What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

microsoft distribution service 3.0 and PUP [Solved]

28 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
Hi yes the scan is still running ESET custom scan started at 4 pm yesterday my time only looks half way threw, can see it is still going threw files will post results WHEN they arrive thanks Jeff ps in opening up the log while it is scaning i can see that the files are 3, 4 , 5 or more times the same file being scanned ???
Post #49
Hi finally finished 96 threats 9 cleaned nothing done with it yet and still loaded waiting on instruction !!! ESET said for me to take action deside weather to delet or clean and had a fin ish button but now that box has disapeared and i dont know what the system is doing ?? C:\Documents and Settings\User\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\stub_data\stubinst_pkg_en-ap.cab Win32/OpenCandy potentially unsafe application No action C:\Documents and Settings\User\Desktop\friend blaster pro setup.exe a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\Documents and Settings\User\Desktop\26 indemand products mrr\Monitor4Pro.zip probably unknown NewHeur_PE virus No action C:\Documents and Settings\User\Desktop\MY online BIZ Empire\friend blaster pro setup.zip a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\Documents and Settings\User\Desktop\MY online BIZ Empire\gimp-setup.exe Win32/DownloadAdmin.G potentially unwanted application No action C:\Documents and Settings\User\Desktop\New Briefcase\friend blaster pro setup.exe a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\Documents and Settings\User\Desktop\New Briefcase\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F potentially unwanted application No action C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\PublicDomainSurvivalKitMRR.zip a variant of Win32/Adware.Softomate.AA application No action C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\OTO Mega pack 10\oto1_all.zip probably a variant of Win32/Agent.JWXATMK trojan No action C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\OTO Mega pack 10\oto9_all9.zip probably a variant of Win32/Agent.IBCSVLH trojan No action C:\Documents and Settings\User\Desktop\New Briefcase\Systems\giveawaytemplate\SoftonicDownloader_for_nvu.exe Win32/SoftonicDownloader.A potentially unwanted application No action C:\Documents and Settings\User\Desktop\New Briefcase\Zipped\sqeeze page template.zip Win32/SoftonicDownloader.A potentially unwanted application No action C:\Documents and Settings\User\Desktop\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F potentially unwanted application No action C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\PublicDomainSurvivalKitMRR.zip a variant of Win32/Adware.Softomate.AA application No action C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\OTO Mega pack 10\oto1_all.zip probably a variant of Win32/Agent.JWXATMK trojan No action C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\OTO Mega pack 10\oto9_all9.zip probably a variant of Win32/Agent.IBCSVLH trojan No action C:\Documents and Settings\User\Desktop\Programs\internet explorer 9 setup.exe a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\Documents and Settings\User\Desktop\Programs\WinZip170.exe a variant of Win32/OpenInstall potentially unwanted application No action C:\Documents and Settings\User\Desktop\Programs\wmrecorder-setup.exe Win32/DownloadAdmin.G potentially unwanted application No action C:\Documents and Settings\User\My Documents\Downloads\media.player.codec.pack.v4.2.2.setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application No action C:\Documents and Settings\User\SyncFolder\New Briefcase\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F potentially unwanted application No action C:\Documents and Settings\User\SyncFolder\New Briefcase\Systems\giveawaytemplate\SoftonicDownloader_for_nvu.exe Win32/SoftonicDownloader.A potentially unwanted application No action C:\Program Files\Deal Spy\ButtonUtil.dll a variant of Win32/Toolbar.CrossRider.G potentially unwanted application No action C:\Program Files\Deal Spy\Deal Spy-bg.exe a variant of Win32/Toolbar.CrossRider.E potentially unwanted application No action C:\Program Files\Deal Spy\Deal Spy.dll a variant of Win32/Toolbar.CrossRider.A potentially unwanted application No action C:\Program Files\Deal Spy\Deal Spy.exe a variant of Win32/Toolbar.CrossRider.E potentially unwanted application No action C:\Program Files\Deal Spy\Uninstall.exe Win32/Packed.ScrambleWrapper.A potentially unwanted application No action C:\Program Files\Zula Games\BackgroundHostPS.dll Win32/Toolbar.Besttoolbars.C potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0075411.dll Win32/Toolbar.Besttoolbars.C potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077459.exe Win32/Toolbar.Besttoolbars.C potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077498.dll a variant of Win32/Toolbar.MyWebSearch.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077504.dll probably a variant of Win32/Toolbar.MyWebSearch.B potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077507.dll probably a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077512.dll probably a variant of Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077518.dll a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077531.dll Win32/Toolbar.MyWebSearch.T potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077534.DLL probably a variant of Win32/Toolbar.MyWebSearch.F potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077602.dll Win32/Toolbar.Besttoolbars.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077606.dll Win32/Toolbar.Besttoolbars.C potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077623.dll a variant of Win32/Toolbar.MyWebSearch.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077629.dll probably a variant of Win32/Toolbar.MyWebSearch.B potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077632.dll probably a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077637.dll probably a variant of Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077643.dll a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077653.dll Win32/Toolbar.MyWebSearch.T potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077656.DLL probably a variant of Win32/Toolbar.MyWebSearch.F potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077666.dll a variant of Win32/Toolbar.MyWebSearch.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077672.dll probably a variant of Win32/Toolbar.MyWebSearch.B potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077675.dll probably a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077680.dll probably a variant of Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077686.dll a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077701.dll Win32/Toolbar.MyWebSearch.T potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP761\A0077704.DLL probably a variant of Win32/Toolbar.MyWebSearch.F potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP767\A0083670.exe Win32/AdInstaller potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP767\A0084567.exe a variant of Win32/Toolbar.MyWebSearch.O potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP767\A0084569.dll Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP767\A0084570.dll probably a variant of Win32/Toolbar.MyWebSearch.Q potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP767\A0084571.dll Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP771\A0086018.exe Win32/SoftonicDownloader.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP773\A0087088.exe a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088368.exe a variant of Win32/Soft32Downloader.D potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088864.dll a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088871.dll probably a variant of Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088876.dll probably a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088879.dll probably a variant of Win32/Toolbar.MyWebSearch.B potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088880.DLL probably a variant of Win32/Toolbar.MyWebSearch.F potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088888.dll a variant of Win32/Toolbar.MyWebSearch.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088895.dll Win32/Toolbar.MyWebSearch.T potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0088905.exe Win32/AdInstaller potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP776\A0089014.exe Win32/SoftonicDownloader.A potentially unwanted application No action C:\System Volume Information\_restore{7117EF88-0BF4-4CB6-B46E-39BA2D53C9A8}\RP778\A0093841.dll Win32/Toolbar.MyWebSearch.T potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Documents and Settings\User\Desktop\statuswinks.exe Win32/Toolbar.Besttoolbars.C potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\8hdatact.dll a variant of Win32/Toolbar.MyWebSearch.A potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\8hhtmlmu.dll probably a variant of Win32/Toolbar.MyWebSearch.B potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\8hieovr.dll probably a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\8hPlugin.dll probably a variant of Win32/Toolbar.MyWebSearch potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\8hskin.dll a variant of Win32/Toolbar.MyWebSearch.P potentially unwanted application No action C:\_OTL\MovedFiles\08282013_070656\C_Program Files\Allin1Convert_8h\bar\1.bin\T8HTML.DLL probably a variant of Win32/Toolbar.MyWebSearch.F potentially unwanted application No action
Post #50
Hi,

