What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Sneaky ...! [Solved]

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31

And Spybot is still finding the 2 Fraud.AVSecuritySuite registry entries.

Would you be able to post the actual file paths that Spybot is showing you?
Post #32 last edited
Fraud.AVSecuritySuite: [SBI $5587D6DE] Settings (Registry value, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer=…http=127.0.0.1:5643…

Fraud.AVSecuritySuite: [SBI $5587D6DE] Settings (Registry value, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer=…http=127.0.0.1:5643…



I've removed them previously, only to have them show up again in hours. The ProxyEnable setting in both areas is ALSO set to "1", which if I understand Malwarbytes' site correctly, it should be "0". Unfortunately they also say I need the full version of the program to protect against this particular malware.
Post #33
Something seems to still be lurking here….

Download RogueKiller to your Desktop.

  • Quit all running programs
  • For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
  • There will be a pre-scan that will run automatically (this is normal)
  • Once the pre-scan has finished, press the Scan button.
  • If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
  • Once the Scan is complete, press the Report button to generate the results.
Please post the contents of the RKreport.txt in your next Reply.

—————-
Post #34 last edited
Yeah, seems like when I get infected anymore, I get REALLY infected. XD I honestly wish I could at least throw a few dollars this website's way this time but I don't see a 'Donate' option anywhere. I should note that I have not erased the backups on F:\ yet.

RogueKiller
RogueKiller V8.6.6 [Aug 19 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Christine [Admin rights]
Mode : Scan – Date : 08/24/2013 14:41:54
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] Runservice.exe – C:\WINDOWS\runservice.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 1 ¤¤¤
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 2 ¤¤¤
[V1][SUSP PATH] Christine.job : C:\Program Files\Seagate\Seagate Dashboard 2.0\NBCore.exe - "C:\Documents and Settings\Christine\Application Data\Seagate\Seagate Dashboard 2.0\Files\Christine.nji" [7][-] -> FOUND
[V1][SUSP PATH] Christine Merge.job : C:\Program Files\Seagate\Seagate Dashboard 2.0\NBCore.exe - "C:\Documents and Settings\Christine\Application Data\Seagate\Seagate Dashboard 2.0\Files\Christine Merge.nji" [7][-] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
[…]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD502HI +++++
— User —
[MBR] 207285155c7adf1c72613fa4cd6d33b0
[BSP] d3d6bfddcfe283a99dd434dda4bda7ee : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: SAMSUNG HD502HI +++++
— User —
[MBR] 8bdf79e482e67146c0a466678c96c841
[BSP] 71c9e539e1bae2e2d14cadbe0d8a43da : Empty MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[0]_S_08242013_144154.txt >>
Post #35
Hi,

honestly wish I could at least throw a few dollars this website's way this time but I don't see a 'Donate' option anywhere.

If you are pleased after we are through and would like to donate there is a Donate button up at the top of the page under the What the Tech title. Of course there is no pressure to do so at all….it is completely your choice. :)

SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Right-click and Run as Administrator SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :reg
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings /s

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #36 last edited
Hmmm, I see no Donate button. NoScript must be blocking it.


Problem. SystemLook is just sitting there doing nothing after I cut and pasted

:reg
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings /s

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings /s

…into the window, and then hit 'Look'. Nada.

I do not have my computer setup with a password for Administrator, so SystemLook wouldn't let me scan under 'Administrator'. I just have Administrator access linked to my username so that's what I scanned under.
Post #38
I figured out what I needed to do to get the program to run, but am having a considerable amount of trouble posting the log so I'm posting this message in case I don't get it up. when I cut and paste the log it locks up Firefox temporarily, and then I get kicked out to the main forum page when I hit 'Add Reply', without posting the post.
Post #39
Okay, much as I try, the txt file is 17.3 MB and I can't post it here. When I did the scan under 'current user' (since, as I explained above I have my administrator access tied to it and don't have an overall administrator password) I unchecked the check box in order to get the program to respond. Without unchecking that box the program would not run a scan or otherwise respond.
Post #41 last edited
Duh, should have thought of that. :wall:

Interesting thing…I went into User Accounts to make absolutely sure I was definitely the administrator. And I found an extra account that wasn't there before, called something like 'ASP.NET Machine A…' Marked as a limited account, and now deleted. Then I rebooted, and am waiting for SpyBot to finish its bootup scan. Didn't re-run SystemLook, tho, but now the last log is attached.

UPDATE for FYI: Sunday morning, Spybot is still finding and fixing two instances of Fraud.AVSecuritySuite, so deleting that account didn't remove the virus.

