06-04 23:50 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 523264 —-a-w- c:\windows\SysWow64\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 138752 —-a-w- c:\windows\SysWow64\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 38400 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\SysWow64\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 61952 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-06-04 23:50 . 2013-06-04 23:50 361984 —-a-w- c:\windows\SysWow64\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 452096 —-a-w- c:\windows\system32\dxtmsft.dll 2013-06-04 23:50 . 2013-06-04 23:50 441856 —-a-w- c:\windows\system32\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 281600 —-a-w- c:\windows\system32\dxtrans.dll 2013-06-04 23:50 . 2013-06-04 23:50 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 216064 —-a-w- c:\windows\system32\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 197120 —-a-w- c:\windows\system32\msrating.dll 2013-06-04 23:50 . 2013-06-04 23:50 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 81408 —-a-w- c:\windows\system32\icardie.dll 2013-06-04 23:50 . 2013-06-04 23:50 762368 —-a-w- c:\windows\system32\ieapfltr.dll 2013-06-04 23:50 . 2013-06-04 23:50 270848 —-a-w- c:\windows\system32\iedkcs32.dll 2013-06-04 23:50 . 2013-06-04 23:50 235008 —-a-w- c:\windows\system32\url.dll 2013-06-04 23:50 . 2013-06-04 23:50 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-06-04 23:50 . 2013-06-04 23:50 97280 —-a-w- c:\windows\system32\mshtmled.dll 2013-06-04 23:50 . 2013-06-04 23:50 27648 —-a-w- c:\windows\system32\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 247296 —-a-w- c:\windows\system32\webcheck.dll 2013-06-04 23:50 . 2013-06-04 23:50 1509376 —-a-w- c:\windows\system32\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 102912 —-a-w- c:\windows\system32\inseng.dll 2013-06-04 23:50 . 2013-06-04 23:50 599552 —-a-w- c:\windows\system32\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 167424 —-a-w- c:\windows\system32\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 144896 —-a-w- c:\windows\system32\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 62976 —-a-w- c:\windows\system32\pngfilt.dll 2013-06-04 23:50 . 2013-06-04 23:50 52224 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-06-04 23:50 . 2013-06-04 23:50 51200 —-a-w- c:\windows\system32\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 173568 —-a-w- c:\windows\system32\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 149504 —-a-w- c:\windows\system32\occache.dll 2013-06-04 23:50 . 2013-06-04 23:50 13824 —-a-w- c:\windows\system32\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 136192 —-a-w- c:\windows\system32\iepeers.dll 2013-06-04 23:50 . 2013-06-04 23:50 135680 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\system32\msfeedssync.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 77312 —-a-w- c:\windows\system32\tdc.ocx 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 465920 —-a-w- c:\windows\system32\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 1682432 —-a-w- c:\windows\system32\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 1158144 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 3928064 —-a-w- c:\windows\system32\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 2565120 —-a-w- c:\windows\system32\d3d10warp.dll 2013-06-04 23:48 . 2013-06-04 23:48 2284544 —-a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 363008 —-a-w- c:\windows\system32\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 220160 —-a-w- c:\windows\SysWow64\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 207872 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1175552 —-a-w- c:\windows\system32\FntCache.dll 2013-06-04 23:48 . 2013-06-04 23:48 1080832 —-a-w- c:\windows\SysWow64\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 333312 —-a-w- c:\windows\system32\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 296960 —-a-w- c:\windows\system32\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 194560 —-a-w- c:\windows\system32\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1238528 —-a-w- c:\windows\system32\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 648192 —-a-w- c:\windows\system32\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 293376 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 221184 —-a-w- c:\windows\system32\UIAnimation.dll 2013-06-04 23:48 . 