Glad you go that done. :)

[external image: Posted Image]

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Files
C:\Documents and Settings\User\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.50\agent\stub_data\stubinst_pkg_en-ap.cab 
C:\Documents and Settings\User\Desktop\friend blaster pro setup.exe a variant of Win32/Soft32Downloader.D 
C:\Documents and Settings\User\Desktop\26 indemand products mrr\Monitor4Pro.zip 
C:\Documents and Settings\User\Desktop\MY online BIZ Empire\friend blaster pro setup.zip 
C:\Documents and Settings\User\Desktop\MY online BIZ Empire\gimp-setup.exe Win32/DownloadAdmin.G 
C:\Documents and Settings\User\Desktop\New Briefcase\friend blaster pro setup.exe a variant of Win32/Soft32Downloader.D 
C:\Documents and Settings\User\Desktop\New Briefcase\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F 
C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\PublicDomainSurvivalKitMRR.zip 
C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\OTO Mega pack 10\oto1_all.zip probably 
C:\Documents and Settings\User\Desktop\New Briefcase\Products to be used\FIRESALE mine\OTO Mega pack 10\oto9_all9.zip probably 
C:\Documents and Settings\User\Desktop\New Briefcase\Systems\giveawaytemplate\SoftonicDownloader_for_nvu.exe Win32/SoftonicDownloader.A 
C:\Documents and Settings\User\Desktop\New Briefcase\Zipped\sqeeze page template.zip Win32/SoftonicDownloader.A 
C:\Documents and Settings\User\Desktop\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F 
C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\PublicDomainSurvivalKitMRR.zip 
C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\OTO Mega pack 10\oto1_all.zip 
C:\Documents and Settings\User\Desktop\Products to be used\FIRESALE mine\OTO Mega pack 10\oto9_all9.zip 
C:\Documents and Settings\User\Desktop\Programs\internet explorer 9 setup.exe a variant of Win32/Soft32Downloader.D 
C:\Documents and Settings\User\Desktop\Programs\WinZip170.exe a variant of Win32/OpenInstall 
C:\Documents and Settings\User\Desktop\Programs\wmrecorder-setup.exe Win32/DownloadAdmin.G 
C:\Documents and Settings\User\My Documents\Downloads\media.player.codec.pack.v4.2.2.setup.exe a variant of Win32/Bundled.Toolbar.Ask 
C:\Documents and Settings\User\SyncFolder\New Briefcase\NEWEST COPIED April 2013\zipped soFTWARE\ULTRAMAX-GOLD mine xxxxxxx.zip PHP/Obfuscated.F 
C:\Documents and Settings\User\SyncFolder\New Briefcase\Systems\giveawaytemplate\SoftonicDownloader_for_nvu.exe Win32/SoftonicDownloader.A 
C:\Program Files\Deal Spy\ButtonUtil.dll a variant of Win32/Toolbar.CrossRider.G 
C:\Program Files\Deal Spy\Deal Spy-bg.exe a variant of Win32/Toolbar.CrossRider.E 
C:\Program Files\Deal Spy\Deal Spy.dll a variant of Win32/Toolbar.CrossRider.A 
C:\Program Files\Deal Spy\Deal Spy.exe a variant of Win32/Toolbar.CrossRider.E 
C:\Program Files\Deal Spy\Uninstall.exe Win32/Packed.ScrambleWrapper.A 
C:\Program Files\Zula Games\BackgroundHostPS.dll Win32/Toolbar.Besttoolbars.C 

:Commands
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Post the new OTL log and let me know what remaining malware related problems you are having. :)
Post #51
Hi Jeff Quick question do i put tick in OTL check boxes beside LOP Check or Purity for the first run fix. and then do a scan WITHOUT those 2 ticked ???? and i do have to do it in safe mode
Post #53
OTL logfile created on: 1/09/2013 1:02:34 PM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\User\Desktop\Diognosing
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 2.09 Gb Available Physical Memory | 69.76% Memory free
4.84 Gb Paging File | 4.04 Gb Available in Paging File | 83.54% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 7.38 Gb Free Space | 6.60% Space Free | Partition Type: NTFS