Attachments:

Post #42
Ok thank you….. Run a fresh scan with OTL so we can take a look. I was looking at these and see them but I don't think they are a problem (even though they are being detected).
Post #43 last edited
I'm more concerned about the fact that the reg entries keep being reinstalled when they're erased. Where would the reinstallation be coming from? And what about the associated 'Proxy Enable' registry entries being set to 1 instead of 0? Should it be reset to 0? I'm also concerned about setting up a better firewall - if its still somewhere in there when I do that, a firewall like Online Armor will probably think its a legit program.

OTL
OTL logfile created on: 8/25/2013 5:42:10 PM - Run 7
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Christine\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 1.85 Gb Available Physical Memory | 56.81% Memory free
5.09 Gb Paging File | 3.78 Gb Available in Paging File | 74.32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 361.75 Gb Free Space | 77.67% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 851.13 Gb Free Space | 91.37% Space Free | Partition Type: NTFS

Computer Name: BIGBLUEMONSTER | User Name: Christine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Christine\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
PRC - C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\aim.exe (AOL Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (ArcSoft Inc.)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\Runservice.exe ()
PRC - C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Wacom Technology, Corp.)
PRC - C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13082501\algo.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\729ef05a2df18630db7f0a28dd0ec155\System.Web.Services.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c60957afdbe82f552f2db272afa719fc\System.ServiceModel.Routing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\53428f2f24507f75cc2df5dd0115b46d\System.ServiceModel.Discovery.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\286a517e1d3aae93daf46ca638856372\System.ServiceModel.Channels.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\d756aec4dac356fb0dbfd15f5e07d012\System.ServiceModel.Activities.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\918ce68a67ddb5558994e20dc3a74c8a\System.ServiceModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Management\6c422db78c17838c3eb9f9fcc01ca63f\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\6e0e5467e23a80c5c7d34f65dc7f87f2\System.IdentityModel.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\58eb4f10504e035b673f8366d9be6881\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\8927b576eb15c4a8f4bb04f05e7cc51e\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\b12cbfa020af0c619d8f58c6b665efc1\System.Runtime.DurableInstancing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\d083ee23a4c0d8cf76ae9e95e52d0388\SMDiagnostics.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\332407a3f224f388f70120d33cb872d5\System.Runtime.Serialization.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\32800018747dbf43506ac49e697daea9\System.Xml.Linq.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\4d277a8481c203a35c58bd277a2e71df\System.Xaml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\9e19102de729beac1a221cde49058d99\Microsoft.VisualBasic.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9b32857137a545633a4f303ec88d418c\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e205d971e9ffa1771cff3d3dde1c3c2b\PresentationFramework.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\a10f361c888b8b98f7ad1fa8d7a51516\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\107b8a28ba272e93556f0e2bfa2c4e16\PresentationCore.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\608aa2db27d45e63a4863f1f1d06897a\System.Core.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\6405f08f877802703cfd956c072a4ad0\WindowsBase.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldap32v60.dll ()
MOD - C:\Program Files\Mozilla Thunderbird\nsldappr32v60.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\8f799a4688381624de3cfb1edbccb163\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\NPSWF32.dll ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Documents and Settings\Christine\Local Settings\Application Data\AOL\AIM\libcef.dll ()
MOD - C:\WINDOWS\mmfs.dll ()
MOD - C:\WINDOWS\Runservice.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3175.36923__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3175.37106__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3175.37120__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3175.37069__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3175.36940__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3175.37078__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3175.36920__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3175.37075__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3175.36922__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3175.36928__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3175.36921__90ba9c70f846762e\ATIDEMOS.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3175.36917__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3175.37077__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll ()
MOD - C:\Program Files\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll ()