2013-06-04 23:48 1988096 —-a-w- c:\windows\SysWow64\d3d10warp.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2013-05-07 2055] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-18 1080096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [x] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x] S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x] S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [x] S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x] S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] S4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x] S4 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x] S4 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x] S4 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - ESGIGUARD *Deregistered* - Avgldx64 *Deregistered* - Avgloga . Contents of the 'Scheduled Tasks' folder . 2013-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 00:08] . 2013-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000Core.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . 2013-07-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000UA.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-04-05 384296] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-11-07 487424] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.searchnu.com/406?appid=390 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 FF - ProfilePath - c:\users\Heather\AppData\Roaming\Mozilla\Firefox\Profiles\u6k3h4gr.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN20463168086412132&UM=2&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - about:home FF - user.js: extensions.privitize.hpOld0 - hxxp://searchou.com/?id=3eacb7ea0000000000000024d651cd15&affilt=5 FF - user.js: extensions.privitize.tlbrSrchUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5&q= FF - user.js: extensions.privitize.id - 3eacb7ea00000000000000ff40e49dc2 FF - user.js: extensions.privitize.appId - {301966DF-A84B-4255-AAB9-574B5CE237E4} FF - user.js: extensions.privitize.instlDay - 15872 FF - user.js: extensions.privitize.vrsn - [removed] FF - user.js: extensions.privitize.vrsni - [removed] FF - user.js: extensions.privitize.vrsnTs - 1.8.21.617:44 FF - user.js: extensions.privitize.prtnrId - privitize FF - user.js: extensions.privitize.prdct - privitize FF - user.js: extensions.privitize.aflt - 5 FF - user.js: extensions.privitize.smplGrp - none FF - user.js: extensions.privitize.tlbrId - base FF - user.js: extensions.privitize.instlRef - FF - user.js: extensions.privitize.dfltLng - FF - user.js: extensions.privitize.excTlbr - false FF - user.js: extensions.privitize.ffxUnstlRst - false FF - user.js: extensions.privitize.admin - false FF - user.js: extensions.privitize.autoRvrt - false FF - user.js: extensions.privitize.rvrt - false FF - user.js: extensions.privitize.hmpg - true FF - user.js: extensions.privitize.hmpgUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dfltSrch - true FF - user.js: extensions.privitize.srchPrvdr - Search The Web (privitize) FF - user.js: extensions.privitize.kw_url - hxxp://searchou.com/?q={searchTerms}&id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dnsErr - true FF - user.js: extensions.privitize.newTab - true FF - user.js: extensions.privitize.newTabUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - 3eacb7ea0000000000000024d651cd15 FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} FF - user.js: extensions.delta.instlDay - 15872 FF - user.js: extensions.delta.vrsn - [removed] FF - user.js: extensions.delta.vrsni - [removed] FF - user.js: extensions.delta.vrsnTs - 1.8.21.519:25 FF - user.js: extensions.delta.prtnrId - delta FF - user.js: extensions.delta.prdct - delta FF - user.js: extensions.delta.aflt - babsst FF - user.js: extensions.delta.smplGrp - none FF - user.js: extensions.delta.tlbrId - base FF - user.js: extensions.delta.instlRef - sst FF - user.js: extensions.delta.dfltLng - en FF - user.js: extensions.delta.excTlbr - false FF - user.js: extensions.delta.ffxUnstlRst - true FF - user.js: extensions.delta.admin - false FF - user.js: extensions.delta_i.babTrack - affID=119294&tt=120613_ndt FF - user.js: extensions.delta_i.babExt - FF - user.js: extensions.delta_i.srcExt - ss FF - user.js: extensions.delta.autoRvrt - false FF - user.js: extensions.delta.rvrt - false FF - user.js: extensions.delta.newTab - false . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll Toolbar-10 - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-07-16 20:12:27 ComboFix-quarantined-files.txt 2013-07-17 00:12 . Pre-Run: 71,934,386,176 bytes free Post-Run: 74,246,307,840 bytes free . - - End Of File - - 765F760918435880C612B856867898B9 5C616939100B85E558DA92B899A0FC36