Computer Name: ACER_TM6460 | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\Local Settings\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
PRC - C:\Documents and Settings\User\Desktop\Diognosing\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\MyPC Backup\BackupStack.exe (Just Develop It)
PRC - C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
PRC - C:\Program Files\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe (RealNetworks, Inc.)
PRC - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
PRC - C:\Program Files\ControlCenter4\BrCcUxSys.exe (Brother Industries, Ltd.)
PRC - C:\Program Files\ControlCenter4\BrCtrlCntr.exe (Brother Industries, Ltd.)
PRC - C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
PRC - C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD.)
PRC - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\972dcf9830a64e9802aaca3a83cae24b\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\b01bf82d99cca42b8140884fb833583d\System.Transactions.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\15fd2d2f4e709154b44187a6915db244\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\cf3c9d1496acdcb836853e59fe20223b\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\9c02362e677418460c52569019a266e4\System.EnterpriseServices.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\14d1a28674a9f78c5759e7dcf74a13fd\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\f93600ac836b9140e1df13bb0f6bfccf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a12a09aaa2c560a808dea7eaba5040c1\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b34cb206ab0cec687c3730b14cdff57\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\5013900c3c0610c88059fcb8f1f4acb4\System.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll ()
MOD - C:\Program Files\MyPC Backup\MPCBIconOverlays.dll ()
MOD - C:\Program Files\MyPC Backup\GetText.dll ()
MOD - C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll ()
MOD - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Brother\BrUtilities\BrLogAPI.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\Libeay32.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\iWMSProv.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\IntStngs.dll ()
MOD - C:\Program Files\Intel\Wireless\Bin\acAuth.dll ()


========== Services (SafeList) ==========

SRV - (vToolbarUpdater15.4.0) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe File not found
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\MsMpEng.exe File not found
SRV - (ACDaemon) – File not found
SRV - (HitmanProScheduler) – C:\Program Files\HitmanPro\hmpsched.exe (SurfRight B.V.)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (BackupStack) – C:\Program Files\MyPC Backup\BackupStack.exe (Just Develop It)
SRV - (RealNetworks Downloader Resolver Service) – C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) – C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (rpcapd) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (PDFProFiltSrvPP) – C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (BrYNSvc) – C:\Program Files\Browny02\BrYNSvc.exe (Brother Industries, Ltd.)
SRV - (WebUpdate4) – C:\WINDOWS\system32\WebUpdateSvc4.exe (Data Perceptions / PowerProgrammer)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)
SRV - (O2Flash) – C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (MpKsle033037d) – c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys File not found
DRV - (MpFilter) – system32\DRIVERS\MpFilter.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (hwdatacard) – File not found
DRV - (GAGPDrv) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\User\LOCALS~1\Temp\catchme.sys File not found
DRV - (SWDUMon) – C:\WINDOWS\system32\drivers\SWDUMon.sys ()
DRV - (hitmanpro37) – C:\WINDOWS\system32\drivers\hitmanpro37.sys ()
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avgtp) – C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (epfwtdir) – C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET)
DRV - (eamon) – C:\WINDOWS\system32\drivers\eamon.sys (ESET)
DRV - (ehdrv) – C:\WINDOWS\system32\drivers\ehdrv.sys (ESET)
DRV - (Apowersoft_AudioDevice) – C:\WINDOWS\system32\drivers\Apowersoft_AudioDevice.sys (Wondershare)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (tap0901) – C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (smihlp) – C:\Program Files\Protector Suite QL\smihlp.sys (UPEK Inc.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTSERIAL) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid) – C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)
DRV - (ipasintf) – C:\WINDOWS\system32\drivers\pas2k.sys ()
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (w39n51) – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (UIUSys) – C:\WINDOWS\system32\drivers\UIUSYS.SYS (Conexant Systems, Inc)
DRV - (IFXTPM) – C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (GVCplDrv) – C:\WINDOWS\System32\drivers\GVCplDrv.sys ()
DRV - (atirage3) – C:\WINDOWS\system32\drivers\atimpae.sys (ATI Technologies Inc.)
DRV - (NETwLx32) – C:\WINDOWS\system32\drivers\NETwLx32.sys (Intel Corporation)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (O2SCBUS) – C:\WINDOWS\system32\drivers\ozscr.sys (O2Micro)
DRV - (O2MDRDR) – C:\WINDOWS\system32\drivers\o2media.sys (O2Micro )
DRV - (O2SDRDR) – C:\WINDOWS\system32\drivers\o2sd.sys (O2Micro )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.com.au/"
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: testpilot%40labs.mozilla.com:1.2.2
FF - prefs.js..extensions.enabledAddons: %7BFCE04E1F-9378-4f39-96F6-5689A9159E45%7D:1.3.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Allin1Convert_8h.com/Plugin: C:\Program Files\Allin1Convert_8h\bar\1.bin\NP8hStub.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@FromDocToPDF_65.com/Plugin: C:\Program Files\FromDocToPDF_65\bar\1.bin\NP65Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.2.32: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@UtilityChest_49.com/Plugin: C:\Program Files\UtilityChest_49\bar\1.bin\NP49Stub.dll File not found
FF - HKLM\Software\MozillaPlugins\@VideoDownloadConverter_4z.com/Plugin: C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@citrixonline.com/appdetectorplugin: C:\Documents and Settings\User\Local Settings\Application Data\Citrix\Plugins\97\npappdetector.dll (Citrix Online)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013/06/20 08:04:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013/06/20 08:04:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\4zffxtbr@VideoDownloadConverter_4z.com: C:\Program Files\VideoDownloadConverter_4z\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2013/08/18 07:12:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/06/03 21:42:50 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/11 10:53:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2013/08/29 15:26:46 | 000,000,000 | —D | M]

[2013/03/21 22:36:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2013/08/20 19:06:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions
[2012/12/10 15:00:23 | 000,000,000 | —D | M] (Bitdefender QuickScan) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011/11/11 08:33:39 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\avg@toolbar(2)
[2011/11/11 08:33:32 | 000,000,000 | —D | M] (Cooliris) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\piclens@cooliris(2).com
[2013/04/28 14:17:27 | 000,615,445 | —- | M] () (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\[removed]
[2013/07/28 14:18:41 | 000,012,103 | —- | M] () (No name found) – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
[2013/02/13 17:42:07 | 000,001,145 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\searchplugins\urlcom.xml
[2013/05/18 10:03:24 | 000,001,492 | —- | M] () – C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\searchplugins\web-search-powered-by-google.xml
[2013/03/21 22:36:02 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/08/28 14:21:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/18 07:26:29 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/05/25 08:38:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\distribution\extensions
[2013/06/20 08:04:48 | 000,000,000 | —D | M] (RealDownloader) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2010/10/27 10:45:15 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/01/03 05:40:28 | 000,104,448 | —- | M] (Crawler, LLC) – C:\Program Files\mozilla firefox\plugins\NPCrwPd.dll
[2013/06/20 08:03:22 | 000,124,504 | —- | M] (RealPlayer) – C:\Program Files\mozilla firefox\plugins\nprpplugin.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\pdf.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\np-mswmp.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\User\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Crawler Products Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPCrwPd.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: RealNetworks™ RealDownloader Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
CHR - plugin: RealNetworks™ RealDownloader HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
CHR - plugin: RealNetworks™ RealDownloader PepperFlashVideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
CHR - plugin: RealDownloader Plugin (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
CHR - plugin: Citrix Online Web Deployment Plugin 1.0.0.97 (Enabled) = C:\Documents and Settings\User\Local Settings\Application Data\Citrix\Plugins\97\npappdetector.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\User\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U13 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: RealDownloader = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.2_0\
CHR - Extension: Torch Share = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof\1.0.0.2504_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\

O1 HOSTS File: ([2013/08/22 23:54:06 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome\Application\29.0.1547.62\npchrome_frame.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm; Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm; Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe (Intel Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Adobe Reader Synchronizer] C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [DriverUpdate] C:\Program Files\DriverUpdate\DriverUpdate.exe (SlimWare Utilities, Inc.)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Send to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RoboForm Options - {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1364512205890 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8BA44A5F-843B-4E98-BDC6-56E16580901F}: DhcpNameServer = 192.168.0.1 192.168.1.1
O18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome\Application\29.0.1547.62\npchrome_frame.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\psfus: DllName - (psqlpwd.dll) - C:\WINDOWS\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/11 20:34:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2011/10/31 17:28:00 | 000,000,000 | —D | M] - C:\AutoSave SoundsAndMusic 1 – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/01 12:58:29 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2013/09/01 06:42:33 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/30 18:32:21 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\ESET
[2013/08/29 15:26:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ESET
[2013/08/29 15:26:37 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2013/08/29 15:26:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ESET
[2013/08/27 06:19:44 | 000,000,000 | —D | C] – C:\Program Files\MyPC Backup
[2013/08/26 10:48:52 | 000,000,000 | —D | C] – C:\_OTL
[2013/08/26 10:41:55 | 000,000,000 | —D | C] – C:\RegBackup
[2013/08/26 10:41:10 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Start Menu\Programs\Tweaking.com
[2013/08/26 10:41:08 | 000,000,000 | —D | C] – C:\Program Files\Tweaking.com
[2013/08/26 08:29:11 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\26 indemand products mrr
[2013/08/25 12:18:52 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\(16) John Jonas - Outsource To The Philippines on Facebook_files
[2013/08/24 16:29:32 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look_files
[2013/08/24 15:15:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/08/22 09:56:39 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help_files
[2013/08/22 00:12:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/08/21 17:20:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/08/21 17:20:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/08/21 17:20:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/08/21 17:20:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/08/21 17:15:45 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\IAC
[2013/08/21 16:56:44 | 000,000,000 | —D | C] – C:\Qoobox
[2013/08/21 16:55:25 | 000,000,000 | —D | C] – C:\WINDOWS\erdnt
[2013/08/19 07:20:48 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Diognosing
[2013/08/18 23:56:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Social Lead Fox
[2013/08/18 23:55:35 | 000,000,000 | —D | C] – C:\WINDOWS\Social Lead Fox
[2013/08/18 23:55:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2013/08/18 23:55:06 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2013/08/18 23:51:41 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2013/08/18 23:51:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2013/08/18 23:46:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Visual Studio 2005
[2013/08/18 23:46:04 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Local Settings\Application Data\Microsoft Help
[2013/08/18 23:45:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PowerISO
[2013/08/18 23:44:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HitmanPro
[2013/08/18 23:44:21 | 000,000,000 | —D | C] – C:\Program Files\HitmanPro
[2013/08/18 14:27:38 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2013/08/17 20:00:40 | 000,000,000 | —D | C] – C:\Avenger
[2013/08/17 19:18:22 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help_files
[2013/08/17 18:55:26 | 000,204,496 | —- | C] (Malwarebytes) – C:\Documents and Settings\User\Desktop\startuplite-setup-1.07.exe
[2013/08/16 07:50:47 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\New Folder
[2013/08/11 14:27:53 | 000,000,000 | —D | C] – C:\Program Files\SocialLeadFox
[2013/08/11 10:55:16 | 000,029,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mdimon.dll
[2013/08/11 10:48:50 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2013/08/11 10:47:56 | 000,000,000 | —D | C] – C:\WINDOWS\SHELLNEW
[2013/08/11 10:47:05 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2013/08/11 10:47:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2013/08/11 10:46:23 | 000,000,000 | R–D | C] – C:\MSOCache
[2013/08/11 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\PowerISO
[2013/08/09 22:53:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2013/08/09 08:54:38 | 009,167,352 | —- | C] (SurfRight B.V.) – C:\Documents and Settings\User\Desktop\HitmanPro.exe
[2013/08/09 07:52:35 | 013,391,216 | —- | C] (Siber Systems) – C:\Documents and Settings\User\Desktop\RoboForm-Setup.exe
[2013/08/08 13:57:31 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\converted PDFs
[2013/08/08 13:42:28 | 000,000,000 | —D | C] – C:\Program Files\UPDF
[2013/08/04 15:44:49 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\AWeber Communications_files
[2013/08/04 13:59:10 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Application Data\OpenOffice.org
[2013/08/04 13:43:18 | 000,000,000 | –SD | C] – C:\Documents and Settings\User\Start Menu\Programs\OpenOffice.org 3.4.1
[2013/08/04 13:42:13 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2013/08/04 13:39:56 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1 (en-US) Installation Files
[2013/08/04 13:14:55 | 000,000,000 | —D | C] – C:\Documents and Settings\User\Desktop\Realplaer recordings
[2013/08/02 22:54:40 | 000,000,000 | R–D | C] – C:\Documents and Settings\User\Desktop\New Briefcase

========== Files - Modified Within 30 Days ==========

[2013/09/01 13:15:24 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003UA.job
[2013/09/01 12:59:02 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/01 12:58:06 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/01 12:58:01 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/01 12:57:10 | 000,013,464 | —- | M] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2013/09/01 12:52:21 | 000,030,976 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2013/09/01 12:52:08 | 000,000,298 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/09/01 12:52:04 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/09/01 12:51:49 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/01 12:40:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/01 06:42:33 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2013/08/31 12:23:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/31 12:14:04 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003Core.job
[2013/08/29 19:02:22 | 000,000,324 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/29 14:26:13 | 000,001,829 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/08/28 13:15:07 | 000,132,254 | —- | M] () – C:\Documents and Settings\User\My Documents\mijacko1.vcf
[2013/08/28 07:35:00 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/27 16:46:51 | 000,409,660 | —- | M] () – C:\Documents and Settings\User\Desktop\outsourcing-your-life.pdf
[2013/08/27 16:34:27 | 000,000,778 | —- | M] () – C:\Documents and Settings\User\Desktop\MyPC Backup.lnk
[2013/08/27 16:34:27 | 000,000,764 | —- | M] () – C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/08/27 16:33:28 | 010,340,624 | —- | M] () – C:\Documents and Settings\User\Desktop\MyPCBackup_Setup.exe
[2013/08/27 16:15:27 | 000,001,549 | —- | M] () – C:\Documents and Settings\User\Desktop\Sync Folder.lnk
[2013/08/26 14:53:13 | 000,001,892 | —- | M] () – C:\Documents and Settings\User\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/26 08:51:43 | 000,001,626 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2013/08/26 08:19:53 | 000,161,507 | —- | M] () – C:\Documents and Settings\User\Desktop\work.jpg
[2013/08/26 08:16:35 | 000,114,688 | —- | M] () – C:\Documents and Settings\User\Desktop\Work.htm
[2013/08/25 10:42:57 | 000,139,264 | —- | M] () – C:\Documents and Settings\User\Desktop\SystemLook.exe
[2013/08/24 16:29:34 | 000,008,566 | —- | M] () – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look.htm
[2013/08/24 12:50:10 | 000,807,326 | —- | M] () – C:\Documents and Settings\User\Desktop\freesalesfunnel.pdf
[2013/08/22 23:54:06 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/22 09:56:46 | 000,033,793 | —- | M] () – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help.htm
[2013/08/22 00:12:34 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2013/08/21 12:00:44 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/08/21 12:00:43 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/08/17 19:18:25 | 000,014,236 | —- | M] () – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help.htm
[2013/08/17 18:55:31 | 000,204,496 | —- | M] (Malwarebytes) – C:\Documents and Settings\User\Desktop\startuplite-setup-1.07.exe
[2013/08/15 16:36:45 | 000,772,868 | —- | M] () – C:\Documents and Settings\User\Desktop\Module+1.pdf
[2013/08/15 13:43:37 | 000,000,448 | —- | M] () – C:\0
[2013/08/15 10:47:23 | 000,000,144 | —- | M] () – C:\WINDOWS\ANS2000.INI
[2013/08/15 09:19:27 | 000,397,353 | —- | M] () – C:\Documents and Settings\User\Desktop\3-Steps-2-Profit.pdf
[2013/08/15 08:37:20 | 034,162,021 | —- | M] () – C:\Documents and Settings\User\Desktop\mijacko_1080p video mttb.mp4
[2013/08/15 08:28:07 | 034,162,021 | —- | M] () – C:\Documents and Settings\User\Desktop\mijacko_1080p.mp4
[2013/08/14 16:48:32 | 000,505,862 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/14 16:48:32 | 000,089,542 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/12 21:06:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/08/12 07:48:58 | 000,360,136 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/11 14:27:58 | 000,001,644 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Social Lead Fox.lnk
[2013/08/11 10:19:24 | 000,000,698 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2013/08/10 07:50:24 | 000,001,996 | —- | M] () – C:\WINDOWS\System32\.crusader
[2013/08/09 08:57:51 | 009,167,352 | —- | M] (SurfRight B.V.) – C:\Documents and Settings\User\Desktop\HitmanPro.exe
[2013/08/09 07:57:44 | 013,391,216 | —- | M] (Siber Systems) – C:\Documents and Settings\User\Desktop\RoboForm-Setup.exe
[2013/08/08 13:58:11 | 000,000,000 | —- | M] () – C:\Documents and Settings\User\Application Data\pdfperformer
[2013/08/06 17:31:45 | 004,476,508 | —- | M] () – C:\Documents and Settings\User\Desktop\wordpress-3.6.zip
[2013/08/05 18:06:14 | 000,015,593 | —- | M] () – C:\Documents and Settings\User\Desktop\Top Tier imabe.jpg
[2013/08/04 15:44:50 | 000,067,589 | —- | M] () – C:\Documents and Settings\User\Desktop\AWeber Communications.htm
[2013/08/04 15:22:58 | 000,001,186 | —- | M] () – C:\Documents and Settings\User\Desktop\29Leadsources.htm
[2013/08/04 14:59:40 | 002,014,159 | —- | M] () – C:\Documents and Settings\User\My Documents\MY PAGE power pont.odp
[2013/08/04 14:26:11 | 000,008,860 | —- | M] () – C:\Documents and Settings\User\My Documents\A Test Test traffic costs ect.ods
[2013/08/04 13:43:22 | 000,000,933 | —- | M] () – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1.lnk
[2013/08/03 22:31:04 | 000,000,758 | —- | M] () – C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/08/03 22:31:04 | 000,000,740 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/08/03 14:18:38 | 001,543,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdecod.dll
[2013/08/03 10:07:42 | 000,025,521 | —- | M] () – C:\Documents and Settings\User\My Documents\TrafficExchangeSecrets-PLR.zip

========== Files Created - No Company Name ==========

[2013/09/01 12:52:21 | 000,030,976 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2013/08/28 13:15:06 | 000,132,254 | —- | C] () – C:\Documents and Settings\User\My Documents\mijacko1.vcf
[2013/08/27 16:46:50 | 000,409,660 | —- | C] () – C:\Documents and Settings\User\Desktop\outsourcing-your-life.pdf
[2013/08/27 06:20:13 | 000,000,764 | —- | C] () – C:\Documents and Settings\User\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/08/26 10:41:10 | 000,001,892 | —- | C] () – C:\Documents and Settings\User\Desktop\Tweaking.com - Registry Backup.lnk
[2013/08/26 08:19:49 | 000,161,507 | —- | C] () – C:\Documents and Settings\User\Desktop\work.jpg
[2013/08/26 08:16:34 | 000,114,688 | —- | C] () – C:\Documents and Settings\User\Desktop\Work.htm
[2013/08/25 14:00:37 | 010,340,624 | —- | C] () – C:\Documents and Settings\User\Desktop\MyPCBackup_Setup.exe
[2013/08/25 10:42:56 | 000,139,264 | —- | C] () – C:\Documents and Settings\User\Desktop\SystemLook.exe
[2013/08/24 16:29:31 | 000,008,566 | —- | C] () – C:\Documents and Settings\User\Desktop\5FigureDay.com.htm look.htm
[2013/08/24 12:50:08 | 000,807,326 | —- | C] () – C:\Documents and Settings\User\Desktop\freesalesfunnel.pdf
[2013/08/22 09:56:37 | 000,033,793 | —- | C] () – C:\Documents and Settings\User\Desktop\Firefox takes a long time to start up _ Firefox Help.htm
[2013/08/22 07:21:09 | 000,000,276 | —- | C] () – C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
[2013/08/22 00:12:33 | 000,000,211 | —- | C] () – C:\Boot.bak
[2013/08/22 00:12:28 | 000,260,272 | RHS- | C] () – C:\cmldr
[2013/08/21 17:20:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/08/21 17:20:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/08/21 17:20:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/08/21 17:20:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/08/21 17:20:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/08/17 19:18:22 | 000,014,236 | —- | C] () – C:\Documents and Settings\User\Desktop\Malwarebytes Solve Your Malware Problems With Our Help.htm
[2013/08/15 16:36:36 | 000,772,868 | —- | C] () – C:\Documents and Settings\User\Desktop\Module+1.pdf
[2013/08/15 09:19:25 | 000,397,353 | —- | C] () – C:\Documents and Settings\User\Desktop\3-Steps-2-Profit.pdf
[2013/08/15 08:29:42 | 034,162,021 | —- | C] () – C:\Documents and Settings\User\Desktop\mijacko_1080p video mttb.mp4
[2013/08/15 08:21:34 | 034,162,021 | —- | C] () – C:\Documents and Settings\User\Desktop\mijacko_1080p.mp4
[2013/08/11 14:27:58 | 000,001,650 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Social Lead Fox.lnk
[2013/08/11 14:27:58 | 000,001,644 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Social Lead Fox.lnk
[2013/08/11 10:19:24 | 000,000,698 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2013/08/10 07:50:24 | 000,001,996 | —- | C] () – C:\WINDOWS\System32\.crusader
[2013/08/09 22:56:02 | 000,001,626 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2013/08/08 13:58:11 | 000,000,000 | —- | C] () – C:\Documents and Settings\User\Application Data\pdfperformer
[2013/08/06 17:31:03 | 004,476,508 | —- | C] () – C:\Documents and Settings\User\Desktop\wordpress-3.6.zip
[2013/08/05 18:06:12 | 000,015,593 | —- | C] () – C:\Documents and Settings\User\Desktop\Top Tier imabe.jpg
[2013/08/04 15:44:49 | 000,067,589 | —- | C] () – C:\Documents and Settings\User\Desktop\AWeber Communications.htm
[2013/08/04 15:22:56 | 000,001,186 | —- | C] () – C:\Documents and Settings\User\Desktop\29Leadsources.htm
[2013/08/04 14:50:20 | 002,014,159 | —- | C] () – C:\Documents and Settings\User\My Documents\MY PAGE power pont.odp
[2013/08/04 14:01:49 | 000,008,860 | —- | C] () – C:\Documents and Settings\User\My Documents\A Test Test traffic costs ect.ods
[2013/08/04 13:43:22 | 000,000,933 | —- | C] () – C:\Documents and Settings\User\Desktop\OpenOffice.org 3.4.1.lnk
[2013/08/03 12:25:49 | 000,025,521 | —- | C] () – C:\Documents and Settings\User\My Documents\TrafficExchangeSecrets-PLR.zip
[2013/05/21 08:50:17 | 000,003,715 | —- | C] () – C:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/04/20 12:16:37 | 000,000,049 | —- | C] () – C:\WINDOWS\DictionaryServiceProxy.INI
[2013/03/21 23:56:16 | 000,000,008 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\~wmrg
[2013/02/24 14:22:40 | 000,000,205 | —- | C] () – C:\WINDOWS\hbcikrnl.ini
[2013/02/24 11:19:23 | 000,025,816 | —- | C] () – C:\WINDOWS\System32\drivers\RTAIODAT.DAT
[2013/02/24 09:33:54 | 000,013,464 | —- | C] () – C:\WINDOWS\System32\drivers\SWDUMon.sys
[2012/12/25 09:07:54 | 000,000,234 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2012/12/25 09:07:54 | 000,000,094 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2012/12/25 09:07:36 | 000,003,311 | —- | C] () – C:\WINDOWS\BRPARAM.INI
[2012/12/25 09:06:20 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2012/12/25 09:05:34 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2012/12/25 09:05:20 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2012/11/09 11:08:54 | 000,319,312 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1960408961-1409082233-725345543-1003-0.dat
[2012/10/11 06:18:49 | 000,000,031 | —- | C] () – C:\WINDOWS\WebUpdateSvc4.INI
[2012/10/11 06:18:03 | 000,047,631 | —- | C] () – C:\WINDOWS\System32\wuwuninst.exe
[2012/10/09 21:30:31 | 000,134,682 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/08/16 15:20:47 | 000,027,520 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\dt.dat
[2012/02/16 14:43:20 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/10/27 08:16:39 | 000,000,138 | —- | C] () – C:\WINDOWS\TomsRegistration.INI
[2011/03/16 07:09:18 | 000,096,768 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/06 07:37:33 | 000,000,127 | —- | C] () – C:\Documents and Settings\User\Local Settings\Application Data\fusioncache.dat

========== ZeroAccess Check ==========

[2010/10/12 10:09:44 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2010/04/17 02:09:07 | 001,509,888 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 22:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 10:12:08 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >




sound is still bad , still takes a long time to shut down
other than that im not sure at this stage ??
Post #54
[external image: Posted Image] FRST

Download the 32 bit version for your system of FRST and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

———-
Post #57
ComboFix 13-09-02.02 - User 03/09/2013 7:23.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2347 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\Diognosing\Under supervision\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((( Files Created from 2013-08-02 to 2013-09-02 )))))))))))))))))))))))))))))))
.
.
2013-09-02 21:09 . 2013-09-02 21:09 30976 —-a-w- c:\windows\system32\drivers\hitmanpro37.sys
2013-09-02 21:07 . 2013-09-02 21:07 ——– d—–w- c:\windows\LastGood
2013-08-30 08:32 . 2013-08-30 08:32 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\ESET
2013-08-26 20:19 . 2013-08-27 06:34 ——– d—–w- c:\program files\MyPC Backup
2013-08-26 00:48 . 2013-08-26 00:48 ——– dc—-w- C:\_OTL
2013-08-26 00:41 . 2013-08-26 00:41 ——– dc—-w- C:\RegBackup
2013-08-26 00:41 . 2013-08-26 00:41 ——– d—–w- c:\program files\Tweaking.com
2013-08-21 07:15 . 2013-08-21 07:15 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\IAC
2013-08-18 13:55 . 2013-08-18 13:55 ——– d—–w- c:\windows\Social Lead Fox
2013-08-18 13:55 . 2013-08-18 13:55 ——– d—–w- c:\program files\Microsoft Works
2013-08-18 13:46 . 2013-08-18 13:46 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Microsoft Help
2013-08-18 13:44 . 2013-08-18 13:44 ——– d—–w- c:\program files\HitmanPro
2013-08-18 04:29 . 2013-08-18 12:49 ——– d—–w- c:\documents and settings\Administrator
2013-08-11 04:27 . 2013-08-18 13:55 ——– d—–w- c:\program files\SocialLeadFox
2013-08-11 00:55 . 2006-10-26 09:58 30512 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2013-08-11 00:55 . 2009-02-26 09:18 29552 —-a-w- c:\windows\system32\mdimon.dll
2013-08-11 00:48 . 2013-08-18 13:35 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2013-08-11 00:47 . 2013-08-11 00:52 ——– d—–w- c:\windows\SHELLNEW
2013-08-11 00:47 . 2013-08-18 13:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2013-08-11 00:46 . 2013-08-11 00:46 ——– dc—-r- C:\MSOCache
2013-08-11 00:19 . 2013-08-18 13:36 ——– d—–w- c:\program files\PowerISO
2013-08-09 12:53 . 2013-08-18 13:38 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2013-08-08 03:42 . 2013-08-08 22:15 ——– d—–w- c:\program files\UPDF
2013-08-04 03:59 . 2013-08-04 03:59 ——– d—–w- c:\documents and settings\User\Application Data\OpenOffice.org
2013-08-04 03:42 . 2013-08-04 03:42 ——– d—–w- c:\program files\OpenOffice.org 3
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-02 21:06 . 2013-02-23 23:33 13464 —-a-w- c:\windows\system32\drivers\SWDUMon.sys
2013-08-21 02:00 . 2012-04-11 23:16 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-21 02:00 . 2011-06-06 00:08 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-03 04:18 . 2006-10-18 11:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
2013-07-30 05:11 . 2012-08-30 21:33 37664 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-07-26 02:47 . 2004-08-04 12:00 920064 —-a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47 . 2004-08-04 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2004-08-04 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2004-08-04 12:00 385024 ——w- c:\windows\system32\html.iec
2013-07-12 01:33 . 2013-05-13 21:05 0 —-a-w- c:\windows\system32\TempWmicBatchFile.bat
2013-07-10 10:37 . 2004-08-04 12:00 406016 —-a-w- c:\windows\system32\usp10.dll
2013-07-04 03:03 . 2004-08-04 12:00 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2004-08-03 22:59 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBOK]
@="{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}"
[HKEY_CLASSES_ROOT\CLSID\{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}]
2009-11-06 14:07 297808 —-a-w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2013-08-08 109784]
"Adobe Reader Synchronizer"="c:\program files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe" [2013-05-10 1272912]
"DriverUpdate"="c:\program files\DriverUpdate\DriverUpdate.exe" [2013-06-22 34220352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2006-09-01 30208]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-04-14 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-04-14 569413]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2011-05-18 2629632]
"IndexSearch"="c:\program files\Nuance\PaperPort\IndexSearch.exe" [2010-03-08 46368]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"RTHDCPL"="RTHDCPL.EXE" [2000-01-01 20143688]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2013-06-19 295512]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"GoogleChromeAutoLaunch_BB7E6CE705E9E15ABCB72D3060D30B1F"="c:\program files\Google\Chrome\Application\chrome.exe" [2013-08-24 829392]
.
c:\documents and settings\User\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files\MyPC Backup\MyPC Backup.exe [2013-7-2 1945128]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe -s [2011-1-26 622592]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-09-01 00:59 39936 —-a-w- c:\windows\system32\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Movie Maker\\moviemk.exe"=
"c:\\Program Files\\7-Zip\\7zFM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Torch\\Plugins\\Torrent\\TorchTorrent.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"54925:UDP"= 54925:UDP:BrotherNetwork Scanner
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [31/08/2012 7:33 AM 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23/07/2011 2:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [13/07/2011 7:55 AM 67664]
R2 BackupStack;Computer Backup (MyPC Backup);c:\program files\MyPC Backup\BackupStack.exe [2/07/2013 3:55 AM 32808]