========== Services (SafeList) ==========

SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (Seagate Dashboard Services) – C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe (Seagate Technology LLC)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (TabletServiceWacom) – C:\WINDOWS\system32\Wacom_Tablet.exe (Wacom Technology, Corp.)
SRV - (EpsonPrinterStudy4) – C:\Program Files\epson\EpsonPrinterStudy4\EPCP.exe (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SetupNTGLM7X) – D:\NTGLM7X.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NTACCESS) – D:\NTACCESS.sys File not found
DRV - (MSICPL) – D:\install4\MSICPL.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (GMSIPCI) – D:\INSTALL\GMSIPCI.SYS File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHDAudioService) – C:\WINDOWS\system32\drivers\AtihdXP3.sys (Advanced Micro Devices)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (wacmoumonitor) – C:\WINDOWS\system32\drivers\wacmoumonitor.sys (Wacom Technology)
DRV - (wacomvhid) – C:\WINDOWS\system32\drivers\wacomvhid.sys (Wacom Technology)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (amdide) – C:\WINDOWS\system32\drivers\amdide.sys (Advanced Micro Devices)
DRV - (wacommousefilter) – C:\WINDOWS\system32\drivers\wacommousefilter.sys (Wacom Technology)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (ndiscm) – C:\WINDOWS\system32\drivers\NetMotCM.sys (Motorola Inc.)
DRV - (incdrm) – C:\WINDOWS\System32\drivers\incdrm.sys (Ahead Software AG)
DRV - (BCMModem) – C:\WINDOWS\system32\drivers\BCMDM.sys (BCM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://forecast.weather.gov/MapClick.php?CityName=Bellingham&state=WA&site=SEW&textField1=48.7597&textField2=-122.487&e=0"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130515
FF - prefs.js..extensions.enabledAddons: %7Ba7c6cf7f-112c-4500-a7ea-39801a327e5f%7D:2.0.16
FF - prefs.js..extensions.enabledAddons: pbupload%40photobucket.com:1.3.9
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17
FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:19.3
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:1.11
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.7.1rc2
FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1489
FF - prefs.js..extensions.enabledAddons: %7Be7348bc0-16f6-11de-8c30-0800200c9a66%7D:15.0.25.04.12
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.6.5
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.4
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.8: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A72E0FE7-282F-4517-9C95-5B611103B925}: C:\Documents and Settings\Christine\Local Settings\Application Data\{A72E0FE7-282F-4517-9C95-5B611103B925}\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/01/22 21:14:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/08/22 14:41:42 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/17 10:11:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/23 15:47:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/08/06 22:33:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions
[2010/07/23 21:10:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/21 10:44:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions
[2011/02/27 20:41:19 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2013/07/27 00:37:52 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/04/28 16:48:59 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/07/01 22:46:42 | 000,000,000 | —D | M] (Purple Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{3ffb7be0-8bde-11de-8a39-0800200c9a66}
[2009/10/10 19:46:14 | 000,000,000 | —D | M] (AvantGarde Rosepetal) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}
[2013/05/15 11:23:42 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013/07/19 01:57:51 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/05/04 15:44:43 | 000,000,000 | —D | M] (Pink Fox) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e7348bc0-16f6-11de-8c30-0800200c9a66}
[2013/08/21 10:44:27 | 000,057,732 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/06/25 18:25:35 | 000,027,521 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\[removed]
[2013/08/15 11:48:09 | 000,534,320 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/06/15 12:25:30 | 000,868,738 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
[2013/07/30 20:17:34 | 000,824,302 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/04/18 19:39:22 | 001,109,062 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}.xpi
[2013/08/03 00:51:12 | 000,275,449 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009/10/10 19:46:14 | 001,897,274 | —- | M] () (No name found) – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp.xpi
[2013/08/23 12:42:40 | 000,005,472 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Mozilla\Firefox\Profiles\t2cpv24e.default\searchplugins\startpage.xml
[2013/08/17 10:11:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/17 10:11:30 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/22 14:41:42 | 000,000,000 | —D | M] (avast! Online Security) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF

O1 HOSTS File: ([2013/08/22 14:08:35 | 000,449,812 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15467 more lines…
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Ad Blocker) - {FFCB3198-32F3-4E8B-9539-4324694ED663} - C:\Program Files\AVAST Software\avast! Ad Blocker IE\Adblocker32.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DBAgent] C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe (Seagate Technology LLC)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [LTCM Client] C:\Program Files\LTCM Client\ltcmClient.exe (Leader Technologies Inc.)
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Uploader] C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe (Seagate Technology LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4A2C5A9-E429-494E-98CE-F10BCE688442}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Christine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/20 00:10:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/08/25 01:01:08 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Christine\Recent
[2013/08/24 14:39:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Desktop\RK_Quarantine
[2013/08/22 14:42:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/08/22 14:42:04 | 000,369,584 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:04 | 000,029,816 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2013/08/22 14:42:02 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/22 14:42:01 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:01 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/22 14:41:59 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/22 14:41:58 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/08/22 14:41:32 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/22 14:41:13 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/08/22 14:37:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/08/21 08:56:55 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/20 16:17:59 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/20 16:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com
[2013/08/20 16:11:20 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2013/08/20 16:07:40 | 001,018,949 | —- | C] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/19 18:40:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/18 17:30:37 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/18 17:28:44 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/18 17:28:44 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/18 17:28:44 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/18 17:28:44 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/18 17:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/18 17:22:46 | 005,105,231 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 13:59:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 11:08:42 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/17 10:11:13 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/08/06 22:33:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Thunderbird
[2013/08/05 13:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Nero
[2013/08/05 13:53:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Seagate Dashboard 2.0
[2013/08/05 13:53:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2013/08/05 13:53:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nero
[2013/08/05 13:53:04 | 000,000,000 | —D | C] – C:\Program Files\Seagate
[2013/08/05 13:45:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/08/05 13:45:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Christine\Application Data\Seagate
[2013/08/05 13:41:43 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2013/08/02 10:56:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MRT