Hmmm… I thought I had. I tried again how about now? ComboFix 13-07-16.01 - Heather 07/18/2013 8:28.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6140.4446 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Heather\Desktop\CFScript.txt.url AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 ))))))))))))))))))))))))))))))) . . 2013-07-18 12:36 . 2013-07-18 12:36 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-07-17 00:25 . 2013-07-17 00:25 ——– d—–w- c:\users\Heather\AppData\Roaming\AVG2013 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\users\Heather\AppData\Local\AVG SafeGuard toolbar 2013-07-17 00:24 . 2013-07-17 00:24 45856 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\programdata\AVG SafeGuard toolbar 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\program files (x86)\Common Files\AVG Secure Search 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\program files (x86)\AVG SafeGuard toolbar 2013-07-17 00:22 . 2013-07-17 00:22 ——– d—–w- C:\$AVG 2013-07-17 00:22 . 2013-07-17 00:25 ——– d—–w- c:\programdata\AVG2013 2013-07-17 00:20 . 2013-07-17 01:25 ——– d—–w- c:\users\Heather\AppData\Local\Avg2013 2013-07-16 00:29 . 2013-07-16 00:29 ——– d—–w- c:\program files\Enigma Software Group 2013-07-16 00:28 . 2013-07-16 01:01 ——– d—–w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP 2013-07-16 00:28 . 2013-07-16 00:28 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-07-15 23:53 . 2013-07-16 00:13 ——– d—–w- C:\MGADiagToolOutput 2013-07-15 23:52 . 2013-07-15 23:52 ——– d—–w- c:\programdata\Office Genuine Advantage 2013-07-14 23:45 . 2013-06-11 23:25 15404032 —-a-w- c:\windows\system32\ieframe.dll 2013-07-14 23:45 . 2013-06-11 23:25 19238912 —-a-w- c:\windows\system32\mshtml.dll 2013-07-13 16:45 . 2013-05-27 05:50 1011712 —-a-w- c:\program files\Windows Defender\MpSvc.dll 2013-07-13 16:45 . 2013-05-27 05:50 571904 —-a-w- c:\program files\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 04:57 392704 —-a-w- c:\program files (x86)\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 05:50 314880 —-a-w- c:\program files\Windows Defender\MpCommu.dll 2013-07-13 16:45 . 2013-05-27 04:57 54784 —-a-w- c:\program files (x86)\Windows Defender\MpOAV.dll 2013-07-13 16:45 . 2013-05-27 03:15 9216 —-a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll 2013-07-13 16:45 . 2013-05-27 04:57 4608 —-a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll 2013-07-13 16:45 . 2013-06-04 06:00 624128 —-a-w- c:\windows\system32\qedit.dll 2013-07-13 16:45 . 2013-06-04 04:53 509440 —-a-w- c:\windows\SysWow64\qedit.dll 2013-07-13 16:45 . 2013-05-06 06:03 1887744 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-13 16:45 . 2013-05-06 04:56 1620480 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-07-13 16:44 . 2013-06-05 03:34 3153920 —-a-w- c:\windows\system32\win32k.sys 2013-07-13 16:44 . 2013-04-10 05:48 1732608 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-13 16:44 . 2013-04-10 05:46 1367040 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:44 . 2013-04-10 05:46 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-13 16:44 . 2013-04-10 05:46 1393152 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-13 16:44 . 2013-04-10 05:03 936448 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:43 . 2013-04-09 23:34 1247744 —-a-w- c:\windows\SysWow64\DWrite.dll 2013-07-13 16:43 . 2013-04-02 22:51 1643520 —-a-w- c:\windows\system32\DWrite.dll 2013-06-26 23:46 . 2013-06-26 23:46 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-06-26 23:46 . 2013-06-26 23:46 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-16 00:08 . 2012-05-13 02:38 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-16 00:08 . 2011-06-25 14:47 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-14 23:47 . 2010-01-15 16:40 78185248 —-a-w- c:\windows\system32\MRT.exe 2013-06-26 23:46 . 2012-07-21 21:00 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-06-26 23:46 . 2011-04-06 01:54 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-06-04 23:50 . 