R2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [10/08/2013 7:42 AM 106280]
R2 ipasintf;ipasintf;c:\windows\system32\drivers\pas2k.sys [10/07/2006 6:37 PM 78280]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [15/06/2013 9:42 AM 418376]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [15/06/2013 9:42 AM 701512]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [26/06/2010 3:07 AM 35088]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe [9/03/2010 12:40 AM 144672]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [16/04/2013 3:07 AM 39056]
R2 smihlp;SMI helper driver;c:\program files\Protector Suite QL\smihlp.sys [1/09/2006 10:42 AM 3328]
R2 WebUpdate4;Web Update Wizard Service V4;c:\windows\system32\WebUpdateSvc4.exe [19/01/2008 2:12 AM 258264]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [20/03/2013 4:57 PM 26080]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys [3/09/2013 7:09 AM 30976]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [12/10/2010 9:55 AM 36352]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [15/06/2013 9:42 AM 22856]
R3 NETwLx32; Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit;c:\windows\system32\drivers\NETwLx32.sys [24/02/2013 12:46 PM 6607744]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [16/02/2006 5:36 PM 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [20/02/2006 4:01 PM 43608]
S1 MpKsle033037d;MpKsle033037d;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys –> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{996C69FE-556B-47DA-AD95-1E462181B36C}\MpKsle033037d.sys [?]
S2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe –> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [24/02/2013 11:19 AM 1691480]
S3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [25/12/2012 9:06 AM 245760]
S3 GAGPDrv;GAGPDrv; [x]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [24/02/2013 9:33 AM 13464]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - HITMANPRO37
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-29 03:58 1177552 —-a-w- c:\program files\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 02:00]
.
2013-09-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 07:57]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-15 06:48]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-15 06:48]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-01 21:37]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1409082233-725345543-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-01 21:37]
.
2013-08-29 c:\windows\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\recordingmanager.exe [2013-04-15 17:09]
.
2013-09-02 c:\windows\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-04-15 17:07]
.
2013-08-27 c:\windows\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\RealNetworks\RealDownloader\realupgrade.exe [2013-04-15 17:07]
.
2013-09-02 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-04-16 02:45]
.
2013-08-31 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1960408961-1409082233-725345543-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-04-16 02:45]
.
2013-09-02 c:\windows\Tasks\ReclaimerUpdateFiles_User.job
- c:\documents and settings\User\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-02 14:22]
.
2013-09-02 c:\windows\Tasks\ReclaimerUpdateXML_User.job
- c:\documents and settings\User\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-02 14:22]
.
2013-09-02 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_User.job
- c:\documents and settings\User\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-02 14:22]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com.au/
uInternet Settings,ProxyOverride = *.local
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Open with PDF Viewer Plus - c:\program files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Show RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
TCP: DhcpNameServer = 192.168.0.1 192.168.1.1
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com.au/
FF - ExtSQL: 2013-07-27 21:49; {B40794A0-7477-4335-95C5-8CB9BBC5C4A5}; c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ze604on3.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{4d87b7a7-23f1-470c-aa45-96b25b9bd138} - (no file)
AddRemove-Deal Spy - c:\program files\Deal Spy\Uninstall.exe
AddRemove-Shareaza 3 MediaBar - c:\program files\Shareaza Applications\MediaBar\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-03 07:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1960408961-1409082233-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(964)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\bio.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\MSVCP71.dll
c:\program files\Protector Suite QL\crypto.dll
.
- - - - - - - > 'lsass.exe'(1020)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus2.dll
.
- - - - - - - > 'explorer.exe'(2680)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\program files\MyPC Backup\MPCBIconOverlays.dll
c:\program files\MyPC Backup\LogicNP.EZShellExtensions.dll
c:\program files\MyPC Backup\x86\System.Data.SQLite.dll
c:\program files\MyPC Backup\AWSSDK.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-09-03 07:46:53
ComboFix-quarantined-files.txt 2013-09-02 21:46
ComboFix2.txt 2013-08-23 14:07
ComboFix3.txt 2013-08-21 14:33
.
Pre-Run: 8,000,610,304 bytes free
Post-Run: 7,997,153,280 bytes free
.
- - End Of File - - DFE879083CFE0654125FFD82719021DB
8F558EB6672622401DA993E1E865C861
Post #58
Please go to: VirusTotal
On the page you'll find a "Choose File" button.
Click on the Choose File button.
In the Choose File to Upload window which opens, copy and paste this into the File Name box.

c:\program files\DriverUpdate\DriverUpdate.exe

Next, click the Open button.
Then click the "Scan It!" button just below.
This will scan the file. Please be patient.
If you get a message saying File has already been analyzed: click Reanalyze file now
Once scanned, copy and paste the link to the results page in your next reply.
———-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI