microsoft distribution service 3.0 and PUP [Solved]

hello ,
for a week or so now i have been having trouble with my computer, takes long time to bootup or and close down sometimes will not close down at all , and had to cut the power ??
bad sound , gurggling ,long drawnout words
as if not loaded properly ,
sometimes my email wont work
generaly running slower , browser sometimes freezes im using firefox

I tried to to do a restore but that never works

i tried it in safe mode that didnt work there is a lot of software distribution service 3.0 saved points

it started when i got blocked from my facebook account in them saying i have a virus so in checking yes there was a PUP trojan optional
Pup toolbar x5 , (that i cannot find )
Pup.bprotector x2
Pup Babylon
babylon toolbar ?????


iv used
Malawarebyts free
Super anitspyware spy trial
hitman pro trial
AVG free come up with ( inline Hook ntkrnlpa-exe c/Windows system32 med cannot remove access denied )

a question should i get rid of adware cookies ,( i have )


ok now is a copy of start up
StartupList report, 19/08/2013, 7:52:09 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\User\Desktop\Diognosing\HiJackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v8.00 (8.00.6001.18702)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\AVG\AVG2013\avgemcx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WebUpdateSvc4.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ControlCenter4\BrCtrlCntr.exe
C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DriverUpdate\DriverUpdate.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\ControlCenter4\BrCcUxSys.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\User\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\User\Desktop\Diognosing\HiJackThis.exe

————————————————–

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
PSQLLauncher = "C:\Program Files\Protector Suite QL\launcher.exe" /startup
IntelZeroConfig = "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
IntelWireless = "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
EOUApp = "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
APSDaemon = "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
ControlCenter4 = C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun
BrStsMon00 = C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN
IndexSearch = "C:\Program Files\Nuance\PaperPort\IndexSearch.exe"
PPort12reminder = "C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"
RTHDCPL = RTHDCPL.EXE
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
Allin1Convert Search Scope Monitor = "C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hsrchmn.exe" /m=2 /w /h
Allin1Convert_8h Browser Plugin Loader = C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Google Update = "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
RoboForm = "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
Adobe Reader Synchronizer = "C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe"
DriverUpdate = "C:\Program Files\DriverUpdate\DriverUpdate.exe" -boot

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
(no name) - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll - {551A852F-39A6-44A7-9C13-AFBEC9185A9D}
RoboForm BHO - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll - {724d43a9-0d85-11d4-9908-00400523e39a}
(no name) - C:\Program Files\Java\jre7\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - (no file) - {a235e1e3-6296-4710-af39-104a7faa6c7c}
MediaBar - (no file) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}
(no name) - C:\Program Files\Java\jre7\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
ChromeFrame BHO - C:\Program Files\Google\Chrome\Application\28.0.1500.95\npchrome_frame.dll - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7}
(no name) - (no file) - {f236ca79-3123-4afb-9f74-e98117ad5625}
(no name) - C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbar.dll - {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d}

————————————————–

Enumerating Task Scheduler jobs:

Adobe Flash Player Updater.job
AppleSoftwareUpdate.job
At1.job
DriverUpdate Scan.job
GoogleUpdateTaskMachineCore.job
GoogleUpdateTaskMachineUA.job
GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003Core.job
GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003UA.job
ParetoLogic Registration3.job
ParetoLogic Update Version3 Startup Task.job
ParetoLogic Update Version3.job
RealDownloaderDownloaderScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
RealDownloaderRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
RealPlayerRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
RegCure Pro.job
RegCure Pro_sch_E7E215FE-D549-11E2-9EB0-0019D2C6D852.job
SUPERAntiSpyware Scheduled Task 30727d94-c041-43f1-bda9-3abca887b852.job
SUPERAntiSpyware Scheduled Task 38fe5e8f-bbb3-4a5d-985e-0440f2bd68ed.job

————————————————–

Enumerating Download Program Files:

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://www.update.microsoft.com/microsoftu…b?1364512205890

[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

————————————————–

Enumerating Winsock LSP files:

NameSpace #4: C:\WINDOWS\system32\wshbth.dll
NameSpace #5: C:\Program Files\Bonjour\mdnsNSP.dll

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

————————————————–
End of report, 9,725 bytes
Report generated in 0.125 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


……………………………………………………

and

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:58:26 AM, on 19/08/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\AVG\AVG2013\avgemcx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WebUpdateSvc4.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ControlCenter4\BrCtrlCntr.exe
C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DriverUpdate\DriverUpdate.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\ControlCenter4\BrCcUxSys.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\User\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\User\Desktop\Diognosing\HiJackThis.exe
C:\WINDOWS\system32\notepad.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {7a55cbb2-2b2e-4a41-9de1-6ac5d2c2be0a} - (no file)
R3 - URLSearchHook: (no name) - {4c60e5ab-5c68-4c59-abaa-885010b24b32} - (no file)
R3 - URLSearchHook: (no name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - (no file)
O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts
O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
O2 - BHO: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll
O2 - BHO: RoboForm BHO - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Toolbar BHO - {a235e1e3-6296-4710-af39-104a7faa6c7c} - (no file)
O2 - BHO: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome\Application\28.0.1500.95\npchrome_frame.dll
O2 - BHO: Search Assistant BHO - {f236ca79-3123-4afb-9f74-e98117ad5625} - (no file)
O2 - BHO: Toolbar BHO - {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d} - C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
O3 - Toolbar: &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Utility Chest - {cf67755f-9265-449c-87cf-b945519e073b} - (no file)
O3 - Toolbar: VideoDownloadConverter - {48586425-6bb7-4f51-8dc6-38c88e3ebb58} - (no file)
O3 - Toolbar: Allin1Convert - {cd1a63ba-a08c-431b-9a34-f240aadc728d} - C:\Program Files\Allin1Convert_8h\bar\1.bin\8hbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe /autorun
O4 - HKLM\..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\Nuance\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort12reminder] "C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\12\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Allin1Convert Search Scope Monitor] "C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hsrchmn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [Allin1Convert_8h Browser Plugin Loader] C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Adobe Reader Synchronizer] "C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe"
O4 - HKCU\..\Run: [DriverUpdate] "C:\Program Files\DriverUpdate\DriverUpdate.exe" -boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://buttons.allin1convert.com/one-toolb…mp;n=2013081619
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Open with PDF Viewer Plus - res://C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: RoboForm Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra 'Tools' menuitem: Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1364512205890
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome\Application\28.0.1500.95\npchrome_frame.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - - (no file)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Allin1ConvertService (Allin1Convert_8hService) - COMPANYVERS_NAME - C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrYNSvc - Brother Industries, Ltd. - C:\Program Files\Browny02\BrYNSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FromDocToPDFService (FromDocToPDF_65Service) - Unknown owner - C:\PROGRA~1\FROMDO~2\bar\1.bin\65barsvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HitmanPro Scheduler (HitmanProScheduler) - SurfRight B.V. - C:\Program Files\HitmanPro\hmpsched.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\MsMpEng.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (O2Flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: PDFProFiltSrvPP - Nuance Communications, Inc. - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Utility ChestService (UtilityChest_49Service) - Unknown owner - C:\PROGRA~1\UTILIT~2\bar\1.bin\49barsvc.exe (file missing)
O23 - Service: vToolbarUpdater15.4.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe (file missing)
O23 - Service: Web Update Wizard Service V4 (WebUpdate4) - Data Perceptions / PowerProgrammer - C:\WINDOWS\system32\WebUpdateSvc4.exe

–
End of file - 16546 bytes

hope this helps and i hope it can be fixed
thanks
michelle

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• The fixes are specific to your problem and should only be used for the issues on this machine.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
• Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that…. [external image: Posted Image] Let's get going!!
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
• Double click dds to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download TDSSKiller

• Double click TDSSKiller.exe
• Press Start Scan but do nothing else as we are just looking for what is there.
• If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
• Attach the log in your next reply
  
• A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-

[external image: Posted Image] AdwCleaner

Please download AdwCleaner by Xplode onto your desktop.

• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• A logfile will automatically open after the scan has finished.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[R1].txt as well.

———-

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.30.10

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
User :: ACER_TM6460 [administrator]

1/08/2013 6:36:38 AM
mbam-log-2013-08-01 (06-36-38).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 304293
Time elapsed: 1 hour(s), 17 minute(s), 13 second(s)

Memory Processes Detected: 3
C:\Documents and Settings\All Users\Application Data\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Browser.Defender.A) -> 2052 -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Browser.Defender.A) -> 2308 -> Delete on reboot.
C:\Program Files\Wajam\Updater\WajamUpdater.exe (PUP.Optional.Wajam) -> 3032 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 12
HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCR\wajam.WajamBHO.1 (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCR\wajam.WajamBHO (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} (PUP.Browser.Defender.A) -> Quarantined and deleted successfully.
HKLM\SYSTEM\CurrentControlSet\Services\WajamUpdater (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\Documents and Settings\User\Application Data\Babylon (PUP.Optional.Babylon.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Dealply (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Dealply\UpdateProc (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.

Files Detected: 13
C:\Documents and Settings\All Users\Application Data\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe (PUP.Browser.Defender.A) -> Delete on reboot.
C:\Program Files\Wajam\IE\priam_bho.dll (PUP.Optional.Wajam) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe (PUP.Browser.Defender.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Dealply\UpdateProc\UpdateTask.exe (PUP.DealPly.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Desktop\Programs\Regwork_Installer.exe (PUP.Optional.AskToolbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Quarantined and deleted successfully.
C:\Program Files\Wajam\Updater\WajamUpdater.exe (PUP.Optional.Wajam) -> Delete on reboot.
C:\Documents and Settings\User\Application Data\Dealply\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Application Data\Dealply\UpdateProc\TTL.DAT (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.

(end)


and results not revoved what should i do about my briefcase and portable hard drive ??? this is important to me

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.16.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
User :: ACER_TM6460 [administrator]

17/08/2013 5:28:33 PM
MBAM-log-2013-08-17 (18-20-50) xxxxxxxxx.txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 243179
Time elapsed: 34 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 4
C:\Program Files\MyPC Backup\AWSSDK.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\LogicNP.EZShellExtensions.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\MPCBIconOverlays.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll (PUP.Optional.MyPCBackup) -> No action taken.

Registry Keys Detected: 2
HKLM\SYSTEM\CurrentControlSet\Services\BackupStack (PUP.Optional.MyPCBackup) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup (PUP.Optional.MyPCBackup) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 15
C:\Program Files\MyPC Backup (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Config (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\11081311 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\x64 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\x86 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\~updates (PUP.Optional.MyPCBackup) -> No action taken.

Files Detected: 207
C:\Program Files\MyPC Backup\pt_PT.mo (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\MPCBClient.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\aff.conf (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.51.x86.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.52.x64.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.52.x86.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.60.x64.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.60.x86.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AlphaVSS.Common.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\AWSSDK.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\BackupStack.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Crypto32.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Crypto64.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\debug.txt (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\de_DE.mo (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\diffstack.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\es_ES.mo (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\fr_FR.mo (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\GetText.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\it_IT.mo (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\LogicNP.EZShellExtensions.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\MPCBContextMenu.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\MPCBIconOverlays.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\MyPC Backup.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\mypcbackup.ico (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\RegisterExtensionDotNet20_x64.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\RegisterExtensionDotNet20_x86.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\RestartExplorer.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Service Start.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Shared Stack.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Signup Wizard.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\spf.dat (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\syncicon.ico (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\syncing.ico (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\tick.ico (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\uninst.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\UnRegisterExtensions.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Updater.exe (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Config\api.cred (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Config\api.ts2 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_backup_conf.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_file_cache.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_queues.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_resumable.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_settings.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_sig_cache.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Database\mpcb_version_queue.db (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\CLIENT.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\LICENCE.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\OVERLAY.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\REMOTING.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\SETTINGS.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\log\SHELL.log (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\6acde3bd-9147-4c50-ac95-2d5f05f687bacompleteQueue.queue (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\804303cc-9e93-4fc0-9217-eeca5436e0d2completeQueue.queue (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\jux1xfup.ahn (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\0wybfkou.xv3 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\23cdwmf0.qdk (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\brww4gvw.i5r (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\dq4iiwb4.dak (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\hjpyuyep.ziy (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\opkacyq0.h14 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\qt1puvxc.riv (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\tzlaiq5u.5o4 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\08081311\xd2e4lod.oxg (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\d1yjtd4o.ybx (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\knwigrm5.0bj (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\bipt0kgt.gfu (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\nzvm4kcw.10y (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\pdm0eaw2.0tt (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\qcfbucs0.v43 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\tisctd4k.iwh (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\ztg1d0xv.mep (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\zuhxjjxj.wt3 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\f24skoqv.nji (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\glrqnvbg.gub (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\09081311\hqwoegfi.or1 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\11081311\bxzznhkz.v2y (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\0aggpmmq.nsj (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\aiajnkeu.gqn (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\gi5pjiam.sx5 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\guh2vdmz.0zg (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\k2o0vhmy.a2v (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\ouwwjtwz.aot (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\q4hgsham.khh (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\re34nafk.h3u (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\tivgdlpf.cap (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\wdwmcg5k.5iy (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\12081302\zoquoci5.jao (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\hhug4cj3.mff (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\rf4vvlxr.qob (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\khgzwcwc.axl (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\qxcih5t4.xjn (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\r30h5hd4.ljx (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\u3qkmeen.g2f (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\uqyg4b5q.gsl (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\xesidnt3.hpp (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\yv5ahycn.ueq (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\2wt4oftl.tfy (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\cp42jf3q.bh0 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\fqt43lnt.4le (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\fwkbantn.bs3 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\cache\13081311\gtmsxlph.qv4 (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_02892475-5dc0-459a-bcf1-6ce0a359ac7f_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_02892475-5dc0-459a-bcf1-6ce0a359ac7f_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_057ee084-5416-48da-aebb-2077cf2076dd_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_057ee084-5416-48da-aebb-2077cf2076dd_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_0c0f291b-24ae-41af-b7f7-b489e4deb0ac_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_0c0f291b-24ae-41af-b7f7-b489e4deb0ac_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_0dcf7d00-6bb1-4e13-a80a-a3809594ed59_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_0dcf7d00-6bb1-4e13-a80a-a3809594ed59_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_125d7115-0637-4cbd-8ae8-48c6f743b694_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_125d7115-0637-4cbd-8ae8-48c6f743b694_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_c1140427-a56d-4fd2-8bdc-6055adc2fbbc_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_c1140427-a56d-4fd2-8bdc-6055adc2fbbc_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_ca8ab554-9bc6-4013-913c-b74ad8b6affc_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_ca8ab554-9bc6-4013-913c-b74ad8b6affc_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_cf6e57bc-4c85-4da3-b339-a27635d1b464_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_cf6e57bc-4c85-4da3-b339-a27635d1b464_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d439ff0d-0938-41df-ad45-8e4410eb5f52_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_7d142a43-fa24-4a3c-ba20-220bd704a089_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_7ff6f97b-4792-41fd-96ee-fdd869c27efb_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_7ff6f97b-4792-41fd-96ee-fdd869c27efb_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_8090bf16-f789-4587-b469-e2138747f1d4_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_8090bf16-f789-4587-b469-e2138747f1d4_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_836d6449-cb1b-4c14-b5c2-4141114fec52_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_836d6449-cb1b-4c14-b5c2-4141114fec52_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_8aeda0c6-2c95-4297-96bc-c56705bb5c04_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_8aeda0c6-2c95-4297-96bc-c56705bb5c04_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_94d2a107-d34e-40c2-b2d4-65f666fe7ac1_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_94d2a107-d34e-40c2-b2d4-65f666fe7ac1_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_a427278b-8703-421a-a5f7-11addfb604b3_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_a427278b-8703-421a-a5f7-11addfb604b3_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_590eeae7-2605-478c-9680-31ffdf949c10_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_590eeae7-2605-478c-9680-31ffdf949c10_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_5b87ba9c-956d-414b-a328-3051625dae9d_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_5b87ba9c-956d-414b-a328-3051625dae9d_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_61958dac-7c77-407d-a741-ca5f8fa40c0b_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_61958dac-7c77-407d-a741-ca5f8fa40c0b_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_6a6f36fb-ccc1-41a4-bdd5-13bde0dcdf31_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_6a6f36fb-ccc1-41a4-bdd5-13bde0dcdf31_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_6ac5827e-df61-4e8f-923a-716ead751d48_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_6ac5827e-df61-4e8f-923a-716ead751d48_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_1883cabd-b873-4cc5-a38a-67d975e86f67_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3e2b8630-61d1-4ed5-8301-766b49de70f4_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_514a2b71-7fbb-4f27-af7b-82d12ef22e6d_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_7d142a43-fa24-4a3c-ba20-220bd704a089_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d439ff0d-0938-41df-ad45-8e4410eb5f52_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_a479fcfc-ebc7-4af0-b55a-60584b939561_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_a479fcfc-ebc7-4af0-b55a-60584b939561_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_aaf05f47-c4cc-4fb8-add4-e82242c87d79_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_aaf05f47-c4cc-4fb8-add4-e82242c87d79_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_acf39fa3-3be0-4b65-8d8a-af335b78fd14_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_acf39fa3-3be0-4b65-8d8a-af335b78fd14_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_b0262498-c5e0-4b70-b460-9de5320cc807_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_b0262498-c5e0-4b70-b460-9de5320cc807_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_b1891d50-f55c-4403-b0bc-a61ea935209e_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_b1891d50-f55c-4403-b0bc-a61ea935209e_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_bdcf4f95-28be-49ed-be55-aaf990704878_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_bdcf4f95-28be-49ed-be55-aaf990704878_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_eed6c14d-f953-4945-8c0d-892e7dee5ac2_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_eed6c14d-f953-4945-8c0d-892e7dee5ac2_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_f22b65f9-0581-459e-b9a8-7644361256a6_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_f22b65f9-0581-459e-b9a8-7644361256a6_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_f485abc7-9cd8-472c-8f54-caddf64e9020_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_f485abc7-9cd8-472c-8f54-caddf64e9020_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_fbfdce37-aafa-43ef-b083-86d692dfe445_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_fbfdce37-aafa-43ef-b083-86d692dfe445_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3e2b8630-61d1-4ed5-8301-766b49de70f4_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_44de6835-c653-43a9-a69e-25a851628142_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_44de6835-c653-43a9-a69e-25a851628142_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_499b8abf-64db-4658-8f3d-04d494965c3b_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_499b8abf-64db-4658-8f3d-04d494965c3b_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_49a5d7a7-1947-41c2-aae0-5dab29c05b9d_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_49a5d7a7-1947-41c2-aae0-5dab29c05b9d_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_4c75af76-4991-49c8-a741-e9629b8cddfb_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_4c75af76-4991-49c8-a741-e9629b8cddfb_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_514a2b71-7fbb-4f27-af7b-82d12ef22e6d_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_1883cabd-b873-4cc5-a38a-67d975e86f67_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_318f1d54-76c0-4521-8fc5-f494a5806dd3_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_318f1d54-76c0-4521-8fc5-f494a5806dd3_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3192cc42-c799-45bb-8ca6-ce635bc2aabb_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3192cc42-c799-45bb-8ca6-ce635bc2aabb_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3216cd98-60c7-4193-bba0-5abb1e2add6c_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3216cd98-60c7-4193-bba0-5abb1e2add6c_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_322c814a-c799-4dee-ae62-0f6694eca3a4_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_322c814a-c799-4dee-ae62-0f6694eca3a4_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3d099b78-2125-45af-81a4-8c855cf7a77a_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_3d099b78-2125-45af-81a4-8c855cf7a77a_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d585be7a-023e-4132-bc8b-81110b3847a8_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d585be7a-023e-4132-bc8b-81110b3847a8_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d5ab7264-3a72-41b9-b17d-a8195d9a98bd_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_d5ab7264-3a72-41b9-b17d-a8195d9a98bd_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_dc3bbcbc-590e-442e-a34a-665eb313d4a9_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_dc3bbcbc-590e-442e-a34a-665eb313d4a9_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_e45e1536-5ea4-439f-afd0-668fc09ce81a_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_e45e1536-5ea4-439f-afd0-668fc09ce81a_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_ee9bc202-f200-48c3-9ff6-1bd1d964cc1b_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_ee9bc202-f200-48c3-9ff6-1bd1d964cc1b_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_78168db0-0b3e-42f9-837e-8bf6bd2a1abe_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_78168db0-0b3e-42f9-837e-8bf6bd2a1abe_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_78cdab91-89af-49fb-98cb-94d8ea33011b_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_78cdab91-89af-49fb-98cb-94d8ea33011b_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_79ab7492-7b3d-4417-ba4d-55a7c2a18995_backupKeyCache.block (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\Resources\keycache\_79ab7492-7b3d-4417-ba4d-55a7c2a18995_backupKeyCache.tree (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\x64\System.Data.SQLite.dll (PUP.Optional.MyPCBackup) -> No action taken.
C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll (PUP.Optional.MyPCBackup) -> No action taken.

(end


i ran a chkdsk that took all night to run and missed when it finished , but did get to read disk was ok
so now i rill run the programs you said but i will send this one first
thanks
michelle


i keep having troubles sending this to you

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Jeffs First check test result

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.11.2
Run by [removed] at 17:59:22 on 2013-08-20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1775 [GMT 10:00]
.
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: AVG Firewall *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\WebUpdateSvc4.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DriverUpdate\DriverUpdate.exe
C:\Program Files\ControlCenter4\BrCtrlCntr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\ControlCenter4\BrCcUxSys.exe
C:\DOCUME~1\User\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uURLSearchHooks: : {7a55cbb2-2b2e-4a41-9de1-6ac5d2c2be0a} - LocalServer32 -
uURLSearchHooks: : {4c60e5ab-5c68-4c59-abaa-885010b24b32} - LocalServer32 -
uURLSearchHooks: : {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - LocalServer32 -
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} -
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: {a235e1e3-6296-4710-af39-104a7faa6c7c} -
BHO: {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} -
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: ChromeFrame BHO: {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - c:\program files\google\chrome\application\28.0.1500.95\npchrome_frame.dll
BHO: Search Assistant BHO: {f236ca79-3123-4afb-9f74-e98117ad5625} - LocalServer32 -
BHO: Toolbar BHO: {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d} - c:\program files\allin1convert_8h\bar\1.bin\8hbar.dll
TB: &RoboForm Toolbar: {724D43A0-0D85-11D4-9908-00400523E39A} - c:\program files\siber systems\ai roboform\roboform.dll
TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Allin1Convert: {cd1a63ba-a08c-431b-9a34-f240aadc728d} - c:\program files\allin1convert_8h\bar\1.bin\8hbar.dll
uRun: [Google Update] "c:\documents and settings\user\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [Adobe Reader Synchronizer] "c:\program files\adobe\reader 10.0\reader\AdobeCollabSync.exe"
uRun: [DriverUpdate] "c:\program files\driverupdate\DriverUpdate.exe" -boot
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PSQLLauncher] "c:\program files\protector suite ql\launcher.exe" /startup
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [EOUApp] "c:\program files\intel\wireless\bin\EOUWiz.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ControlCenter4] c:\program files\controlcenter4\BrCcBoot.exe /autorun
mRun: [BrStsMon00] c:\program files\browny02\brother\BrStMonW.exe /AUTORUN
mRun: [IndexSearch] "c:\program files\nuance\paperport\IndexSearch.exe"
mRun: [PPort12reminder] "c:\program files\nuance\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\12\config\ereg\Ereg.ini"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Allin1Convert Search Scope Monitor] "c:\progra~1\allin1~2\bar\1.bin\8hsrchmn.exe" /m=2 /w /h
mRun: [Allin1Convert_8h Browser Plugin Loader] c:\progra~1\allin1~2\bar\1.bin\8hbrmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [GoogleChromeAutoLaunch_BB7E6CE705E9E15ABCB72D3060D30B1F] "c:\program files\google\chrome\application\chrome.exe" –no-startup-window
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tl-wn3~1.lnk - c:\program files\tp-link\tl-wn321g wireless utility\installer\winxp\TWCU.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Search - http://buttons.allin1convert.com/one-toolb…mp;n=2013081619
IE: Customize Menu - c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Fill Forms - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Open with PDF Viewer Plus - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Save Forms - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Show RoboForm Toolbar - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1364512205890
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.0.1 192.168.1.1
TCP: Interfaces\{8BA44A5F-843B-4E98-BDC6-56E16580901F} : DHCPNameServer = 192.168.0.1 192.168.1.1
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome\application\28.0.1500.95\npchrome_frame.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: psfus - psqlpwd.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli psqlpwd
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.95\installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com.au/
FF - prefs.js: keyword.enabled - false
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\np-mswmp.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\user\local settings\application data\citrix\plugins\97\npappdetector.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\allin1convert_8h\bar\1.bin\NP8hStub.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll
FF - ExtSQL: 2013-07-27 21:49; {B40794A0-7477-4335-95C5-8CB9BBC5C4A5}; c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF - ExtSQL: 2013-08-15 09:41; 8hffxtbr@Allin1Convert_8h.com; c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\8hffxtbr@Allin1Convert_8h.com
FF - ExtSQL: !HIDDEN! 2013-08-15 09:41; 8hffxtbr@Allin1Convert_8h.com; c:\program files\allin1convert_8h\bar\1.bin
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 60216]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-8-9 246072]
R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 96568]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 39224]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 208184]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 22328]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 171320]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 182072]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-8-31 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-23 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2013-7-4 4939312]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2013-7-23 283136]
R2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\hitmanpro\hmpsched.exe [2013-8-10 106280]
R2 ipasintf;ipasintf;c:\windows\system32\drivers\pas2k.sys [2006-7-10 78280]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-6-15 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-6-15 701512]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-6-26 35088]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\nuance\paperport\PDFProFiltSrvPP.exe [2010-3-9 144672]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2013-4-16 39056]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-7-12 3289472]
R2 smihlp;SMI helper driver;c:\program files\protector suite ql\smihlp.sys [2006-9-1 3328]
R2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [2008-1-19 258264]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2013-3-20 26080]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2010-10-12 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-6-15 22856]
R3 NETwLx32; Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;c:\windows\system32\drivers\NETwLx32.sys [2013-2-24 6607744]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2006-2-16 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2006-2-20 43608]
S0 mnagoil;mnagoil;c:\windows\system32\drivers\gbnxcw.sys –> c:\windows\system32\drivers\gbnxcw.sys [?]
S0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\mpfilter.sys –> c:\windows\system32\drivers\MpFilter.sys [?]
S1 MpKsle033037d;MpKsle033037d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{996c69fe-556b-47da-ad95-1e462181b36c}\mpksle033037d.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{996c69fe-556b-47da-ad95-1e462181b36c}\MpKsle033037d.sys [?]
S2 Allin1Convert_8hService;Allin1ConvertService;c:\progra~1\allin1~2\bar\1.bin\8hbarsvc.exe [2013-8-15 42504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 FromDocToPDF_65Service;FromDocToPDFService;c:\progra~1\fromdo~2\bar\1.bin\65barsvc.exe –> c:\progra~1\fromdo~2\bar\1.bin\65barsvc.exe [?]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-21 162408]
S2 UtilityChest_49Service;Utility ChestService;c:\progra~1\utilit~2\bar\1.bin\49barsvc.exe –> c:\progra~1\utilit~2\bar\1.bin\49barsvc.exe [?]
S2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files\common files\avg secure search\vtoolbarupdater\15.4.0\toolbarupdater.exe –> c:\program files\common files\avg secure search\vtoolbarupdater\15.4.0\ToolbarUpdater.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2013-2-24 1691480]
S3 BrYNSvc;BrYNSvc;c:\program files\browny02\BrYNSvc.exe [2012-12-25 245760]
S3 GAGPDrv;GAGPDrv; [x]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2013-2-24 13464]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
.
=============== Created Last 30 ================
.
2013-08-18 14:33:01 ——– d—–w- c:\documents and settings\user\local settings\application data\IAC
2013-08-18 14:32:20 ——– d—–w- c:\documents and settings\user\application data\ParetoLogic
2013-08-18 13:55:35 ——– d—–w- c:\windows\Social Lead Fox
2013-08-18 13:46:04 ——– d—–w- c:\documents and settings\user\local settings\application data\Microsoft Help
2013-08-18 13:44:21 ——– d—–w- c:\program files\HitmanPro
2013-08-16 02:58:49 ——– d—–w- c:\documents and settings\user\application data\DriverCure
2013-08-16 02:58:26 ——– d—–w- c:\program files\common files\ParetoLogic
2013-08-16 02:58:12 ——– d—–w- c:\program files\ParetoLogic
2013-08-16 02:58:12 ——– d—–w- c:\documents and settings\all users\application data\ParetoLogic
2013-08-14 23:41:41 ——– d—–w- c:\documents and settings\user\application data\Allin1Convert_8h
2013-08-14 23:41:17 ——– d—–w- c:\program files\Allin1Convert_8h
2013-08-11 04:27:53 ——– d—–w- c:\program files\SocialLeadFox
2013-08-11 00:55:17 30512 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
2013-08-11 00:55:16 29552 —-a-w- c:\windows\system32\mdimon.dll
2013-08-11 00:48:50 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2013-08-11 00:47:56 ——– d—–w- c:\windows\SHELLNEW
2013-08-11 00:19:23 ——– d—–w- c:\program files\PowerISO
2013-08-09 12:53:58 ——– d—–w- c:\documents and settings\all users\application data\HitmanPro
2013-08-08 03:42:28 ——– d—–w- c:\program files\UPDF
2013-08-04 03:59:10 ——– d—–w- c:\documents and settings\user\application data\OpenOffice.org
2013-08-04 03:42:13 ——– d—–w- c:\program files\OpenOffice.org 3
2013-08-03 21:37:56 ——– d—–w- c:\windows\system32\wbem\repository\FS
2013-08-03 21:37:56 ——– d—–w- c:\windows\system32\wbem\Repository
2013-08-01 04:01:10 ——– d—–w- c:\program files\Zula Games
2013-08-01 02:57:18 ——– d—–w- c:\documents and settings\user\application data\zulagames
2013-08-01 02:57:11 ——– d—–w- c:\documents and settings\user\application data\SUPERAntiSpyware.com
2013-08-01 02:56:53 ——– d—–w- c:\program files\SUPERAntiSpyware
2013-08-01 02:56:53 ——– d—–w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-07-31 23:55:59 255488 —-a-r- c:\windows\system32\drivers\netr73.sys
2013-07-30 22:29:01 238872 ——w- c:\windows\system32\MpSigStub.exe
.
==================== Find3M ====================
.
2013-08-19 23:19:38 13464 —-a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-08-05 21:19:03 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-05 21:19:02 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-30 05:11:10 37664 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-07-26 02:47:17 920064 —-a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47:13 43520 ——w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47:12 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52:59 385024 ——w- c:\windows\system32\html.iec
2013-07-19 15:51:00 246072 —-a-w- c:\windows\system32\drivers\avglogx.sys
2013-07-19 15:50:56 60216 —-a-w- c:\windows\system32\drivers\avgidshx.sys
2013-07-19 15:50:56 208184 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2013-07-19 15:50:50 171320 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2013-07-12 01:33:31 0 —-a-w- c:\windows\system32\TempWmicBatchFile.bat
2013-07-10 10:37:53 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-09 15:32:40 39224 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2013-07-04 03:03:25 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-04 07:23:02 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40:45 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-28 01:59:37 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2013-05-28 00:41:07 6144 —-a-w- c:\windows\system32\xpsp4res.dll
.
============= FINISH: 18:00:18.90 ===============


AND

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/10/2010 8:36:23 PM
System Uptime: 20/08/2013 9:10:34 AM (9 hours ago)
.
Motherboard: Acer | | Coniston
Processor: Intel® Core™2 CPU T7200 @ 2.00GHz | U2E1 | 1995/166mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 112 GiB total, 15.729 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3D80A1D2A0D1A000
Manufacturer: Microsoft
Name: 1394 Net Adapter #4
PNP Device ID: V1394\NIC1394\3D80A1D2A0D1A000
Service: NIC1394
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\3D80A1D1A0D1A000
Manufacturer: Microsoft
Name: 1394 Net Adapter #3
PNP Device ID: V1394\NIC1394\3D80A1D1A0D1A000
Service: NIC1394
.
Class GUID: {4D36E968-E325-11CE-BFC1-08002BE10318}
Description: ATI Technologies, Inc. 3D RAGE PRO AGP
Device ID: ROOT\DISPLAY\0000
Manufacturer: ATI Technologies, Inc.
Name: ATI Technologies, Inc. 3D RAGE PRO AGP
PNP Device ID: ROOT\DISPLAY\0000
Service: atirage3
.
==== System Restore Points ===================
.
RP737: 25/05/2013 8:19:15 AM - RegCure Pro Backup
RP738: 25/05/2013 8:57:49 AM - Installed AVG 2013
RP739: 29/05/2013 7:41:56 AM - RegCure Pro Backup
RP740: 1/06/2013 7:37:21 AM - RegCure Pro Backup
RP741: 12/06/2013 9:11:40 PM - Software Distribution Service 3.0
RP742: 15/06/2013 6:57:36 AM - RegCure Pro Backup
RP743: 23/06/2013 11:01:24 AM - RegCure Pro Backup
RP744: 29/06/2013 8:04:28 AM - RegCure Pro Backup
RP745: 30/06/2013 11:27:07 AM - Restore Operation
RP746: 6/07/2013 8:04:40 AM - RegCure Pro Backup
RP747: 9/07/2013 3:00:51 PM - DriverUpdate Installing Drivers
RP748: 9/07/2013 3:02:59 PM - Software Distribution Service 3.0
RP749: 11/07/2013 9:14:32 AM - Software Distribution Service 3.0
RP750: 14/07/2013 12:13:22 PM - RegCure Pro Backup
RP751: 17/07/2013 9:44:34 AM - Software Distribution Service 3.0
RP752: 20/07/2013 1:52:15 PM - RegCure Pro Backup
RP753: 28/07/2013 2:01:43 PM - RegCure Pro Backup
RP754: 31/07/2013 8:29:00 AM - Software Distribution Service 3.0
RP755: 31/07/2013 9:30:30 PM - Software Distribution Service 3.0
RP756: 1/08/2013 9:55:55 AM - Unsigned driver install
RP757: 3/08/2013 8:04:14 AM - RegCure Pro Backup
RP758: 3/08/2013 12:27:36 PM - Restore Operation
RP759: 4/08/2013 7:37:14 AM - Restore Operation
RP760: 4/08/2013 1:42:06 PM - Installed OpenOffice.org 3.4.1
RP761: 8/08/2013 10:54:04 PM - System Checkpoint
RP762: 11/08/2013 10:46:19 AM - Installed Microsoft Office Professional Plus 2007
RP763: 11/08/2013 10:55:13 AM - Printer Driver Microsoft Office Document Image Writer Installed
RP764: 12/08/2013 6:35:31 AM - Software Distribution Service 3.0
RP765: 13/08/2013 6:37:07 AM - Software Distribution Service 3.0
RP766: 14/08/2013 6:59:34 AM - Software Distribution Service 3.0
RP767: 14/08/2013 4:35:15 PM - Software Distribution Service 3.0
RP768: 16/08/2013 5:21:12 AM - System Checkpoint
RP769: 16/08/2013 11:17:49 AM - Restore Operation
RP770: 16/08/2013 11:59:12 AM - Restore Operation
RP771: 16/08/2013 1:09:11 PM - RegCure Pro Backup
RP772: 16/08/2013 7:42:41 PM - RegCure Pro Backup
RP773: 17/08/2013 8:22:43 AM - RegCure Pro Backup
RP774: 18/08/2013 11:38:35 AM - Restore Operation
RP775: 18/08/2013 12:19:23 PM - Restore Operation
RP776: 19/08/2013 6:42:42 AM - Restore Operation
.
==== Installed Programs ======================
.
7-Zip 9.20
AdaURL v2.0
Adobe AIR
Adobe Connect Add-in
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.7)
Allin1Convert Firefox Toolbar
Allin1Convert Internet Explorer Toolbar
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Article Spinner 5.0.0.0
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
Avanquest update
AVG 2013
Bonjour
Broadcom NetLink Controller
Brother MFL-Pro Suite MFC-J430W
CardBus Installation Package V1.002
Deal Spy
DriverUpdate
eFORM Dec 2.1.0.1
Elemental Trader 1.5
EmailToolv3.2.0.017 for eFORM
eType
ForexCT
FreeDirectoryBot v2.0
FromDocToPDF Toolbar
GCI Demo (remove only)
Google Chrome
Google Chrome Frame
Google Talk (remove only)
Google Talk Plugin
Google Update Helper
GoToMeeting 5.7.0.1172
HDAUDIO Soft Data Fax Modem with SmartCP
HitmanPro 3.7
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
HP Software Update
HP Unload DLL Patch
Intel® PROSet/Wireless Software
iTunes
Java 7 Update 11
Java Auto Updater
Java™ 6 Update 31
Keyword Blueprint 2
Malwarebytes Anti-Malware version 1.75.0.1300
mCore
mDriver
mDrWiFi
MediaBar
Memories Disc Creator 2.0
mEoU
MetaTrader - FXTG
mHelp
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
mIWA
mLogView
mMHouse
Mozilla Firefox 21.0 (x86 en-US)
Mozilla Maintenance Service
mPfMgr
mPfWiz
mProSafe
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 6 Service Pack 2 (KB973686)
mWlsSafe
mXML
mZConfig
NetComm NB6 Series ADSL2+ Router USB Driver
Nuance PaperPort 12
Nuance PDF Viewer Plus
O2Micro Flash Memory Card Reader Driver (x86)
O2Micro Flash Memory Card Windows Driver V2.03
OpenOffice.org 3.4.1
overland
OZ711 SCR Driver
PaperPort Image Printer
PC Ultra Speed v3.0
PipKey
PIXresizer 2.0.4
Pokki
PowerDVD
PowerISO
Protector Suite 5.4
QuickTime
RAF
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
RegCure Pro
RF Wireless Mouse
RoboForm 7-9-0-0 (All Users)
Scansoft PDF Professional
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2559049)
Security Update for Windows Internet Explorer 7 (KB2586448)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB2829530)
Security Update for Windows Internet Explorer 8 (KB2838727)
Security Update for Windows Internet Explorer 8 (KB2846071)
Security Update for Windows Internet Explorer 8 (KB2847204)
Security Update for Windows Internet Explorer 8 (KB2862772)
Security Update for Windows XP (KB2849470)
Security Update for Windows XP (KB2850869)
Security Update for Windows XP (KB2859537)
Security Update for Windows XP (KB923789)
Skype Click to Call
Skype™ 6.6
SMSC IrCC V5.1.3600.9
Social Lead Fox
Software Update Wizard (Redistributable) 4.5
SqueezeBuzz
SupportResistance
Synaptics Pointing Device Driver
The Market Toolbox (remove only)
TL-WN321G Wireless Utility
Trend Bolt
Ultimate Income Booster version 7
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows Internet Explorer 8 (KB2632503)
Update for Windows XP (KB2863058)
Utility Chest Toolbar
VideoDownloadConverter Firefox Toolbar
VideoDownloadConverter Internet Explorer Toolbar
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - Intel (NETwLx32) net (08/15/2010 13.3.0.137)
Windows Driver Package - Intel (NETwNx32) net (07/14/2010 13.3.0.24)
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
WinPcap 4.1.2
WinZip 17.0
WM Capture 6
WM Recorder
.
==== Event Viewer Messages From Past Week ========
.
20/08/2013 9:20:04 AM, error: Service Control Manager [7022] - The AVGIDSAgent service hung on starting.
18/08/2013 2:44:50 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
18/08/2013 2:29:44 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
18/08/2013 2:28:17 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AVGIDSDriver AVGIDSShim Avgldx86 Fips intelppm MpFilter SASDIFSV SASKUTIL SCDEmu
18/08/2013 2:28:17 PM, error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: A device attached to the system is not functioning.
18/08/2013 12:31:22 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 0019D2C6D852 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
18/08/2013 10:21:14 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
14/08/2013 7:05:00 AM, error: Schedule [7901] - The At1.job command failed to start due to the following error: %%2147942403
14/08/2013 7:00:41 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
14/08/2013 6:28:10 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter
14/08/2013 6:26:07 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Computer Backup (MyPC Backup) service to connect.
14/08/2013 6:26:07 PM, error: Service Control Manager [7000] - The vToolbarUpdater15.4.0 service failed to start due to the following error: The system cannot find the file specified.
14/08/2013 6:26:07 PM, error: Service Control Manager [7000] - The Utility ChestService service failed to start due to the following error: The system cannot find the path specified.
14/08/2013 6:26:07 PM, error: Service Control Manager [7000] - The FromDocToPDFService service failed to start due to the following error: The system cannot find the path specified.
14/08/2013 6:26:07 PM, error: Service Control Manager [7000] - The Computer Backup (MyPC Backup) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
14/08/2013 5:24:31 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for DeleteFlag with the following error: Access is denied.
14/08/2013 5:17:43 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
14/08/2013 10:05:33 PM, error: Service Control Manager [7000] - The Microsoft Antimalware Service service failed to start due to the following error: The system cannot find the path specified.
.
==== End Of File ===========================





xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

http://forums.whatthetech.com/index.php?sh…mp;#entry829488

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.11.2
Run by [removed] at 17:59:22 on 2013-08-20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1775 [GMT 10:00]
.
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: AVG Firewall *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\HitmanPro\hmpsched.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\WebUpdateSvc4.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALLIN1~2\bar\1.bin\8hbrmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DriverUpdate\DriverUpdate.exe
C:\Program Files\ControlCenter4\BrCtrlCntr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\ControlCenter4\BrCcUxSys.exe
C:\DOCUME~1\User\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k bthsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uURLSearchHooks: : {7a55cbb2-2b2e-4a41-9de1-6ac5d2c2be0a} - LocalServer32 -
uURLSearchHooks: : {4c60e5ab-5c68-4c59-abaa-885010b24b32} - LocalServer32 -
uURLSearchHooks: : {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - LocalServer32 -
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} -
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: {a235e1e3-6296-4710-af39-104a7faa6c7c} -
BHO: {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} -
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: ChromeFrame BHO: {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - c:\program files\google\chrome\application\28.0.1500.95\npchrome_frame.dll
BHO: Search Assistant BHO: {f236ca79-3123-4afb-9f74-e98117ad5625} - LocalServer32 -
BHO: Toolbar BHO: {fbcbc43a-dca9-4192-a4c8-b57fd0f77d4d} - c:\program files\allin1convert_8h\bar\1.bin\8hbar.dll
TB: &RoboForm Toolbar: {724D43A0-0D85-11D4-9908-00400523E39A} - c:\program files\siber systems\ai roboform\roboform.dll
TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: Allin1Convert: {cd1a63ba-a08c-431b-9a34-f240aadc728d} - c:\program files\allin1convert_8h\bar\1.bin\8hbar.dll
uRun: [Google Update] "c:\documents and settings\user\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [Adobe Reader Synchronizer] "c:\program files\adobe\reader 10.0\reader\AdobeCollabSync.exe"
uRun: [DriverUpdate] "c:\program files\driverupdate\DriverUpdate.exe" -boot
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PSQLLauncher] "c:\program files\protector suite ql\launcher.exe" /startup
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [EOUApp] "c:\program files\intel\wireless\bin\EOUWiz.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ControlCenter4] c:\program files\controlcenter4\BrCcBoot.exe /autorun
mRun: [BrStsMon00] c:\program files\browny02\brother\BrStMonW.exe /AUTORUN
mRun: [IndexSearch] "c:\program files\nuance\paperport\IndexSearch.exe"
mRun: [PPort12reminder] "c:\program files\nuance\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\12\config\ereg\Ereg.ini"
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Allin1Convert Search Scope Monitor] "c:\progra~1\allin1~2\bar\1.bin\8hsrchmn.exe" /m=2 /w /h
mRun: [Allin1Convert_8h Browser Plugin Loader] c:\progra~1\allin1~2\bar\1.bin\8hbrmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [GoogleChromeAutoLaunch_BB7E6CE705E9E15ABCB72D3060D30B1F] "c:\program files\google\chrome\application\chrome.exe" –no-startup-window
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tl-wn3~1.lnk - c:\program files\tp-link\tl-wn321g wireless utility\installer\winxp\TWCU.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: &Search - http://buttons.allin1convert.com/one-toolb…mp;n=2013081619
IE: Customize Menu - c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Fill Forms - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Open with PDF Viewer Plus - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Save Forms - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Show RoboForm Toolbar - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1364512205890
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.0.1 192.168.1.1
TCP: Interfaces\{8BA44A5F-843B-4E98-BDC6-56E16580901F} : DHCPNameServer = 192.168.0.1 192.168.1.1
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome\application\28.0.1500.95\npchrome_frame.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: psfus - psqlpwd.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli psqlpwd
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.95\installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com.au/
FF - prefs.js: keyword.enabled - false
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\np-mswmp.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\user\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\user\local settings\application data\citrix\plugins\97\npappdetector.dll
FF - plugin: c:\documents and settings\user\local settings\application data\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\allin1convert_8h\bar\1.bin\NP8hStub.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll
FF - ExtSQL: 2013-07-27 21:49; {B40794A0-7477-4335-95C5-8CB9BBC5C4A5}; c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF - ExtSQL: 2013-08-15 09:41; 8hffxtbr@Allin1Convert_8h.com; c:\documents and settings\user\application data\mozilla\firefox\profiles\ze604on3.default\extensions\8hffxtbr@Allin1Convert_8h.com
FF - ExtSQL: !HIDDEN! 2013-08-15 09:41; 8hffxtbr@Allin1Convert_8h.com; c:\program files\allin1convert_8h\bar\1.bin
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 60216]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-8-9 246072]
R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 96568]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 39224]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 208184]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 22328]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-7-11 171320]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 182072]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-8-31 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-23 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2013-7-4 4939312]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2013-7-23 283136]
R2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\hitmanpro\hmpsched.exe [2013-8-10 106280]
R2 ipasintf;ipasintf;c:\windows\system32\drivers\pas2k.sys [2006-7-10 78280]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-6-15 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-6-15 701512]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-6-26 35088]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\nuance\paperport\PDFProFiltSrvPP.exe [2010-3-9 144672]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2013-4-16 39056]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-7-12 3289472]
R2 smihlp;SMI helper driver;c:\program files\protector suite ql\smihlp.sys [2006-9-1 3328]
R2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [2008-1-19 258264]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2013-3-20 26080]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2010-10-12 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-6-15 22856]
R3 NETwLx32; Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;c:\windows\system32\drivers\NETwLx32.sys [2013-2-24 6607744]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2006-2-16 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2006-2-20 43608]
S0 mnagoil;mnagoil;c:\windows\system32\drivers\gbnxcw.sys –> c:\windows\system32\drivers\gbnxcw.sys [?]
S0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\mpfilter.sys –> c:\windows\system32\drivers\MpFilter.sys [?]
S1 MpKsle033037d;MpKsle033037d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{996c69fe-556b-47da-ad95-1e462181b36c}\mpksle033037d.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{996c69fe-556b-47da-ad95-1e462181b36c}\MpKsle033037d.sys [?]
S2 Allin1Convert_8hService;Allin1ConvertService;c:\progra~1\allin1~2\bar\1.bin\8hbarsvc.exe [2013-8-15 42504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 FromDocToPDF_65Service;FromDocToPDFService;c:\progra~1\fromdo~2\bar\1.bin\65barsvc.exe –> c:\progra~1\fromdo~2\bar\1.bin\65barsvc.exe [?]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-21 162408]
S2 UtilityChest_49Service;Utility ChestService;c:\progra~1\utilit~2\bar\1.bin\49barsvc.exe –> c:\progra~1\utilit~2\bar\1.bin\49barsvc.exe [?]
S2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files\common files\avg secure search\vtoolbarupdater\15.4.0\toolbarupdater.exe –> c:\program files\common files\avg secure search\vtoolbarupdater\15.4.0\ToolbarUpdater.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2013-2-24 1691480]
S3 BrYNSvc;BrYNSvc;c:\program files\browny02\BrYNSvc.exe [2012-12-25 245760]
S3 GAGPDrv;GAGPDrv; [x]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2013-2-24 13464]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
.
=============== Created Last 30 ================
.
2013-08-18 14:33:01 ——– d—–w- c:\documents and settings\user\local settings\application data\IAC
2013-08-18 14:32:20 ——– d—–w- c:\documents and settings\user\application data\ParetoLogic
2013-08-18 13:55:35 ——– d—–w- c:\windows\Social Lead Fox
2013-08-18 13:46:04 ——– d—–w- c:\documents and settings\user\local settings\application data\Microsoft Help
2013-08-18 13:44:21 ——– d—–w- c:\program files\HitmanPro
2013-08-16 02:58:49 ——– d—–w- c:\documents and settings\user\application data\DriverCure
2013-08-16 02:58:26 ——– d—–w- c:\program files\common files\ParetoLogic
2013-08-16 02:58:12 ——– d—–w- c:\program files\ParetoLogic
2013-08-16 02:58:12 ——– d—–w- c:\documents and settings\all users\application data\ParetoLogic
2013-08-14 23:41:41 ——– d—–w- c:\documents and settings\user\application data\Allin1Convert_8h
2013-08-14 23:41:17 ——– d—–w- c:\program files\Allin1Convert_8h
2013-08-11 04:27:53 ——– d—–w- c:\program files\SocialLeadFox
2013-08-11 00:55:17 30512 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll
2013-08-11 00:55:16 29552 —-a-w- c:\windows\system32\mdimon.dll
2013-08-11 00:48:50 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2013-08-11 00:47:56 ——– d—–w- c:\windows\SHELLNEW
2013-08-11 00:19:23 ——– d—–w- c:\program files\PowerISO
2013-08-09 12:53:58 ——– d—–w- c:\documents and settings\all users\application data\HitmanPro
2013-08-08 03:42:28 ——– d—–w- c:\program files\UPDF
2013-08-04 03:59:10 ——– d—–w- c:\documents and settings\user\application data\OpenOffice.org
2013-08-04 03:42:13 ——– d—–w- c:\program files\OpenOffice.org 3
2013-08-03 21:37:56 ——– d—–w- c:\windows\system32\wbem\repository\FS
2013-08-03 21:37:56 ——– d—–w- c:\windows\system32\wbem\Repository
2013-08-01 04:01:10 ——– d—–w- c:\program files\Zula Games
2013-08-01 02:57:18 ——– d—–w- c:\documents and settings\user\application data\zulagames
2013-08-01 02:57:11 ——– d—–w- c:\documents and settings\user\application data\SUPERAntiSpyware.com
2013-08-01 02:56:53 ——– d—–w- c:\program files\SUPERAntiSpyware
2013-08-01 02:56:53 ——– d—–w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-07-31 23:55:59 255488 —-a-r- c:\windows\system32\drivers\netr73.sys
2013-07-30 22:29:01 238872 ——w- c:\windows\system32\MpSigStub.exe
.
==================== Find3M ====================
.
2013-08-19 23:19:38 13464 —-a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-08-05 21:19:03 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-05 21:19:02 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-30 05:11:10 37664 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-07-26 02:47:17 920064 —-a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47:13 43520 ——w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47:12 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52:59 385024 ——w- c:\windows\system32\html.iec
2013-07-19 15:51:00 246072 —-a-w- c:\windows\system32\drivers\avglogx.sys
2013-07-19 15:50:56 60216 —-a-w- c:\windows\system32\drivers\avgidshx.sys
2013-07-19 15:50:56 208184 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2013-07-19 15:50:50 171320 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2013-07-12 01:33:31 0 —-a-w- c:\windows\system32\TempWmicBatchFile.bat
2013-07-10 10:37:53 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-09 15:32:40 39224 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2013-07-04 03:03:25 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-04 07:23:02 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40:45 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-28 01:59:37 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2013-05-28 00:41:07 6144 —-a-w- c:\windows\system32\xpsp4res.dll
.
============= FINISH: 18:00:18.90 ===============

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx



The results for TDSSKiller were nothing found



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# AdwCleaner v2.306 - Logfile created 08/20/2013 at 19:01:31
# Updated 19/07/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : User - ACER_TM6460
# Boot Mode : Normal
# Running from : C:\Documents and Settings\User\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\Mozilla Firefox\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
Folder Deleted : C:\Documents and Settings\All Users\Application Data\ParetoLogic
Folder Deleted : C:\Documents and Settings\GRAHAMS\Application Data\Mozilla\Firefox\Profiles\chje6a4u.default\extensions\8hffxtbr@Allin1Convert_8h.com
Folder Deleted : C:\Documents and Settings\User\Application Data\DriverCure
Folder Deleted : C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\8hffxtbr@Allin1Convert_8h.com
Folder Deleted : C:\Documents and Settings\User\Application Data\ParetoLogic
Folder Deleted : C:\Documents and Settings\User\Local Settings\Application Data\iac
Folder Deleted : C:\Documents and Settings\User\Start Menu\Programs\ParetoLogic
Folder Deleted : C:\Program Files\Common Files\ParetoLogic
Folder Deleted : C:\Program Files\ParetoLogic

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{13119113-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{33119133-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\prefs.js

Deleted : user_pref("avg.install.userHPSettings", "hxxp://home.mywebsearch.com/index.jhtml?ptb=6E78B76D-0318-4[…]
Deleted : user_pref("extensions.alexa.toolbarXMLText", "\n\[…]
Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
Deleted : user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?p[…]
Deleted : user_pref("extensions.toolbar.mindspark._65Members_.homepage", "hxxp://home.mywebsearch.com/index.jh[…]
Deleted : user_pref("extensions.toolbar.mindspark._8hMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?p[…]
Deleted : user_pref("extensions.wajam.affiliate_id", "6447");
Deleted : user_pref("extensions.wajam.firstrun", "false");
Deleted : user_pref("extensions.wajam.log_send_info", "false");
Deleted : user_pref("extensions.wajam.mappingListJsonString", "{\"version\":\"0.21086\",\"supported_sites\":{\[…]
Deleted : user_pref("extensions.wajam.no_trace", "false");
Deleted : user_pref("extensions.wajam.server_current_mapping_version", "0.21086");
Deleted : user_pref("extensions.wajam.supported_sites.google.wajam_google_se_js", "try {window['APP_LABEL_NAME[…]
Deleted : user_pref("extensions.wajam.supported_sites.mywebsearch.wajam_se_js", "try {window['APP_LABEL_NAME'][…]
Deleted : user_pref("extensions.wajam.trace_log", "1368835352215 - processInstallationUpgrade - version set to[…]
Deleted : user_pref("extensions.wajam.unique_id", "DB59B67C6ED7AF69B0803B7096831F6E");
Deleted : user_pref("extensions.wajam.user_current_mapping_version", "0");
Deleted : user_pref("extensions.wajam.version", "1.26");
Deleted : user_pref("searchreset.backup.browser.search.defaultenginename", "My Web Search");
Deleted : user_pref("searchreset.backup.keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?[…]

File : C:\Documents and Settings\GRAHAMS\Application Data\Mozilla\Firefox\Profiles\chje6a4u.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\d0ot3tyw.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v28.0.1500.95

File : C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [42006 octets] - [09/08/2013 09:37:42]
AdwCleaner[R2].txt - [42067 octets] - [09/08/2013 09:38:26]
AdwCleaner[R3].txt - [41708 octets] - [09/08/2013 10:17:27]
AdwCleaner[R4].txt - [41828 octets] - [09/08/2013 21:38:42]
AdwCleaner[S1].txt - [459 octets] - [09/08/2013 09:50:08]
AdwCleaner[S2].txt - [369 octets] - [09/08/2013 10:18:19]
AdwCleaner[S3].txt - [41450 octets] - [09/08/2013 21:48:16]
AdwCleaner[S4].txt - [4891 octets] - [20/08/2013 19:01:31]

########## EOF - C:\AdwCleaner[S4].txt - [4951 octets] ##########

ComboFix 13-08-20.01 - User 22/08/2013 0:17.1.2 - x86
Running from: c:\documents and settings\[removed]\Desktop\Diognosing\Under supervision\ComboFix.exe
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\0.bak
c:\documents and settings\All Users\Application Data\2CF
c:\documents and settings\All Users\Application Data\APPICON.ico
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfapx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfarx.dll
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgntdumpx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgrunasx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avi7.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\compat.ini
c:\documents and settings\All Users\Application Data\TEMP\AVG\htmlayout.dll
c:\documents and settings\All Users\Application Data\TEMP\AVG\incavi.avm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_cz.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_da.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_es.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_fr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ge.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_hu.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_id.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_in.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_it.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_jp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ko.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ms.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_nl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pb.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ru.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sc.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sk.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_tr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_us.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zh.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaconf.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfacz.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfada.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaes.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfafr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfage.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfahu.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaid.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfain.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfait.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfajp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfako.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfams.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfanl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapb.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaru.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasc.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfask.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfatr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaus.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfavera.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaverx.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazh.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\microavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\miniavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.ini
c:\documents and settings\User\Application Data\Microsoft\engine_ag.dll
c:\documents and settings\User\g2mdlhlpx.exe
c:\documents and settings\User\WINDOWS
C:\install.exe
c:\windows\system32\Cache
c:\windows\system32\Cache\26c630d098e22dd5.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\2d964b8de5b3a482.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\32cbad2a62ca532e.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\3b0b51e718e7abd7.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\650045215daedb90.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c3ae5dec925004c.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\6d4d149ca0b564df.fb
c:\windows\system32\Cache\72f0c99ac389efc2.fb
c:\windows\system32\Cache\747209b76fcaec37.fb
c:\windows\system32\Cache\95f567698be8a182.fb
c:\windows\system32\Cache\9cea68e0b0d7041d.fb
c:\windows\system32\Cache\a81a4a0f89330273.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\c6b6b90d41ffbab1.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d548e0f66d1eadb8.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\f6bfa0555d15785c.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\Cache\fb2d3efaba2f1666.fb
c:\windows\system32\Cache\fb73aca14109ff8b.fb
c:\windows\system32\Settings
c:\windows\system32\Settings\Settings.ini
.
.
((((((((((((((((((((((((( Files Created from 2013-07-21 to 2013-08-21 )))))))))))))))))))))))))))))))
.
.
2013-08-21 13:51 . 2013-08-21 13:51 ——– d—–w- c:\windows\LastGood
2013-08-21 07:15 . 2013-08-21 07:15 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\IAC
2013-08-18 13:55 . 2013-08-18 13:55 ——– d—–w- c:\windows\Social Lead Fox
2013-08-18 13:55 . 2013-08-18 13:55 ——– d—–w- c:\program files\Microsoft Works
2013-08-18 13:46 . 2013-08-18 13:46 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Microsoft Help
2013-08-18 13:44 . 2013-08-18 13:44 ——– d—–w- c:\program files\HitmanPro
2013-08-18 04:29 . 2013-08-18 12:49 ——– d—–w- c:\documents and settings\Administrator
2013-08-14 23:41 . 2013-08-18 20:50 ——– d—–w- c:\documents and settings\User\Application Data\Allin1Convert_8h
2013-08-14 23:41 . 2013-08-14 23:41 ——– d—–w- c:\program files\Allin1Convert_8h
2013-08-11 04:27 . 2013-08-18 13:55 ——– d—–w- c:\program files\SocialLeadFox
2013-08-11 00:55 . 2006-10-26 09:58 30512 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2013-08-11 00:55 . 2009-02-26 09:18 29552 —-a-w- c:\windows\system32\mdimon.dll
2013-08-11 00:48 . 2013-08-18 13:35 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2013-08-11 00:47 . 2013-08-11 00:52 ——– d—–w- c:\windows\SHELLNEW
2013-08-11 00:47 . 2013-08-18 13:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2013-08-11 00:46 . 2013-08-11 00:46 ——– dc—-r- C:\MSOCache
2013-08-11 00:19 . 2013-08-18 13:36 ——– d—–w- c:\program files\PowerISO
2013-08-09 12:53 . 2013-08-18 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2013-08-08 03:42 . 2013-08-08 22:15 ——– d—–w- c:\program files\UPDF
2013-08-04 03:59 . 2013-08-04 03:59 ——– d—–w- c:\documents and settings\User\Application Data\OpenOffice.org
2013-08-04 03:42 . 2013-08-04 03:42 ——– d—–w- c:\program files\OpenOffice.org 3
2013-08-03 21:37 . 2013-08-03 21:37 ——– d—–w- c:\windows\system32\wbem\Repository
2013-08-01 04:01 . 2013-08-01 04:01 ——– d—–w- c:\program files\Zula Games
2013-08-01 02:57 . 2013-08-01 04:01 ——– d—–w- c:\documents and settings\User\Application Data\zulagames
2013-08-01 02:57 . 2013-08-01 02:57 ——– d—–w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2013-08-01 02:56 . 2013-08-17 21:05 ——– d—–w- c:\program files\SUPERAntiSpyware
2013-08-01 02:56 . 2013-08-01 02:56 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2013-07-31 23:55 . 2007-01-04 08:41 255488 —-a-r- c:\windows\system32\drivers\netr73.sys
2013-07-30 22:29 . 2013-05-02 15:28 238872 ——w- c:\windows\system32\MpSigStub.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-21 13:50 . 2013-02-23 23:33 13464 —-a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-08-21 02:00 . 2012-04-11 23:16 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-21 02:00 . 2011-06-06 00:08 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-30 05:11 . 2012-08-30 21:33 37664 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-07-26 02:47 . 2004-08-04 12:00 920064 —-a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47 . 2004-08-04 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2004-08-04 12:00 385024 ——w- c:\windows\system32\html.iec
2013-07-19 15:51 . 2012-08-09 03:56 246072 —-a-w- c:\windows\system32\drivers\avglogx.sys
2013-07-19 15:50 . 2012-04-18 18:50 60216 —-a-w- c:\windows\system32\drivers\avgidshx.sys
2013-07-19 15:50 . 2011-12-23 03:32 208184 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2013-07-19 15:50 . 2011-07-10 15:13 171320 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2013-07-12 01:33 . 2013-05-13 21:05 0 —-a-w- c:\windows\system32\TempWmicBatchFile.bat
2013-07-10 10:37 . 2004-08-04 12:00 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-09 15:32 . 2011-09-12 20:30 39224 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2013-07-04 03:03 . 2004-08-04 12:00 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2004-08-03 22:59 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-30 15:45 . 2011-08-07 20:08 96568 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2013-06-04 07:23 . 2004-08-04 12:00 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2004-08-04 12:00 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-28 01:59 . 2004-08-04 12:00 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2013-05-28 00:41 . 2010-10-15 10:52 6144 —-a-w- c:\windows\system32\xpsp4res.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBOK]
@="{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}"
[HKEY_CLASSES_ROOT\CLSID\{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}]
2009-11-06 14:07 297808 —-a-w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2013-08-08 109784]
"Adobe Reader Synchronizer"="c:\program files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe" [2013-05-10 1272912]
"DriverUpdate"="c:\program files\DriverUpdate\DriverUpdate.exe" [2013-06-22 34220352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-09-01 30208]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-04-14 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-04-14 569413]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2011-05-18 2629632]
"IndexSearch"="c:\program files\Nuance\PaperPort\IndexSearch.exe" [2010-03-08 46368]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20143688]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"Allin1Convert Search Scope Monitor"="c:\progra~1\ALLIN1~2\bar\1.bin\8hsrchmn.exe" [2013-08-14 44784]
"Allin1Convert_8h Browser Plugin Loader"="c:\progra~1\ALLIN1~2\bar\1.bin\8hbrmon.exe" [2013-08-14 30096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"GoogleChromeAutoLaunch_BB7E6CE705E9E15ABCB72D3060D30B1F"="c:\program files\Google\Chrome\Application\chrome.exe" [2013-07-25 846288]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe -s [2011-1-26 622592]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-09-01 00:59 39936 —-a-w- c:\windows\system32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\7-Zip\\7zFM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Torch\\Plugins\\Torrent\\TorchTorrent.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"54925:UDP"= 54925:UDP:BrotherNetwork Scanner
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [19/04/2012 4:50 AM 60216]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/08/2012 1:56 PM 246072]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [13/09/2011 6:30 AM 39224]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [23/12/2011 1:32 PM 208184]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [23/12/2011 1:32 PM 22328]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11/07/2011 1:13 AM 171320]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/07/2011 1:14 AM 182072]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [31/08/2012 7:33 AM 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/07/2011 2:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/07/2011 7:55 AM 67664]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [4/07/2013 3:53 PM 4939312]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [23/07/2013 7:09 PM 283136]
R2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [10/08/2013 7:42 AM 106280]
R2 ipasintf;ipasintf;c:\windows\system32\drivers\pas2k.sys [10/07/2006 6:37 PM 78280]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [15/06/2013 9:42 AM 418376]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [15/06/2013 9:42 AM 701512]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [26/06/2010 3:07 AM 35088]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [9/03/2010 12:40 AM 144672]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [16/04/2013 3:07 AM 39056]
R2 smihlp;SMI helper driver;c:\program files\Protector Suite QL\smihlp.sys [1/09/2006 10:42 AM 3328]
R2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [19/01/2008 2:12 AM 258264]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [20/03/2013 4:57 PM 26080]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [12/10/2010 9:55 AM 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [15/06/2013 9:42 AM 22856]
R3 NETwLx32; Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;c:\windows\system32\drivers\NETwLx32.sys [24/02/2013 12:46 PM 6607744]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [16/02/2006 5:36 PM 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [20/02/2006 4:01 PM 43608]
S0 mnagoil;mnagoil;c:\windows\system32\drivers\gbnxcw.sys –> c:\windows\system32\drivers\gbnxcw.sys [?]
S1 MpKsle033037d;MpKsle033037d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys [?]
S2 Allin1Convert_8hService;Allin1ConvertService;c:\progra~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe –> c:\progra~1\ALLIN1~2\bar\1.bin\8hbarsvc.exe [?]
S2 FromDocToPDF_65Service;FromDocToPDFService;c:\progra~1\FROMDO~2\bar\1.bin\65barsvc.exe –> c:\progra~1\FROMDO~2\bar\1.bin\65barsvc.exe [?]
S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [12/07/2013 2:37 PM 3289472]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [21/06/2013 9:53 AM 162408]
S2 UtilityChest_49Service;Utility ChestService;c:\progra~1\UTILIT~2\bar\1.bin\49barsvc.exe –> c:\progra~1\UTILIT~2\bar\1.bin\49barsvc.exe [?]
S2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe –> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [24/02/2013 11:19 AM 1691480]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [25/12/2012 9:06 AM 245760]
S3 GAGPDrv;GAGPDrv; [x]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [24/02/2013 9:33 AM 13464]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-04 11:01 1173456 —-a-w- c:\program files\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 02:00]
.
2013-08-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2013-08-20 c:\windows\Tasks\DriverUpdate Scan.job
- c:\program files\DriverUpdate\DriverUpdate.exe [2013-06-22 05:30]
.
2013-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-15 06:48]
.
2013-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-15 06:48]
.
2013-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-01 21:37]
.
2013-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-01 21:37]
.
2013-08-09 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\recordingmanager.exe [2013-04-15 17:09]
.
2013-08-21 c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-04-15 17:07]
.
2013-08-20 c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-04-15 17:07]
.
2013-08-21 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-04-16 02:45]
.
2013-08-16 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-04-16 02:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Open with PDF Viewer Plus - c:\program files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Show RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
TCP: DhcpNameServer = 192.168.0.1 192.168.1.1
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com.au/
FF - prefs.js: keyword.enabled - false
FF - ExtSQL: 2013-07-27 21:49; {B40794A0-7477-4335-95C5-8CB9BBC5C4A5}; c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF - ExtSQL: 2013-08-15 09:41; 8hffxtbr@Allin1Convert_8h.com; c:\program files\Allin1Convert_8h\bar\1.bin
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ShellIconOverlayIdentifiers-{4d87b7a7-23f1-470c-aa45-96b25b9bd138} - (no file)
MSConfigStartUp-CTFMON - (no file)
AddRemove-{C547F361-5750-4CD1-9FB6-BC93827CB6C1} - c:\program files\ParetoLogic\RegCure Pro\uninstall.exe
AddRemove-Adobe Connect Add-in - c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\connectaddin\connectaddin.exe
AddRemove-eType - c:\documents and settings\User\Application Data\eType\eTypeUninstall.exe
AddRemove-Pokki - c:\documents and settings\User\local settings\application data\Pokki\Engine\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-22 00:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1960408961-1409082233-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1192)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\MSVCP71.dll
c:\program files\Protector Suite QL\crypto.dll
.
- - - - - - - > 'lsass.exe'(1248)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
.
Completion time: 2013-08-22 00:33:32
ComboFix-quarantined-files.txt 2013-08-21 14:33
.
Pre-Run: 16,672,796,672 bytes free
Post-Run: 17,006,997,504 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 712AA8D6BBBFD6FCABFD4773C367DFEA
8F558EB6672622401DA993E1E865C861