2013-06-04 23:50 226304 —-a-w- c:\windows\system32\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 185344 —-a-w- c:\windows\SysWow64\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 158720 —-a-w- c:\windows\SysWow64\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-06-04 23:50 . 2013-06-04 23:50 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 523264 —-a-w- c:\windows\SysWow64\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 138752 —-a-w- c:\windows\SysWow64\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 38400 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\SysWow64\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 61952 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-06-04 23:50 . 2013-06-04 23:50 361984 —-a-w- c:\windows\SysWow64\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 452096 —-a-w- c:\windows\system32\dxtmsft.dll 2013-06-04 23:50 . 2013-06-04 23:50 441856 —-a-w- c:\windows\system32\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 281600 —-a-w- c:\windows\system32\dxtrans.dll 2013-06-04 23:50 . 2013-06-04 23:50 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 216064 —-a-w- c:\windows\system32\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 197120 —-a-w- c:\windows\system32\msrating.dll 2013-06-04 23:50 . 2013-06-04 23:50 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 81408 —-a-w- c:\windows\system32\icardie.dll 2013-06-04 23:50 . 2013-06-04 23:50 762368 —-a-w- c:\windows\system32\ieapfltr.dll 2013-06-04 23:50 . 2013-06-04 23:50 270848 —-a-w- c:\windows\system32\iedkcs32.dll 2013-06-04 23:50 . 2013-06-04 23:50 235008 —-a-w- c:\windows\system32\url.dll 2013-06-04 23:50 . 2013-06-04 23:50 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-06-04 23:50 . 2013-06-04 23:50 97280 —-a-w- c:\windows\system32\mshtmled.dll 2013-06-04 23:50 . 2013-06-04 23:50 27648 —-a-w- c:\windows\system32\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 247296 —-a-w- c:\windows\system32\webcheck.dll 2013-06-04 23:50 . 2013-06-04 23:50 1509376 —-a-w- c:\windows\system32\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 102912 —-a-w- c:\windows\system32\inseng.dll 2013-06-04 23:50 . 2013-06-04 23:50 599552 —-a-w- c:\windows\system32\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 167424 —-a-w- c:\windows\system32\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 144896 —-a-w- c:\windows\system32\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 62976 —-a-w- c:\windows\system32\pngfilt.dll 2013-06-04 23:50 . 2013-06-04 23:50 52224 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-06-04 23:50 . 2013-06-04 23:50 51200 —-a-w- c:\windows\system32\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 173568 —-a-w- c:\windows\system32\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 149504 —-a-w- c:\windows\system32\occache.dll 2013-06-04 23:50 . 2013-06-04 23:50 13824 —-a-w- c:\windows\system32\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 136192 —-a-w- c:\windows\system32\iepeers.dll 2013-06-04 23:50 . 2013-06-04 23:50 135680 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\system32\msfeedssync.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 77312 —-a-w- c:\windows\system32\tdc.ocx 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 465920 —-a-w- c:\windows\system32\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 1682432 —-a-w- c:\windows\system32\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 1158144 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 3928064 —-a-w- c:\windows\system32\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 2565120 —-a-w- c:\windows\system32\d3d10warp.dll 2013-06-04 23:48 . 2013-06-04 23:48 2284544 —-a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 363008 —-a-w- c:\windows\system32\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 220160 —-a-w- c:\windows\SysWow64\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 207872 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1175552 —-a-w- c:\windows\system32\FntCache.dll 2013-06-04 23:48 . 2013-06-04 23:48 1080832 —-a-w- c:\windows\SysWow64\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 333312 —-a-w- c:\windows\system32\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 296960 —-a-w- c:\windows\system32\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 194560 —-a-w- c:\windows\system32\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1238528 —-a-w- c:\windows\system32\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 648192 —-a-w- c:\windows\system32\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 293376 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 221184 —-a-w- c:\windows\system32\UIAnimation.dll 2013-06-04 23:48 . 2013-06-04 23:48 1988096 —-a-w- c:\windows\SysWow64\d3d10warp.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2013-05-07 2055] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-04-29 4408368] "vProt"="c:\program files (x86)\AVG SafeGuard toolbar\vprot.exe" [2013-07-17 2236080] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-18 1080096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x] S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x] S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x] S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [x] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [x] S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x] S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [x] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - AVGLDX64 *NewlyCreated* - AVGLOGA *NewlyCreated* - AVGMFX64 *NewlyCreated* - AVGTP *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 00:08] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000Core.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000UA.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll [BU] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-04-05 384296] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-11-07 487424] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.searchnu.com/406?appid=390 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll FF - ProfilePath - c:\users\Heather\AppData\Roaming\Mozilla\Firefox\Profiles\u6k3h4gr.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279411&CUI=UN20463168086412132&UM=2&SearchSource=3&q={searchTerms} FF - prefs.js: browser.startup.homepage - about:home FF - user.js: extensions.privitize.hpOld0 - hxxp://searchou.com/?id=3eacb7ea0000000000000024d651cd15&affilt=5 FF - user.js: extensions.privitize.tlbrSrchUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5&q= FF - user.js: extensions.privitize.id - 3eacb7ea00000000000000ff40e49dc2 FF - user.js: extensions.privitize.appId - {301966DF-A84B-4255-AAB9-574B5CE237E4} FF - user.js: extensions.privitize.instlDay - 15872 FF - user.js: extensions.privitize.vrsn - [removed] FF - user.js: extensions.privitize.vrsni - [removed] FF - user.js: extensions.privitize.vrsnTs - 1.8.21.617:44 FF - user.js: extensions.privitize.prtnrId - privitize FF - user.js: extensions.privitize.prdct - privitize FF - user.js: extensions.privitize.aflt - 5 FF - user.js: extensions.privitize.smplGrp - none FF - user.js: extensions.privitize.tlbrId - base FF - user.js: extensions.privitize.instlRef - FF - user.js: extensions.privitize.dfltLng - FF - user.js: extensions.privitize.excTlbr - false FF - user.js: extensions.privitize.ffxUnstlRst - false FF - user.js: extensions.privitize.admin - false FF - user.js: extensions.privitize.autoRvrt - false FF - user.js: extensions.privitize.rvrt - false FF - user.js: extensions.privitize.hmpg - true FF - user.js: extensions.privitize.hmpgUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dfltSrch - true FF - user.js: extensions.privitize.srchPrvdr - Search The Web (privitize) FF - user.js: extensions.privitize.kw_url - hxxp://searchou.com/?q={searchTerms}&id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.privitize.dnsErr - true FF - user.js: extensions.privitize.newTab - true FF - user.js: extensions.privitize.newTabUrl - hxxp://searchou.com/?id=3eacb7ea00000000000000ff40e49dc2&affilt=5 FF - user.js: extensions.delta.tlbrSrchUrl - FF - user.js: extensions.delta.id - 3eacb7ea0000000000000024d651cd15 FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} FF - user.js: extensions.delta.instlDay - 15872 FF - user.js: extensions.delta.vrsn - [removed] FF - user.js: extensions.delta.vrsni - [removed] FF - user.js: extensions.delta.vrsnTs - 1.8.21.519:25 FF - user.js: extensions.delta.prtnrId - delta FF - user.js: extensions.delta.prdct - delta FF - user.js: extensions.delta.aflt - babsst FF - user.js: extensions.delta.smplGrp - none FF - user.js: extensions.delta.tlbrId - base FF - user.js: extensions.delta.instlRef - sst FF - user.js: extensions.delta.dfltLng - en FF - user.js: extensions.delta.excTlbr - false FF - user.js: extensions.delta.ffxUnstlRst - true FF - user.js: extensions.delta.admin - false FF - user.js: extensions.delta_i.babTrack - affID=119294&tt=120613_ndt FF - user.js: extensions.delta_i.babExt - FF - user.js: extensions.delta_i.srcExt - ss FF - user.js: extensions.delta.autoRvrt - false FF - user.js: extensions.delta.rvrt - false FF - user.js: extensions.delta.newTab - false . - - - - ORPHANS REMOVED - - - - . BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-07-18 08:39:13 ComboFix-quarantined-files.txt 2013-07-18 12:39 ComboFix2.txt 2013-07-17 00:12 . Pre-Run: 73,990,160,384 bytes free Post-Run: 73,753,944,064 bytes free . - - End Of File - - 46D688AB4B934CF1C1904E71A872C312 5C616939100B85E558DA92B899A0FC36

I tried again, pretty sure I saved it as a text file this time, sorry for the confusion ComboFix 13-07-18.04 - Heather 07/18/2013 19:35:21.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6140.4706 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Heather\Desktop\CFScript (2).txt AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-06-18 to 2013-07-18 ))))))))))))))))))))))))))))))) . . 2013-07-18 23:42 . 2013-07-18 23:42 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-07-17 00:25 . 2013-07-17 00:25 ——– d—–w- c:\users\Heather\AppData\Roaming\AVG2013 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\users\Heather\AppData\Local\AVG SafeGuard toolbar 2013-07-17 00:24 . 2013-07-17 00:24 45856 —-a-w- c:\windows\system32\drivers\avgtpx64.sys 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\programdata\AVG SafeGuard toolbar 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\program files (x86)\Common Files\AVG Secure Search 2013-07-17 00:24 . 2013-07-17 00:24 ——– d—–w- c:\program files (x86)\AVG SafeGuard toolbar 2013-07-17 00:22 . 2013-07-17 00:22 ——– d—–w- C:\$AVG 2013-07-17 00:22 . 2013-07-17 00:25 ——– d—–w- c:\programdata\AVG2013 2013-07-17 00:20 . 2013-07-17 01:25 ——– d—–w- c:\users\Heather\AppData\Local\Avg2013 2013-07-16 00:29 . 2013-07-16 00:29 ——– d—–w- c:\program files\Enigma Software Group 2013-07-16 00:28 . 2013-07-16 01:01 ——– d—–w- c:\windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP 2013-07-16 00:28 . 2013-07-16 00:28 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2013-07-15 23:53 . 2013-07-16 00:13 ——– d—–w- C:\MGADiagToolOutput 2013-07-15 23:52 . 2013-07-15 23:52 ——– d—–w- c:\programdata\Office Genuine Advantage 2013-07-14 23:45 . 2013-06-11 23:25 15404032 —-a-w- c:\windows\system32\ieframe.dll 2013-07-14 23:45 . 2013-06-11 23:25 19238912 —-a-w- c:\windows\system32\mshtml.dll 2013-07-13 16:45 . 2013-05-27 05:50 1011712 —-a-w- c:\program files\Windows Defender\MpSvc.dll 2013-07-13 16:45 . 2013-05-27 05:50 571904 —-a-w- c:\program files\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 04:57 392704 —-a-w- c:\program files (x86)\Windows Defender\MpClient.dll 2013-07-13 16:45 . 2013-05-27 05:50 314880 —-a-w- c:\program files\Windows Defender\MpCommu.dll 2013-07-13 16:45 . 2013-05-27 04:57 54784 —-a-w- c:\program files (x86)\Windows Defender\MpOAV.dll 2013-07-13 16:45 . 2013-05-27 03:15 9216 —-a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll 2013-07-13 16:45 . 2013-05-27 04:57 4608 —-a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll 2013-07-13 16:45 . 2013-06-04 06:00 624128 —-a-w- c:\windows\system32\qedit.dll 2013-07-13 16:45 . 2013-06-04 04:53 509440 —-a-w- c:\windows\SysWow64\qedit.dll 2013-07-13 16:45 . 2013-05-06 06:03 1887744 —-a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-13 16:45 . 2013-05-06 04:56 1620480 —-a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-07-13 16:44 . 2013-06-05 03:34 3153920 —-a-w- c:\windows\system32\win32k.sys 2013-07-13 16:44 . 2013-04-10 05:48 1732608 —-a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-13 16:44 . 2013-04-10 05:46 1367040 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:44 . 2013-04-10 05:46 1402880 —-a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-13 16:44 . 2013-04-10 05:46 1393152 —-a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-13 16:44 . 2013-04-10 05:03 936448 —-a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-13 16:43 . 2013-04-09 23:34 1247744 —-a-w- c:\windows\SysWow64\DWrite.dll 2013-07-13 16:43 . 2013-04-02 22:51 1643520 —-a-w- c:\windows\system32\DWrite.dll 2013-06-26 23:46 . 2013-06-26 23:46 ——– d—–w- c:\program files (x86)\Common Files\Java 2013-06-26 23:46 . 2013-06-26 23:46 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-16 00:08 . 2012-05-13 02:38 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-16 00:08 . 2011-06-25 14:47 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-14 23:47 . 2010-01-15 16:40 78185248 —-a-w- c:\windows\system32\MRT.exe 2013-06-26 23:46 . 2012-07-21 21:00 867240 —-a-w- c:\windows\SysWow64\npDeployJava1.dll 2013-06-26 23:46 . 2011-04-06 01:54 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll 2013-06-04 23:50 . 2013-06-04 23:50 226304 —-a-w- c:\windows\system32\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 185344 —-a-w- c:\windows\SysWow64\elshyph.dll 2013-06-04 23:50 . 2013-06-04 23:50 158720 —-a-w- c:\windows\SysWow64\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-06-04 23:50 . 2013-06-04 23:50 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 523264 —-a-w- c:\windows\SysWow64\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 150528 —-a-w- c:\windows\SysWow64\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 138752 —-a-w- c:\windows\SysWow64\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 38400 —-a-w- c:\windows\SysWow64\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\SysWow64\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 61952 —-a-w- c:\windows\SysWow64\tdc.ocx 2013-06-04 23:50 . 2013-06-04 23:50 361984 —-a-w- c:\windows\SysWow64\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 452096 —-a-w- c:\windows\system32\dxtmsft.dll 2013-06-04 23:50 . 2013-06-04 23:50 441856 —-a-w- c:\windows\system32\html.iec 2013-06-04 23:50 . 2013-06-04 23:50 281600 —-a-w- c:\windows\system32\dxtrans.dll 2013-06-04 23:50 . 2013-06-04 23:50 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 216064 —-a-w- c:\windows\system32\msls31.dll 2013-06-04 23:50 . 2013-06-04 23:50 197120 —-a-w- c:\windows\system32\msrating.dll 2013-06-04 23:50 . 2013-06-04 23:50 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll 2013-06-04 23:50 . 2013-06-04 23:50 81408 —-a-w- c:\windows\system32\icardie.dll 2013-06-04 23:50 . 2013-06-04 23:50 762368 —-a-w- c:\windows\system32\ieapfltr.dll 2013-06-04 23:50 . 2013-06-04 23:50 270848 —-a-w- c:\windows\system32\iedkcs32.dll 2013-06-04 23:50 . 2013-06-04 23:50 235008 —-a-w- c:\windows\system32\url.dll 2013-06-04 23:50 . 2013-06-04 23:50 1400416 —-a-w- c:\windows\system32\ieapfltr.dat 2013-06-04 23:50 . 2013-06-04 23:50 97280 —-a-w- c:\windows\system32\mshtmled.dll 2013-06-04 23:50 . 2013-06-04 23:50 27648 —-a-w- c:\windows\system32\licmgr10.dll 2013-06-04 23:50 . 2013-06-04 23:50 247296 —-a-w- c:\windows\system32\webcheck.dll 2013-06-04 23:50 . 2013-06-04 23:50 1509376 —-a-w- c:\windows\system32\inetcpl.cpl 2013-06-04 23:50 . 2013-06-04 23:50 102912 —-a-w- c:\windows\system32\inseng.dll 2013-06-04 23:50 . 2013-06-04 23:50 599552 —-a-w- c:\windows\system32\vbscript.dll 2013-06-04 23:50 . 2013-06-04 23:50 167424 —-a-w- c:\windows\system32\iexpress.exe 2013-06-04 23:50 . 2013-06-04 23:50 144896 —-a-w- c:\windows\system32\wextract.exe 2013-06-04 23:50 . 2013-06-04 23:50 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-06-04 23:50 . 2013-06-04 23:50 62976 —-a-w- c:\windows\system32\pngfilt.dll 2013-06-04 23:50 . 2013-06-04 23:50 52224 —-a-w- c:\windows\system32\msfeedsbs.dll 2013-06-04 23:50 . 2013-06-04 23:50 51200 —-a-w- c:\windows\system32\imgutil.dll 2013-06-04 23:50 . 2013-06-04 23:50 173568 —-a-w- c:\windows\system32\ieUnatt.exe 2013-06-04 23:50 . 2013-06-04 23:50 149504 —-a-w- c:\windows\system32\occache.dll 2013-06-04 23:50 . 2013-06-04 23:50 13824 —-a-w- c:\windows\system32\mshta.exe 2013-06-04 23:50 . 2013-06-04 23:50 136192 —-a-w- c:\windows\system32\iepeers.dll 2013-06-04 23:50 . 2013-06-04 23:50 135680 —-a-w- c:\windows\system32\IEAdvpack.dll 2013-06-04 23:50 . 2013-06-04 23:50 12800 —-a-w- c:\windows\system32\msfeedssync.exe 2013-06-04 23:50 . 2013-06-04 23:50 48640 —-a-w- c:\windows\system32\mshtmler.dll 2013-06-04 23:50 . 2013-06-04 23:50 77312 —-a-w- c:\windows\system32\tdc.ocx 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 9728 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 5632 —ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 465920 —-a-w- c:\windows\system32\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 4096 —ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3584 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 3072 —ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 2560 —ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 1682432 —-a-w- c:\windows\system32\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 1158144 —-a-w- c:\windows\SysWow64\XpsPrint.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 10752 —ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2013-06-04 23:48 . 2013-06-04 23:48 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll 2013-06-04 23:48 . 2013-06-04 23:48 3928064 —-a-w- c:\windows\system32\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 2565120 —-a-w- c:\windows\system32\d3d10warp.dll 2013-06-04 23:48 . 2013-06-04 23:48 2284544 —-a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2013-06-04 23:48 . 2013-06-04 23:48 363008 —-a-w- c:\windows\system32\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 220160 —-a-w- c:\windows\SysWow64\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 207872 —-a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 161792 —-a-w- c:\windows\SysWow64\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1175552 —-a-w- c:\windows\system32\FntCache.dll 2013-06-04 23:48 . 2013-06-04 23:48 1080832 —-a-w- c:\windows\SysWow64\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 333312 —-a-w- c:\windows\system32\d3d10_1core.dll 2013-06-04 23:48 . 2013-06-04 23:48 296960 —-a-w- c:\windows\system32\d3d10core.dll 2013-06-04 23:48 . 2013-06-04 23:48 245248 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2013-06-04 23:48 . 2013-06-04 23:48 194560 —-a-w- c:\windows\system32\d3d10_1.dll 2013-06-04 23:48 . 2013-06-04 23:48 1238528 —-a-w- c:\windows\system32\d3d10.dll 2013-06-04 23:48 . 2013-06-04 23:48 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll 2013-06-04 23:48 . 2013-06-04 23:48 648192 —-a-w- c:\windows\system32\d3d10level9.dll 2013-06-04 23:48 . 2013-06-04 23:48 293376 —-a-w- c:\windows\SysWow64\dxgi.dll 2013-06-04 23:48 . 2013-06-04 23:48 221184 —-a-w- c:\windows\system32\UIAnimation.dll 2013-06-04 23:48 . 2013-06-04 23:48 1988096 —-a-w- c:\windows\SysWow64\d3d10warp.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320] "MotoCast"="c:\program files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk" [2013-05-07 2055] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816] "AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2013-04-29 4408368] "vProt"="c:\program files (x86)\AVG SafeGuard toolbar\vprot.exe" [2013-07-17 2236080] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-8-18 1080096] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x] R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x] S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x] S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x] S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_2994e9b145633086\AESTSr64.exe [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [x] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [x] S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x] S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x] S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [x] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [x] S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x] S2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [x] S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2013-07-18 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 00:08] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000Core.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . 2013-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3027918190-1659419789-3035849352-1000UA.job - c:\users\Heather\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-22 01:19] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll [BU] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-04-05 384296] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-11-07 487424] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll FF - ProfilePath - c:\users\Heather\AppData\Roaming\Mozilla\Firefox\Profiles\u6k3h4gr.default\ . - - - - ORPHANS REMOVED - - - - . BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-10 - (no file) Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file) . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.20\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-07-18 19:45:21 ComboFix-quarantined-files.txt 2013-07-18 23:45 ComboFix2.txt 2013-07-18 12:39 ComboFix3.txt 2013-07-17 00:12 . Pre-Run: 73,541,709,824 bytes free Post-Run: 73,255,759,872 bytes free . - - End Of File - - 9FC44694FD8429E9E040B0234E4E6C95 5C616939100B85E558DA92B899A0FC36