========== Files - Modified Within 30 Days ==========

[2013/08/25 17:36:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/25 17:22:01 | 000,000,370 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/25 14:06:06 | 000,000,616 | —- | M] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/25 14:06:04 | 000,000,604 | —- | M] () – C:\WINDOWS\tasks\Christine.job
[2013/08/25 10:19:15 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/25 10:18:48 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/25 10:18:22 | 000,000,561 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2013/08/25 10:18:15 | 000,000,338 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2013/08/25 10:18:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/25 10:17:58 | 000,875,944 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/24 19:34:20 | 000,459,002 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:43 | 000,211,421 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:12 | 000,139,264 | —- | M] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:07 | 000,923,136 | —- | M] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/22 14:42:08 | 000,369,584 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2013/08/22 14:42:08 | 000,175,176 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | M] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:41:59 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/08/22 14:08:35 | 000,449,812 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/21 21:39:01 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-813497703-839522115-1003.job
[2013/08/20 16:17:12 | 000,001,876 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:34 | 003,858,143 | —- | M] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 16:07:23 | 001,018,949 | —- | M] (Thisisu) – C:\Documents and Settings\Christine\Desktop\JRT.exe
[2013/08/20 12:31:40 | 000,000,981 | —- | M] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 12:31:40 | 000,000,963 | —- | M] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 18:52:44 | 000,001,655 | —- | M] () – C:\WINDOWS\System32\Wacom_Tablet.dat
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120418.backup
[2013/08/18 17:35:13 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-120228.backup
[2013/08/18 17:30:41 | 000,000,392 | RHS- | M] () – C:\boot.ini
[2013/08/18 17:22:49 | 005,105,231 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\ComboFix.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | M] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 15:06:18 | 004,745,728 | —- | M] (AVAST Software) – C:\Documents and Settings\Christine\Desktop\aswMBR.exe
[2013/08/18 14:11:40 | 000,666,633 | —- | M] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/18 11:08:39 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Christine\Desktop\dds.scr
[2013/08/18 11:07:18 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Christine\Desktop\OTL.exe
[2013/08/15 11:54:11 | 000,481,216 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/15 11:54:11 | 000,079,672 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/07 09:58:10 | 000,002,455 | —- | M] () – C:\Documents and Settings\Christine\Desktop\HiJackThis.lnk
[2013/08/05 15:46:52 | 000,000,396 | —- | M] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 15:29:40 | 000,000,412 | —- | M] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2013/08/03 02:27:49 | 000,449,839 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-130835.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093359.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130818-093319.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183845.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-183810.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-152248.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-150257.backup
[2013/08/03 02:27:49 | 000,449,839 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130817-141503.backup
[2013/07/27 00:57:01 | 000,449,574 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130731-142401.backup
[2013/07/27 00:57:01 | 000,449,574 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130803-022749.backup
[2013/07/27 00:48:47 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2013/08/25 10:17:58 | 000,875,944 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/24 19:34:20 | 000,459,002 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.zip
[2013/08/24 19:28:37 | 000,211,421 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.7z
[2013/08/24 16:12:20 | 000,139,264 | —- | C] () – C:\Documents and Settings\Christine\Desktop\SystemLook.exe
[2013/08/24 14:33:11 | 000,923,136 | —- | C] () – C:\Documents and Settings\Christine\Desktop\RogueKiller.exe
[2013/08/23 15:56:25 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSP.sys.sum
[2013/08/22 14:42:08 | 000,000,175 | —- | C] () – C:\WINDOWS\System32\drivers\aswSnx.sys.sum
[2013/08/22 14:42:05 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2013/08/22 14:42:01 | 000,175,176 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/22 14:42:00 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/22 14:42:00 | 000,000,370 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/08/20 16:17:12 | 000,001,876 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/20 16:08:28 | 003,858,143 | —- | C] () – C:\Documents and Settings\Christine\Desktop\tweaking.com_registry_backup_setup.exe
[2013/08/20 11:53:17 | 000,000,981 | —- | C] () – C:\Documents and Settings\Christine\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/08/20 11:53:17 | 000,000,963 | —- | C] () – C:\Documents and Settings\Christine\Desktop\Spybot - Search & Destroy.lnk
[2013/08/18 17:28:44 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/18 17:28:44 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/18 17:28:44 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/18 17:28:44 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/18 17:28:44 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/18 15:24:26 | 000,000,512 | —- | C] () – C:\Documents and Settings\Christine\Desktop\MBR.dat
[2013/08/18 14:11:43 | 000,666,633 | —- | C] () – C:\Documents and Settings\Christine\Desktop\AdwCleaner.exe
[2013/08/05 15:47:21 | 000,465,224 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1229272821-813497703-839522115-1003-0.dat
[2013/08/05 15:47:20 | 000,428,818 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2013/08/05 13:58:37 | 000,000,616 | —- | C] () – C:\WINDOWS\tasks\Christine Merge.job
[2013/08/05 13:58:24 | 000,000,604 | —- | C] () – C:\WINDOWS\tasks\Christine.job
[2013/08/05 13:54:37 | 000,000,396 | —- | C] () – C:\WINDOWS\tasks\Christine DBAgent 2 0.job
[2013/08/05 13:54:05 | 000,000,412 | —- | C] () – C:\WINDOWS\tasks\Seagate_Install_Launch.job
[2013/08/05 13:53:39 | 000,001,932 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Seagate Dashboard 2.0.lnk
[2012/09/09 16:02:52 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2012/09/09 16:02:47 | 000,618,823 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2012/09/09 16:02:47 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2012/03/17 16:13:43 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/01/22 21:19:29 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2010/07/30 13:21:08 | 000,027,648 | —- | C] () – C:\Documents and Settings\Christine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/19 15:48:43 | 000,000,004 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2009/10/26 18:00:48 | 008,801,704 | —- | C] () – C:\Program Files\FLV PlayerATBSetup.exe

========== ZeroAccess Check ==========

[2009/09/20 00:21:28 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2009/07/18 08:05:06 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 04:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/13 16:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2009/10/09 17:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2013/08/22 14:41:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2010/03/10 13:45:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2013/08/05 13:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2013/03/10 15:54:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2012/07/13 09:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{6AD8E59C-250C-4201-B5BA-56ADEF76FF46}
[2009/10/09 17:18:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\acccore
[2010/12/07 22:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Amazon
[2009/12/17 18:16:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\CoreFTP
[2011/09/27 13:20:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\ElevatedDiagnostics
[2010/06/07 09:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\EPSON
[2010/03/11 07:10:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leader Technologies
[2010/03/10 13:53:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Leadertech
[2012/09/02 15:09:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Safer Networking
[2013/08/05 13:45:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Seagate
[2012/09/01 11:50:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\TestApp
[2010/07/23 21:10:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Christine\Application Data\Thunderbird

========== Purity Check ==========



< End of report >
Post #44
Please do the following for me…

Please download HostsXpert from the link below.

http://www.funkytoad.com/download/HostsXpert.zip

Unzip HostsXpert.zip
Open HostsXpert.exe.

you have to click: ''make hosts writable'' in the top right corner, then press the ''restore MS hosts file'' option

Close program when complete.

Empty Recycle Bin

Reboot and "copy/paste" a new SpyBot log file into this thread.
Also please describe how your computer behaves at the moment.
Post #45
I think I have a possible clue to where its hidden its annoying little filebutt.

Remember how I mentioned back at the beginning that it happens a lot after a Windows update? Particularly ones that require opening Internet Exploder. Windows updates that require opening a browser are the only times I use Internet Explorer 8….which I just discovered had a redirect written into the 'home page' box under my Internet Options, and which also tried to redirect when I opened it to check the settings actually in the program. It also keeps popping up with the 'Welcome to Internet Explorer 8' every time I open it, but I just close that. I'd love to uninstall it permanently, but according to MS that requires uninstalling SP3 first, then IE, then reinstalling SP3…then reinstalling IE8 if I need to use it later. It does not appear under 'Add or Remove Programs' because of SP3.

Also, I DO NOT use a proxy for my internet. The only place a 'proxy' is enabled is in the registry, in the lines above the registry entries that Spybot lists below, which my bit of research tells me AVSecuritySuite does along with inserting these entries. And I THINK a previous time I came here I was told to erase those associated entries, but I guess you guys must erase threads after a certain period of time or I could check.

Oh right, forgot to mention the HOSTS file thing…the HOSTS file only had one entry '127.0.0.1 ' and when I did as instructed nothing changed, and there was no option to Save, so I just reset it back to Read only, and closed the program. There wasn't anything in the Recycle bin, either. Rebooted, ran Spybot after clicking on a few more things to include in the report that weren't checked before.

Spybot file attached 'cause it was just over the limit.

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI