Also infected with longfintuna [Closed]

Per the 'Am I infected" guidelines, here is the complete OTL.EXE output:

OTL logfile created on: 9/26/2013 8:37:05 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = I:\Documents and Settings\Michael\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 0.75 Gb Available Physical Memory | 21.58% Memory free
7.33 Gb Paging File | 4.17 Gb Available in Paging File | 56.92% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4096I:\pagef [Binary data over 200 bytes]

%SystemDrive% = I: | %SystemRoot% = I:\WINDOWS | %ProgramFiles% = I:\Program Files
Drive C: | 1863.01 Gb Total Space | 208.15 Gb Free Space | 11.17% Space Free | Partition Type: NTFS
Drive I: | 127.99 Gb Total Space | 1.92 Gb Free Space | 1.50% Space Free | Partition Type: NTFS

Computer Name: DOOFIE | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - I:\Documents and Settings\Michael\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - I:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - I:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - I:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files\MSOffice 2007\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - I:\Program Files\Nike\Nike+ Connect\Nike+ Connect daemon.exe (Nike)
PRC - C:\Program Files\Picasa\Picasa3\Picasa3.exe (Google Inc.)
PRC - I:\Documents and Settings\Kate\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\MSOffice 2007\Office12\MSPUB.EXE (Microsoft Corporation)
PRC - I:\Documents and Settings\Kate\Local Settings\Application Data\Nike\Nike+ Connect\Nike+ Connect.exe (Nike)
PRC - I:\Documents and Settings\Kate\Local Settings\Application Data\Nike\Nike+ Connect\Nike+ Connect daemon.exe (Nike)
PRC - C:\Program Files\MSOffice 2007\Office12\WINWORD.EXE (Microsoft Corporation)
PRC - I:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)
PRC - I:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
PRC - I:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
PRC - I:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - I:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - I:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - I:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccsvchst.exe (Symantec Corporation)
PRC - I:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)
PRC - I:\Program Files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe (PIXELA CORPORATION)
PRC - I:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - I:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - I:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - I:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATICFA.EXE (SEIKO EPSON CORPORATION)
PRC - I:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)


========== Modules (No Company Name) ==========

MOD - I:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7bf3e4deef4483205017aa7b13194845\System.ServiceProcess.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\900d7d45b5a5498cbb97c36409f0afe1\System.Runtime.Remoting.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\bfa9e814cb8b662508aa93ae387b434f\System.EnterpriseServices.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\102014a4f570b1dc944ff7eb8e1c6e2b\System.Transactions.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\1a3b614a84244ea5fa4147b5cf007333\System.Windows.Forms.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\3a3fc0216674bdea0be809b305517c98\System.Drawing.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\8fefdc1ecedf91a104b084c7d8200bde\System.Data.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\c25ede0d0127774c504c4fc41d4de273\System.Core.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\884bcbd22130ebeb1211bc7bcc3910c9\System.Xml.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\df40dab689e9d8febfb943599ba79f8d\System.Configuration.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\de853615c8224ba5d9aa9b76276c6d98\System.ni.dll ()
MOD - I:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\cf58670896c5313b9b52f026f4455a5d\mscorlib.ni.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - I:\Program Files\LeapFrog\LeapFrog Connect\QtGui4.dll ()
MOD - I:\Program Files\LeapFrog\LeapFrog Connect\QtCore4.dll ()
MOD - I:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - I:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\QTCore4.dll ()
MOD - C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - I:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - I:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MOD - I:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - I:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - I:\Program Files\PIXELA\Everio MediaBrowser 3\pxl_m17n_tool.dll ()


========== Services (SafeList) ==========

SRV - (ZY202_XP) – %systemroot%\system32\arrayssl_vpn_service3,0,1,9.dll File not found
SRV - (yats32) – %systemroot%\system32\perc2hib.dll File not found
SRV - (wintabservice) – %systemroot%\system32\mxssvr.dll File not found
SRV - (windowblinds) – %systemroot%\system32\F700iob.dll File not found
SRV - (W700mdm) – %systemroot%\system32\RDID1027.dll File not found
SRV - (vmusb) – %systemroot%\system32\stcagent.dll File not found
SRV - (VIAPFD) – %systemroot%\system32\Dfs.dll File not found
SRV - (VAIOMediaPlatform-MusicServer-HTTP) – %systemroot%\system32\psdistributionagent.dll File not found
SRV - (USB_RNDIS_XP) – %systemroot%\system32\fsssvc.dll File not found
SRV - (umpusbxp) – %systemroot%\system32\WcesComm.dll File not found
SRV - (UCTblHid) – %systemroot%\system32\nmservice.dll File not found
SRV - (TMKEmu) – %systemroot%\system32\se59mdfl.dll File not found
SRV - (tcpipBM) – %systemroot%\system32\appdrv.dll File not found
SRV - (sskbfd) – %systemroot%\system32\qkbfiltr.dll File not found
SRV - (smwdm) – %systemroot%\system32\BLKWGU(Belkin).dll File not found
SRV - (siswlsvc) – %systemroot%\system32\clcapsvc.dll File not found
SRV - (sis162u) – %systemroot%\system32\LPCFilter.dll File not found
SRV - (se59mdfl) – %systemroot%\system32\nvsmu.dll File not found
SRV - (s7oppitx) – %systemroot%\system32\erecoveryservice.dll File not found
SRV - (rp32service) – %systemroot%\system32\kbdhid.dll File not found
SRV - (pptchpad) – %systemroot%\system32\FreeTdi.dll File not found
SRV - (ppmoucls) – %systemroot%\system32\NWSNS.dll File not found
SRV - (PID_PEPI) – %systemroot%\system32\awhost32.dll File not found
SRV - (pdscheduler) – %systemroot%\system32\viaide.dll File not found
SRV - (pdfcreatormessages) – %systemroot%\system32\pinnaclesys.mediaserver.dll File not found
SRV - (pctfw1) – %systemroot%\system32\QPSched.dll File not found
SRV - (Pcatip) – %systemroot%\system32\ASNDIS5.dll File not found
SRV - (pca) – %systemroot%\system32\milshieldcleaner.dll File not found
SRV - (pae_avs) – %systemroot%\system32\ELacpi.dll File not found
SRV - (nvrd64) – %systemroot%\system32\bdfsfltr.dll File not found
SRV - (NvNdis) – %systemroot%\system32\DLARTL_M.dll File not found
SRV - (ntcharge) – %systemroot%\system32\pavprsrv.dll File not found
SRV - (neokdss) – %systemroot%\system32\phnxvcdservice.dll File not found
SRV - (moufiltr) – %systemroot%\system32\tsircsrv.dll File not found
SRV - (LXARScan) – %systemroot%\system32\hsf_dpv.dll File not found
SRV - (LMouKE) – %systemroot%\system32\SISNICXP.dll File not found
SRV - (LEX_AS_NIC_SERVICE_YNOS) – %systemroot%\system32\cvslock.dll File not found
SRV - (ldlcserv) – %systemroot%\system32\MRESP50.dll File not found
SRV - (k750mdfl) – %systemroot%\system32\pclepci.dll File not found
SRV - (imaservice) – %systemroot%\system32\spmgr.dll File not found
SRV - (iaimtv2) – %systemroot%\system32\ipfilterdriver.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (helpsvc) – %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dlles\pchsvc.dll File not found
SRV - (eskerlicensecontrol) – %systemroot%\system32\NWSAP.dll File not found
SRV - (DXEC02) – %systemroot%\system32\LMouKE.dll File not found
SRV - (dvd_2K) – %systemroot%\system32\ps2.dll File not found
SRV - (dlartl_n) – %systemroot%\system32\spbbcsvc.dll File not found
SRV - (DefaultTabUpdate) – I:\Documents and Settings\Max\Application Data\DefaultTab\DefaultTab\DTUpdate.exe File not found
SRV - (db2remotecmd) – %systemroot%\system32\kavsvc.dll File not found
SRV - (COMMONFX.DLL) – %systemroot%\system32\raysat3_4_6_18server.dll File not found
SRV - (cis1284) – %systemroot%\system32\tosrfbnp.dll File not found
SRV - (CdaD10BA) – %systemroot%\system32\rtl8139.dll File not found
SRV - (ccs) – %systemroot%\system32\cvintdrv.dll File not found
SRV - (bwcsrv) – %systemroot%\system32\ichaud.dll File not found
SRV - (bdss) – %systemroot%\system32\nvsvc.dll File not found
SRV - (atkdisplf) – %systemroot%\system32\statusagent4.dll File not found
SRV - (atixsaudio) – %systemroot%\system32\anbmservice.dll File not found
SRV - (aswlsvc) – %systemroot%\system32\tvtpktfilter.dll File not found
SRV - (artourservice) – %systemroot%\system32\carboncopyscheduler.dll File not found
SRV - (agrsrvce) – %systemroot%\system32\bcserver.dll File not found
SRV - (AffinegyService) – %systemroot%\system32\s217mdfl.dll File not found
SRV - ({d31a0762-0ceb-444e-acff-b049a1f6fe91}) – %systemroot%\system32\USRpdA.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – I:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – I:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Skype C2C Service) – I:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) – I:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (IntuitUpdateServiceV4) – I:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe (Intuit Inc.)
SRV - (LeapFrog Connect Device Service) – I:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
SRV - (UMVPFSrv) – I:\Program Files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (N360) – I:\Program Files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe (Symantec Corporation)
SRV - (PSI_SVC_2) – I:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (Nero BackItUp Scheduler 4.0) – I:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (EPSON_PM_RPCV4_01) – I:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – I:\DOCUME~1\Kate\LOCALS~1\Temp\catchme.sys File not found
DRV - (BHDrvx86) – I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130924.001\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130926.018\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20130926.018\NAVENG.SYS (Symantec Corporation)
DRV - (eeCtrl) – I:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilDrv11311) – I:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11311.sys (Symantec Corporation)
DRV - (IDSxpx86) – I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130926.001\IDSXpx86.sys (Symantec Corporation)
DRV - (SymEvent) – I:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (ati2mtag) – I:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (LVUVC) – I:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – I:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (Ser2pl) – I:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (SYMTDI) – I:\WINDOWS\system32\drivers\N360\0502020.003\symtdi.sys (Symantec Corporation)
DRV - (SRTSP) – I:\WINDOWS\system32\drivers\N360\0502020.003\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) – I:\WINDOWS\system32\drivers\N360\0502020.003\srtspx.sys (Symantec Corporation)
DRV - (SymEFA) – I:\WINDOWS\system32\drivers\N360\0502020.003\symefa.sys (Symantec Corporation)
DRV - (SymDS) – I:\WINDOWS\system32\drivers\N360\0502020.003\symds.sys (Symantec Corporation)
DRV - (SymIRON) – I:\WINDOWS\system32\drivers\N360\0502020.003\ironx86.sys (Symantec Corporation)
DRV - (ivusb) – I:\WINDOWS\system32\drivers\ivusb.sys (Initio Corporation)
DRV - (IntcAzAudAddService) – I:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtiHdmiService) – I:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (AmdPPM) – I:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (hcwPP2) – I:\WINDOWS\system32\drivers\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (nvnetbus) – I:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – I:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (crlscsi) – I:\WINDOWS\System32\drivers\crlscsi.sys (Corel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.live.com/?mkt=en-us
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - No CLSID value found
IE - HKCU\..\URLSearchHook: *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKCU\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {BABF7553-53FD-45AE-AEB6-10B1AB64E015}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\..\SearchScopes\{BABF7553-53FD-45AE-AEB6-10B1AB64E015}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GGIE_en
IE - HKCU\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://search.yahoo.com/search?fr=chr-gree…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=937811"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledAddons: %7B195A3098-0BD5-4e90-AE22-BA1C540AFD1E%7D:4.0.4
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:12.0.0.380%20-%201
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: I:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: I:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: I:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: I:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: I:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: I:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: I:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: I:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: I:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: I:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: I:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=2: C:\Documents and Settings\Michael\Local Settings\Application Data\Google\Update\1.2.121.9\npGoogleOneClick.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: I:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/12/17 11:58:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2012/04/23 23:00:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: I:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn_2011_7_13_2 [2013/09/22 19:35:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: I:\Program Files\Mozilla Firefox\components [2013/08/17 00:23:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: I:\Program Files\Mozilla Firefox\plugins [2013/09/13 21:47:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Components: I:\Program Files\Mozilla Thunderbird\components [2013/08/06 19:07:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.8\extensions\\Plugins: I:\Program Files\Mozilla Thunderbird\plugins [2013/09/13 21:47:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: I:\Program Files\AVG\AVG2012\Thunderbird\ [2011/12/22 10:49:32 | 000,000,000 | —D | M]

[2011/09/30 22:27:35 | 000,000,000 | —D | M] (No name found) – I:\Documents and Settings\Michael\Application Data\Mozilla\Extensions
[2011/09/30 22:27:35 | 000,000,000 | —D | M] (No name found) – I:\Documents and Settings\Michael\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/08/15 19:57:39 | 000,000,000 | —D | M] (No name found) – I:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\extensions
[2013/04/14 08:40:13 | 000,000,000 | —D | M] (Garmin Communicator) – I:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/09/30 22:27:33 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – I:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/08/15 19:57:36 | 000,824,302 | —- | M] () (No name found) – I:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/08/17 00:23:02 | 000,000,000 | —D | M] (No name found) – I:\Program Files\Mozilla Firefox\extensions
[2013/08/20 01:06:24 | 000,000,000 | —D | M] (Skype Click to Call) – I:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/08/17 00:23:03 | 000,000,000 | —D | M] (Java Console) – I:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/08/17 00:23:00 | 000,000,000 | —D | M] (No name found) – I:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/20 01:06:24 | 000,000,000 | —D | M] (Skype Click to Call) – I:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/09/18 17:57:01 | 000,000,000 | —D | M] (Default) – I:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/04/23 23:00:08 | 000,000,000 | —D | M] (Symantec Intrusion Prevention) – I:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPLGN
[2012/04/01 13:06:58 | 000,003,766 | —- | M] () – I:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{
google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = I:\Program Files\Google\Chrome\Application\26.0.1410.43\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = I:\Program Files\Google\Chrome\Application\26.0.1410.43\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = I:\Program Files\Google\Chrome\Application\26.0.1410.43\pdf.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Adobe Acrobat (Enabled) = I:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = I:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = I:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = I:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Picasa\Picasa3\npPicasa3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = I:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = I:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Garmin Communicator Plug-In (Enabled) = I:\Program Files\Garmin GPS Plugin\npGarmin.dll
CHR - plugin: Google Update (Enabled) = I:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 6 U35 (Enabled) = I:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = I:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = I:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave Flash (Enabled) = I:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll
CHR - plugin: Java Deployment Toolkit 6.0.350.10 (Enabled) = I:\WINDOWS\system32\npdeployJava1.dll
CHR - Extension: Google Docs = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Search = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/03/29 19:30:22 | 000,000,826 | R— | M]) - I:\WINDOWS\system32\drivers\etc\hosts
O2 - BHO: (Super Lyrics) - {30B87EBD-E91B-498B-B25D-DF116AF00393} - I:\Program Files\Super_Lyrics\125.dll File not found
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - I:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - I:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - I:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - I:\Program Files\Norton Security Suite\Engine\5.2.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (DefaultTab Browser Helper) - {7F6AFBF1-E065-4627-A2FD-810366367D01} - I:\Documents and Settings\Max\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.dll File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - I:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Super Lyrics) - {B9020890-9E08-446B-87B0-0C5CD0436D86} - I:\Program Files\Super_Lyrics\116.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - I:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - I:\Program Files\Norton Security Suite\Engine\5.2.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [APSDaemon] I:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [DivXUpdate] I:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Monitor] I:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
O4 - HKLM..\Run: [Nike+ Connect] I:\Program Files\Nike\Nike+ Connect\Nike+ Connect daemon.exe (Nike)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" File not found
O4 - HKCU..\Run: [EPSON Stylus CX9400Fax Series] I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICFA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" File not found
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKCU..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] I:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O4 - Startup: I:\Documents and Settings\All Users\Start Menu\Programs\Startup\Device Monitor 3.lnk = I:\Program Files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe (PIXELA CORPORATION)
O4 - Startup: I:\Documents and Settings\All Users\Start Menu\Programs\Startup\PHOTOfunSTUDIO 6.0.lnk = I:\Program Files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe (Panasonic Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: _NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - I:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - I:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\MSOffice 2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - I:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - I:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1343359457328 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1347241314747 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_35)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.253
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D00E7CB-22FA-4BCC-9896-9EB830DD3762}: DhcpNameServer = 192.168.2.253
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8D00E7CB-22FA-4BCC-9896-9EB830DD3762}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - I:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - I:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - I:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (I:\WINDOWS\system32\userinit.exe) - I:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - I:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: I:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: I:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - I:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{52373fcc-3fb3-11dd-b760-0018f336a11d}\Shell - "" = AutoRun
O33 - MountPoints2\{52373fcc-3fb3-11dd-b760-0018f336a11d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{52373fcc-3fb3-11dd-b760-0018f336a11d}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\{8dcd2a31-f592-11db-b71a-0018f336a11d}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/16 16:30:04 | 000,000,000 | —D | C] – I:\Documents and Settings\NetworkService\Local Settings\Application Data\Mozilla
[2013/08/29 18:30:33 | 000,000,000 | —D | C] – I:\garbage
[2013/08/29 13:53:32 | 000,000,000 | —D | C] – I:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2013/08/29 13:53:25 | 000,000,000 | —D | C] – I:\Program Files\Spybot - Search & Destroy
[2013/08/29 13:53:25 | 000,000,000 | —D | C] – I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[8 I:\WINDOWS\*.tmp files -> I:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/09/26 20:26:00 | 000,000,882 | —- | M] () – I:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/09/26 20:10:00 | 000,000,830 | —- | M] () – I:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/26 18:26:00 | 000,000,878 | —- | M] () – I:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/26 16:30:04 | 000,000,404 | —- | M] () – I:\WINDOWS\tasks\At1.job
[2013/09/22 19:47:08 | 000,002,278 | —- | M] () – I:\WINDOWS\System32\wpa.dbl
[2013/09/22 19:34:33 | 000,002,048 | –S- | M] () – I:\WINDOWS\bootstat.dat
[2013/09/22 19:09:34 | 000,442,920 | —- | M] () – I:\WINDOWS\System32\FNTCACHE.DAT
[2013/09/22 16:30:11 | 000,000,664 | —- | M] () – I:\WINDOWS\System32\d3d9caps.dat
[2013/09/21 00:30:54 | 000,001,813 | —- | M] () – I:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/09/20 11:28:01 | 000,000,284 | —- | M] () – I:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/09/20 09:10:08 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – I:\WINDOWS\System32\FlashPlayerApp.exe
[2013/09/20 09:10:08 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – I:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/09/14 15:57:38 | 000,002,349 | —- | M] () – I:\Documents and Settings\Michael\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2013/09/04 05:14:17 | 000,002,828 | -HS- | M] () – I:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2013/09/04 05:14:09 | 000,000,088 | RHS- | M] () – I:\Documents and Settings\All Users\Application Data\E95564235F.sys
[2013/08/30 19:37:35 | 000,000,126 | —- | M] () – I:\Documents and Settings\Michael\Application Data\default.rss
[2013/08/30 19:37:28 | 000,000,069 | —- | M] () – I:\WINDOWS\NeroDigital.ini
[2013/08/29 18:16:50 | 000,002,625 | —- | M] () – I:\WINDOWS\wininit.ini
[8 I:\WINDOWS\*.tmp files -> I:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/29 15:57:29 | 000,002,625 | —- | C] () – I:\WINDOWS\wininit.ini
[2013/07/26 16:31:08 | 000,000,113 | —- | C] () – I:\Documents and Settings\NetworkService\Application Data\WB.CFG
[2013/07/23 16:30:02 | 000,000,005 | —- | C] () – I:\Documents and Settings\NetworkService\Application Data\WBPU-TTL.DAT
[2013/07/22 21:56:15 | 000,000,884 | RHS- | C] () – I:\Documents and Settings\Michael\ntuser.pol
[2013/07/21 20:21:55 | 000,000,000 | —- | C] () – I:\WINDOWS\CorelDrw.ini
[2013/01/12 20:16:31 | 000,001,120 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_IT.dat
[2013/01/12 20:16:31 | 000,001,107 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_GE.dat
[2013/01/12 20:16:30 | 000,001,146 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_DU.dat
[2012/09/27 17:37:54 | 000,745,016 | —- | C] () – I:\WINDOWS\unins000.exe
[2012/09/27 17:37:54 | 000,216,064 | —- | C] ( ) – I:\WINDOWS\System32\LAGARITH.DLL
[2012/09/27 17:37:54 | 000,047,546 | —- | C] () – I:\WINDOWS\unins000.dat
[2012/06/14 07:46:25 | 000,172,953 | —- | C] () – I:\WINDOWS\hppins10.dat.temp
[2012/06/14 07:46:25 | 000,005,924 | —- | C] () – I:\WINDOWS\hppmdl10.dat.temp
[2012/04/23 22:56:15 | 002,458,160 | —- | C] () – I:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-220523388-1715567821-725345543-1004-0.dat
[2012/04/23 22:56:05 | 000,403,322 | —- | C] () – I:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/03/30 21:01:13 | 000,256,000 | —- | C] () – I:\WINDOWS\PEV.exe
[2012/03/30 21:01:13 | 000,208,896 | —- | C] () – I:\WINDOWS\MBR.exe
[2012/03/30 21:01:13 | 000,098,816 | —- | C] () – I:\WINDOWS\sed.exe
[2012/03/30 21:01:13 | 000,080,412 | —- | C] () – I:\WINDOWS\grep.exe
[2012/03/30 21:01:13 | 000,068,096 | —- | C] () – I:\WINDOWS\zip.exe
[2012/03/29 11:47:08 | 000,000,664 | —- | C] () – I:\WINDOWS\System32\d3d9caps.dat
[2012/02/14 16:07:13 | 000,003,072 | —- | C] () – I:\WINDOWS\System32\iacenc.dll
[2012/02/09 17:48:22 | 000,000,744 | —- | C] () – I:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
[2011/12/24 17:30:59 | 000,000,069 | —- | C] () – I:\WINDOWS\NeroDigital.ini
[2011/10/15 15:36:46 | 000,000,074 | —- | C] () – I:\WINDOWS\MPLAYER.INI
[2011/10/02 21:26:06 | 000,000,000 | —- | C] () – I:\WINDOWS\longfile.INI
[2011/10/02 21:26:00 | 001,371,436 | R— | C] () – I:\WINDOWS\System32\VBAR2132.DLL
[2011/10/02 20:38:51 | 000,039,125 | —- | C] () – I:\WINDOWS\iccsigs.dat
[2011/10/02 18:22:58 | 000,111,932 | —- | C] () – I:\WINDOWS\System32\EPPICPrinterDB.dat
[2011/10/02 18:22:58 | 000,031,053 | —- | C] () – I:\WINDOWS\System32\EPPICPattern131.dat
[2011/10/02 18:22:58 | 000,027,417 | —- | C] () – I:\WINDOWS\System32\EPPICPattern121.dat
[2011/10/02 18:22:58 | 000,026,154 | —- | C] () – I:\WINDOWS\System32\EPPICPattern1.dat
[2011/10/02 18:22:58 | 000,024,903 | —- | C] () – I:\WINDOWS\System32\EPPICPattern3.dat
[2011/10/02 18:22:58 | 000,021,390 | —- | C] () – I:\WINDOWS\System32\EPPICPattern5.dat
[2011/10/02 18:22:58 | 000,020,148 | —- | C] () – I:\WINDOWS\System32\EPPICPattern2.dat
[2011/10/02 18:22:58 | 000,011,811 | —- | C] () – I:\WINDOWS\System32\EPPICPattern4.dat
[2011/10/02 18:22:58 | 000,004,943 | —- | C] () – I:\WINDOWS\System32\EPPICPattern6.dat
[2011/10/02 18:22:58 | 000,001,139 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_PT.dat
[2011/10/02 18:22:58 | 000,001,139 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_BP.dat
[2011/10/02 18:22:58 | 000,001,136 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_ES.dat
[2011/10/02 18:22:58 | 000,001,129 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_FR.dat
[2011/10/02 18:22:58 | 000,001,129 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_CF.dat
[2011/10/02 18:22:58 | 000,001,104 | —- | C] () – I:\WINDOWS\System32\EPPICPresetData_EN.dat
[2011/10/02 18:22:58 | 000,000,097 | —- | C] () – I:\WINDOWS\System32\PICSDK.ini
[2011/10/02 13:59:24 | 000,000,623 | R— | C] () – I:\WINDOWS\System32\hppapr10.dat
[2011/10/02 13:59:13 | 000,000,163 | —- | C] () – I:\WINDOWS\System32\AddPort.ini
[2011/10/02 13:49:40 | 000,000,844 | —- | C] () – I:\WINDOWS\hpntwksetup.ini
[2011/10/02 13:29:55 | 000,170,504 | —- | C] () – I:\WINDOWS\hppins10.dat
[2011/10/02 13:29:55 | 000,005,924 | —- | C] () – I:\WINDOWS\hppmdl10.dat
[2011/10/02 11:07:17 | 000,002,828 | -HS- | C] () – I:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2011/10/02 11:07:17 | 000,000,088 | RHS- | C] () – I:\Documents and Settings\All Users\Application Data\E95564235F.sys
[2011/10/01 17:33:56 | 000,004,767 | —- | C] () – I:\WINDOWS\Irremote.ini
[2011/10/01 16:59:56 | 000,000,000 | —- | C] () – I:\WINDOWS\ativpsrm.bin
[2011/10/01 16:00:23 | 000,887,724 | —- | C] () – I:\WINDOWS\System32\ativva6x.dat
[2011/10/01 16:00:23 | 000,239,869 | —- | C] () – I:\WINDOWS\System32\atiicdxx.dat
[2011/10/01 16:00:23 | 000,000,003 | —- | C] () – I:\WINDOWS\System32\ativva5x.dat
[2011/09/30 22:22:22 | 000,002,560 | —- | C] () – I:\Documents and Settings\Michael\Application Data\wnvvocx.stg
[2011/09/30 22:22:22 | 000,001,857 | —- | C] () – I:\Documents and Settings\Michael\Application Data\WnvTool.ini
[2011/09/30 22:22:22 | 000,000,600 | —- | C] () – I:\Documents and Settings\Michael\Application Data\winscp.rnd
[2011/09/30 22:22:22 | 000,000,268 | —- | C] () – I:\Documents and Settings\Michael\Application Data\SupportPrinters
[2011/09/30 22:22:22 | 000,000,268 | —- | C] () – I:\Documents and Settings\Michael\Application Data\Strings
[2011/09/30 22:22:21 | 000,481,559 | —- | C] () – I:\Documents and Settings\Michael\xfx-rebate2010.gif
[2011/09/30 22:22:21 | 000,245,185 | —- | C] () – I:\Documents and Settings\Michael\xfx-rebate2010-2.gif
[2011/09/30 22:22:21 | 000,002,528 | —- | C] () – I:\Documents and Settings\Michael\Application Data\$_hpcst$.hpc
[2011/09/30 22:22:21 | 000,000,126 | —- | C] () – I:\Documents and Settings\Michael\Application Data\default.rss
[2011/09/30 22:18:38 | 000,001,418 | —- | C] () – I:\Documents and Settings\Michael\.jalbum-recent-projects.properties
[2011/09/30 22:18:38 | 000,001,092 | —- | C] () – I:\Documents and Settings\Michael\.jalbum-defaults.jap
[2011/09/30 22:18:38 | 000,001,024 | —- | C] () – I:\Documents and Settings\Michael\.rnd
[2011/09/30 22:18:38 | 000,000,150 | —- | C] () – I:\Documents and Settings\Michael\default.pls
[2011/09/30 22:18:38 | 000,000,038 | —- | C] () – I:\Documents and Settings\Michael\.jalbum-ftp-accounts.xml
[2011/09/30 22:07:20 | 000,010,752 | —- | C] () – I:\Documents and Settings\Michael\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/29 22:05:23 | 000,002,048 | –S- | C] () – I:\WINDOWS\bootstat.dat
[2011/09/29 22:01:31 | 000,022,720 | —- | C] () – I:\WINDOWS\System32\emptyregdb.dat
[2011/09/29 14:51:08 | 000,004,161 | —- | C] () – I:\WINDOWS\ODBCINST.INI
[2011/09/29 14:50:14 | 000,442,920 | —- | C] () – I:\WINDOWS\System32\FNTCACHE.DAT

========== ZeroAccess Check ==========

[2011/10/01 17:10:23 | 000,000,227 | RHS- | M] () – I:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2011/06/21 11:18:34 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = I:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 05:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll
"ThreadingModel" = Both

========== LOP Check ==========

[2012/04/01 15:01:29 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\AVG2012
[2011/09/30 20:43:10 | 000,000,000 | -H-D | M] – I:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/02 18:22:51 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\EPSON
[2012/03/29 11:34:54 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\F4D56250000075AB00013062D151FC4E
[2011/10/02 16:04:16 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\GARMIN
[2013/07/25 10:49:31 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Hero Lab
[2011/12/23 12:22:24 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\InterVideo
[2012/06/17 16:15:35 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Leapfrog
[2012/01/05 10:07:25 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\LightScribe
[2012/04/01 14:50:20 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\MFAData
[2012/12/18 21:07:22 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Nike
[2013/01/12 21:01:06 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Panasonic
[2012/10/22 22:26:29 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2013/08/29 15:57:41 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/12/23 12:19:20 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\Ulead Systems
[2011/10/01 19:47:04 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\ZoneFiveSoftware
[2011/10/01 18:13:44 | 000,000,000 | —D | M] – I:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/09/30 22:28:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\AVG10
[2011/10/02 16:02:06 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\AVG2012
[2011/09/30 22:28:18 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Costco Photo Viewer US
[2011/09/30 22:28:18 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\DDMSettings
[2011/09/30 22:28:16 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\DraftSight
[2011/09/30 22:28:16 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\EPSON
[2013/07/16 19:03:16 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\FileZilla
[2011/09/30 22:28:16 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\FTW
[2011/09/30 22:28:15 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\GARMIN
[2011/09/30 22:27:48 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\JAlbum
[2011/09/30 22:27:46 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Leadertech
[2011/09/30 22:27:31 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\muvee Technologies
[2011/09/30 22:22:50 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Nikon
[2011/09/30 22:22:50 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\OfficeUpdate12
[2011/09/30 22:22:48 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\OpenOffice.org
[2011/09/30 22:22:48 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Opera
[2011/09/30 22:22:48 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\OverlayPlugin
[2011/09/30 22:22:44 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Simple Star
[2011/09/30 22:22:29 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Thunderbird
[2011/12/24 18:30:10 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Ulead Systems
[2011/09/30 22:22:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\WildTangent
[2011/09/30 22:22:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\WinBatch
[2011/09/30 22:22:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Windows Desktop Search
[2011/09/30 22:22:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\Windows Search
[2011/09/30 22:22:22 | 000,000,000 | —D | M] – I:\Documents and Settings\Michael\Application Data\YouTube Downloader

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> I:\Documents and Settings\All Users\Documents\Clone Win2003 LWI 4.0 Lampi Domain:Roxio EMC Stream

< End of report >

Hi and Welcome!! Michael L

My name is Robybel.

I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Having said that….Let's get going!!

_________________________________

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Next

[external image: Posted Image] AdwCleaner

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin…be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button…a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Next

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next

• Download RogueKiller and save it to your desktop.
• Quit all other programs
• Start RogueKiller.exe
• Wait until the Prescan has finished …
• Click on Scan
  [external image: Posted Image]
• Wait for the end of the scan
• A report will be created on your desktop.
• Click on the Delete button
  [external image: Posted Image]
• Next click on the ShortcutsFix
  [external image: Posted Image]
• another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

On your next reply please post :

• checkup.txt
• AdwCleaner[R0].txt
• JRT.txt
• All RKreport.txt

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

I am running the security check program, and a popup appears "AutoIt Error" Line -1: Error: Variable must be of type "Object". I clicked on OK, and it seems to be running with these results:

Results of screen317's Security Check version 0.99.73
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java™ 6 Update 35
Java version out of Date!
Adobe Flash Player 11.8.800.168
Adobe Reader 10.1.8 Adobe Reader out of Date!
Mozilla Firefox (24.0)
Mozilla Thunderbird (17.0.8)
Google Chrome 29.0.1547.66
Google Chrome 29.0.1547.76
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive I:: 16% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````



Here is the AdwCleaner report:


# AdwCleaner v3.005 - Report created 28/09/2013 at 11:19:55
# Updated 22/09/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Michael - DOOFIE
# Running from : I:\Documents and Settings\Michael\My Documents\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

Service Found : DefaultTabUpdate

***** [ Files / Folders ] *****

File Found : I:\Documents and Settings\All Users\Desktop\Open It!.lnk
File Found : I:\Documents and Settings\Kate\Application Data\Mozilla\Firefox\Profiles\f49ytc4h.default\searchplugins\safesearch.xml
File Found : I:\Documents and Settings\Kate\Application Data\Mozilla\Firefox\Profiles\f49ytc4h.default\user.js
File Found : I:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\s03ivxd8.default\Extensions\[removed]
File Found : I:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\s03ivxd8.default\searchplugins\search.xml
File Found : I:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\s03ivxd8.default\user.js
File Found : I:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Found : I:\Program Files\Mozilla Firefox\searchplugins\safesearch.xml
Folder Found : I:\Documents and Settings\Kate\Application Data\Mozilla\Firefox\Profiles\f49ytc4h.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Folder Found : I:\Documents and Settings\Kate\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Folder Found : I:\Documents and Settings\LocalService\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Folder Found : I:\Documents and Settings\Max\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Folder Found I:\Documents and Settings\All Users\Application Data\Tarma Installer
Folder Found I:\Documents and Settings\Christopher\Local Settings\Application Data\AVG Security Toolbar
Folder Found I:\Documents and Settings\Max\Application Data\DefaultTab
Folder Found I:\Documents and Settings\Max\Application Data\DSite
Folder Found I:\Documents and Settings\Max\Application Data\OpenCandy
Folder Found I:\Documents and Settings\Michael\Local Settings\Application Data\AVG Security Toolbar
Folder Found I:\Program Files\DefaultTab
Folder Found I:\Program Files\Ilivid
Folder Found I:\Program Files\openit

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Search Settings
Key Found : HKCU\Software\AVG Security Toolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BF0118D4-63FF-4138-9327-F3028FB1A578}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Found : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser.1
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Found : HKLM\Software\Default Tab
Key Found : HKLM\Software\DefaultTab
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab Chrome
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\OpenIt Open It!
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenIt Open It!
Key Found : HKLM\Software\Tarma Installer
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=242D0018F336A11D&affID=119351&tsp=4951

-\\ Mozilla Firefox v24.0 (en-US)

[ File : I:\Documents and Settings\NetworkService\Application Data\Mozilla\Firefox\Profiles\agp82x3y.default\prefs.js ]


[ File : I:\Documents and Settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\prefs.js ]


[ File : I:\Documents and Settings\Kate\Application Data\Mozilla\Firefox\Profiles\f49ytc4h.default\prefs.js ]


[ File : I:\Documents and Settings\Christopher\Application Data\Mozilla\Firefox\Profiles\1s3cs89p.default\prefs.js ]


[ File : I:\Documents and Settings\Aria\Application Data\Mozilla\Firefox\Profiles\w4nz07h0.default\prefs.js ]


[ File : I:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\s03ivxd8.default\prefs.js ]

Line Found : user_pref("extensions.delta.admin", false);
Line Found : user_pref("extensions.delta.aflt", "babsst");
Line Found : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Line Found : user_pref("extensions.delta.autoRvrt", "false");
Line Found : user_pref("extensions.delta.dfltLng", "en");
Line Found : user_pref("extensions.delta.excTlbr", false);
Line Found : user_pref("extensions.delta.ffxUnstlRst", true);
Line Found : user_pref("extensions.delta.id", "fc56f1920000000000000018f336a11d");
Line Found : user_pref("extensions.delta.instlDay", "15908");
Line Found : user_pref("extensions.delta.instlRef", "sst");
Line Found : user_pref("extensions.delta.newTab", false);
Line Found : user_pref("extensions.delta.prdct", "delta");
Line Found : user_pref("extensions.delta.prtnrId", "delta");
Line Found : user_pref("extensions.delta.rvrt", "false");
Line Found : user_pref("extensions.delta.smplGrp", "none");
Line Found : user_pref("extensions.delta.tlbrId", "base");
Line Found : user_pref("extensions.delta.tlbrSrchUrl", "");
Line Found : user_pref("extensions.delta.vrsn", "[removed]");
Line Found : user_pref("extensions.delta.vrsnTs", "1.8.21.516:31:52");
Line Found : user_pref("extensions.delta.vrsni", "[removed]");
Line Found : user_pref("extensions.delta_i.babExt", "");
Line Found : user_pref("extensions.delta_i.babTrack", "affID=119351&tsp=4951");
Line Found : user_pref("extensions.delta_i.srcExt", "ss");
Line Found : user_pref("extentions.webcake.defaultEnableAppsList", "layers/banner,layers/inline,layers/search,layers/shopping,newOffers/wc");
Line Found : user_pref("extentions.webcake.installId", "a6b21365-cf70-4aff-bfd2-e221bdf83e9f");

-\\ Google Chrome v29.0.1547.76

[ File : I:\Documents and Settings\Michael\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


[ File : I:\Documents and Settings\Kate\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


[ File : I:\Documents and Settings\Max\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [11081 octets] - [28/09/2013 11:19:55]

########## EOF - I:\AdwCleaner\AdwCleaner[R0].txt - [11142 octets] ##########



There were no log files in the adwcleaner folder.

Here is the output of JRT.EXE. Note that Norton considered this tool a risk and removed it before I could run it or even disable Norton from running. I had to download it a second time. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.3 (09.27.2013:1) OS: Microsoft Windows XP x86 Ran by [removed] on Sat 09/28/2013 at 11:43:41.60 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services Successfully stopped: [Service] defaulttabupdate Successfully deleted: [Service] defaulttabupdate ~~~ Registry Values Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-220523388-1715567821-725345543-1003\Software\Microsoft\Internet Explorer\Main\\Start Page Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Search Bar Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Search Page ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\defaulttabbho.defaulttabbrowser Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\defaulttabbho.defaulttabbrowser.1 Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\defaulttabbho.defaulttabbrowseractivex Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\defaulttabbho.defaulttabbrowseractivex.1 Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{38495740-0035-4471-851E-F5BBB86AB085} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{39CB8175-E224-4446-8746-00566302DF8D} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\defaulttabbho.dll Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortapp.dll Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escorteng.dll Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortlbr.dll Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\esrv.exe Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\search settings Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\default tab Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\defaulttab Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\tarma installer Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\applications\ilividsetupv1.exe Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\defaulttab Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\defaulttab chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\openit open it! Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B9020890-9E08-446B-87B0-0C5CD0436D86} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30B87EBD-E91B-498B-B25D-DF116AF00393} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{30B87EBD-E91B-498B-B25D-DF116AF00393} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B9020890-9E08-446B-87B0-0C5CD0436D86} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B9020890-9E08-446B-87B0-0C5CD0436D86} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "I:\Documents and Settings\All Users\application data\tarma installer" Successfully deleted: [Folder] "I:\Program Files\defaulttab" Successfully deleted: [Folder] "I:\Program Files\ilivid" Successfully deleted: [Folder] "I:\Program Files\openit" Successfully deleted: [Folder] "I:\Documents and Settings\All Users\start menu\programs\open it!" ~~~ FireFox Failed to delete: [File] "I:\Program Files\Mozilla Firefox\searchplugins\safesearch.xml" Emptied folder: I:\Documents and Settings\Michael\Application Data\mozilla\firefox\profiles\hspagxlb.default\minidumps [15 files] ~~~ Chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sat 09/28/2013 at 11:49:19.30 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Here are the combofix logs:

ComboFix 13-09-28.02 - Michael 09/28/2013 15:35:59.6.2 - x86
Running from: i:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
i:\documents and settings\All Users\Application Data\E95564235F.sys
i:\documents and settings\Kate\Application Data\3F565D
i:\documents and settings\Kate\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
i:\documents and settings\Max\Application Data\DefaultTab\DefaultTab
i:\documents and settings\Max\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
.
.
((((((((((((((((((((((((( Files Created from 2013-08-28 to 2013-09-28 )))))))))))))))))))))))))))))))
.
.
2013-09-28 18:43 . 2013-09-28 18:43 ——– d—–w- i:\windows\ERUNT
2013-09-28 18:19 . 2013-09-28 18:20 ——– d—–w- I:\AdwCleaner
2013-09-28 14:40 . 2013-09-28 14:40 ——– d—–w- I:\RegBackup
2013-09-28 14:35 . 2013-09-28 14:35 ——– d—–w- i:\program files\Tweaking.com
2013-09-16 23:30 . 2013-09-16 23:30 ——– d—–w- i:\documents and settings\NetworkService\Local Settings\Application Data\Mozilla
2013-09-04 01:44 . 2013-09-04 01:44 ——– d—–w- i:\documents and settings\Aria\Local Settings\Application Data\Panasonic
2013-09-04 01:44 . 2013-09-04 01:44 ——– d—–w- i:\documents and settings\Aria\Local Settings\Application Data\Google
2013-09-03 13:53 . 2013-09-03 13:53 187248 —-a-w- i:\program files\Mozilla Firefox\plugins\nppdf32.dll
2013-09-03 13:53 . 2013-09-03 13:53 187248 —-a-w- i:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2013-08-30 01:30 . 2013-08-30 01:31 ——– d—–w- I:\garbage
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-20 16:10 . 2012-07-15 00:30 692616 —-a-w- i:\windows\system32\FlashPlayerApp.exe
2013-09-20 16:10 . 2011-10-01 23:09 71048 —-a-w- i:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-04 12:14 . 2011-10-02 18:07 2828 –sha-w- i:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2013-08-03 21:18 . 2006-10-19 05:47 1543680 ——w- i:\windows\system32\wmvdecod.dll
2013-07-26 02:47 . 2006-02-28 12:00 920064 —-a-w- i:\windows\system32\wininet.dll
2013-07-26 02:47 . 2006-02-28 12:00 43520 ——w- i:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2006-02-28 12:00 1469440 ——w- i:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2006-02-28 12:00 385024 ——w- i:\windows\system32\html.iec
2013-07-10 10:37 . 2006-02-28 12:00 406016 —-a-w- i:\windows\system32\usp10.dll
2013-07-04 03:03 . 2006-02-28 12:00 2149888 —-a-w- i:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2004-08-03 22:59 2028544 —-a-w- i:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [BU]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [BU]
"SpybotSD TeaTimer"="i:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"LightScribe Control Panel"="i:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="i:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="i:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]
"DivXUpdate"="i:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"APSDaemon"="i:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Monitor"="i:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-11-12 268640]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"Nike+ Connect"="i:\program files\Nike\Nike+ Connect\Nike+ Connect daemon.exe" [2013-05-03 70656]
.
i:\documents and settings\Max\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-2-3 1198592]
.
i:\documents and settings\All Users\Start Menu\Programs\Startup\
Device Monitor 3.lnk - i:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-12-31 542064]
PHOTOfunSTUDIO 6.0.lnk - i:\program files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe -e "i:\program files\Panasonic\PHOTOfunSTUDIO 6.0\PHOTOfunSTUDIO.exe" [2013-1-12 174064]
Windows Search.lnk - i:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "i:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"i:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSOffice 2007\\Office12\\OUTLOOK.EXE"=
"i:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"i:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"i:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"i:\\WINDOWS\\system32\\sessmgr.exe"=
"i:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
"i:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"i:\\Program Files\\FrostWire 5\\FrostWire.exe"=
"i:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"i:\\Documents and Settings\\Kate\\Application Data\\Spotify\\spotify.exe"=
"i:\\Program Files\\Skype\\Phone\\Skype.exe"=
"i:\\Program Files\\Hero Lab\\HeroLab.exe"=
"i:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R2 Skype C2C Service;Skype C2C Service;i:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-08-14 3291008]
R2 SkypeUpdate;Skype Updater;i:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]
R3 ivusb;Initio Driver for USB Default Controller;i:\windows\system32\DRIVERS\ivusb.sys [2010-07-29 25112]
S0 SymDS;Symantec Data Store;i:\windows\system32\drivers\N360\0502020.003\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;i:\windows\system32\drivers\N360\0502020.003\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;i:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130924.001\BHDrvx86.sys [2013-09-24 1097304]
S1 crlscsi;crlscsi; [x]
S1 SymIRON;Symantec Iron Driver;i:\windows\system32\drivers\N360\0502020.003\Ironx86.SYS [2010-11-16 136312]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;i:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-08-23 13672]
S2 N360;Norton Security Suite;i:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe [2011-04-17 130008]
S2 UMVPFSrv;UMVPFSrv;i:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]
S3 EraserUtilDrv11311;EraserUtilDrv11311;i:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11311.sys [2013-08-27 108120]
S3 IDSxpx86;IDSxpx86;i:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130927.001\IDSxpx86.sys [2013-08-14 380832]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - TRUESIGHT
*Deregistered* - aswMBR
*Deregistered* - TrueSight
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
atixsaudio
USB_RNDIS_XP
wintabservice
se59mdfl
cis1284
atkdisplf
aswlsvc
COMMONFX.DLL
tcpipBM
moufiltr
bdss
ldlcserv
nvrd64
imaservice
sskbfd
pctfw1
iaimtv2
s7oppitx
UCTblHid
VAIOMediaPlatform-MusicServer-HTTP
vmusb
pae_avs
VIAPFD
LEX_AS_NIC_SERVICE_YNOS
abnetmon
pptchpad
dlartl_n
eskerlicensecontrol
TMKEmu
{d31a0762-0ceb-444e-acff-b049a1f6fe91}
siswlsvc
db2remotecmd
k750mdfl
yats32
pdfcreatormessages
sis162u
ccs
Pcatip
NvNdis
pca
AffinegyService
agrsrvce
W700mdm
pdscheduler
artourservice
PID_PEPI
DXEC02
rp32service
neokdss
smwdm
ZY202_XP
umpusbxp
LXARScan
windowblinds
dvd_2K
CdaD10BA
bwcsrv
ntcharge
ppmoucls
LMouKE
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN
napagent
hkmsvc
.
Rebuilding … You need to reboot your machine for this to take effect.
.
uploadmgr
TermService
ip6fwhlp
mhn
sacsvr
trksvr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- i:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-21 07:26 1177552 —-a-w- i:\program files\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-28 i:\windows\Tasks\Adobe Flash Player Updater.job
- i:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-15 16:10]
.
2013-09-27 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2013-09-28 i:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- i:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 01:29]
.
2013-09-28 i:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- i:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 01:29]
.
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver; - i:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.2.253
TCP: Interfaces\{8D00E7CB-22FA-4BCC-9896-9EB830DD3762}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - i:\documents and settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;=
FF - ExtSQL: !HIDDEN! 2009-07-01 03:08; {20a82645-c095-46ed-80e3-08825760534b}; i:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
HKCU-Run-H/PC Connection Agent - c:\program files\Microsoft ActiveSync\wcescomm.exe
HKU-Default-RunOnce-FlashPlayerUpdate - i:\windows\system32\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe
i:\documents and settings\Aria\Start Menu\Programs\Startup\PinMcLnk.lnk - c:\hp\bin\cloaker.exe c:\hp\bin\PinMcLnkToStart.bat
i:\documents and settings\Christopher\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk - i:\program files\OpenOffice.org 3\program\quickstart.exe
i:\documents and settings\Christopher\Start Menu\Programs\Startup\PinMcLnk.lnk - c:\hp\bin\cloaker.exe c:\hp\bin\PinMcLnkToStart.bat
i:\documents and settings\Max\Start Menu\Programs\Startup\PinMcLnk.lnk - c:\hp\bin\cloaker.exe c:\hp\bin\PinMcLnkToStart.bat
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-28 15:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"i:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe\" /s \"N360\" /m \"i:\program files\Norton Security Suite\Engine\5.2.2.3\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,2e,4a,3c,50,f7,b6,45,8a,0a,7f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,2e,4a,3c,50,f7,b6,45,8a,0a,7f,\
.
[HKEY_USERS\S-1-5-21-220523388-1715567821-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@i:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="i:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(716)
i:\windows\system32\Ati2evxx.dll
i:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'winlogon.exe'(2932)
i:\windows\system32\Ati2evxx.dll
i:\windows\system32\atiadlxx.dll
.
Completion time: 2013-09-28 15:44:07
ComboFix-quarantined-files.txt 2013-09-28 22:44
ComboFix2.txt 2012-04-01 21:24
ComboFix3.txt 2012-03-31 16:50
.
Pre-Run: 10,292,633,600 bytes free
Post-Run: 11,899,052,032 bytes free
.
- - End Of File - - 3D2F5B28911F009A3D45CC555E073C9A
8F558EB6672622401DA993E1E865C861

ComboFix 13-09-28.02 - Michael 09/29/2013 16:10:07.7.2 - x86
Running from: i:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Michael\My Documents\CFScript.txt
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2013-08-28 to 2013-09-29 )))))))))))))))))))))))))))))))
.
.
2013-09-28 18:43 . 2013-09-28 18:43 ——– d—–w- i:\windows\ERUNT
2013-09-28 18:19 . 2013-09-28 18:20 ——– d—–w- I:\AdwCleaner
2013-09-28 14:40 . 2013-09-28 14:40 ——– d—–w- I:\RegBackup
2013-09-28 14:35 . 2013-09-28 14:35 ——– d—–w- i:\program files\Tweaking.com
2013-09-16 23:30 . 2013-09-16 23:30 ——– d—–w- i:\documents and settings\NetworkService\Local Settings\Application Data\Mozilla
2013-09-04 01:44 . 2013-09-04 01:44 ——– d—–w- i:\documents and settings\Aria\Local Settings\Application Data\Panasonic
2013-09-04 01:44 . 2013-09-04 01:44 ——– d—–w- i:\documents and settings\Aria\Local Settings\Application Data\Google
2013-09-03 13:53 . 2013-09-03 13:53 187248 —-a-w- i:\program files\Mozilla Firefox\plugins\nppdf32.dll
2013-09-03 13:53 . 2013-09-03 13:53 187248 —-a-w- i:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-20 16:10 . 2012-07-15 00:30 692616 —-a-w- i:\windows\system32\FlashPlayerApp.exe
2013-09-20 16:10 . 2011-10-01 23:09 71048 —-a-w- i:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-04 12:14 . 2011-10-02 18:07 2828 –sha-w- i:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2013-08-03 21:18 . 2006-10-19 05:47 1543680 ——w- i:\windows\system32\wmvdecod.dll
2013-07-26 02:47 . 2006-02-28 12:00 920064 —-a-w- i:\windows\system32\wininet.dll
2013-07-26 02:47 . 2006-02-28 12:00 43520 ——w- i:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2006-02-28 12:00 1469440 ——w- i:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2006-02-28 12:00 385024 ——w- i:\windows\system32\html.iec
2013-07-10 10:37 . 2006-02-28 12:00 406016 —-a-w- i:\windows\system32\usp10.dll
2013-07-04 03:03 . 2006-02-28 12:00 2149888 —-a-w- i:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2004-08-03 22:59 2028544 —-a-w- i:\windows\system32\ntkrnlpa.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-27 23:11 579024 —-a-w- i:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [BU]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [BU]
"SpybotSD TeaTimer"="i:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"LightScribe Control Panel"="i:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"Skype"="i:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="i:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]
"DivXUpdate"="i:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888]
"APSDaemon"="i:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Monitor"="i:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2011-11-12 268640]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"Nike+ Connect"="i:\program files\Nike\Nike+ Connect\Nike+ Connect daemon.exe" [2013-05-03 70656]
.
i:\documents and settings\Max\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-2-3 1198592]
.
i:\documents and settings\All Users\Start Menu\Programs\Startup\
Device Monitor 3.lnk - i:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-12-31 542064]
PHOTOfunSTUDIO 6.0.lnk - i:\program files\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe -e "i:\program files\Panasonic\PHOTOfunSTUDIO 6.0\PHOTOfunSTUDIO.exe" [2013-1-12 174064]
Windows Search.lnk - i:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "i:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"i:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSOffice 2007\\Office12\\OUTLOOK.EXE"=
"i:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"i:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"i:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"i:\\WINDOWS\\system32\\sessmgr.exe"=
"i:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
"i:\\Program Files\\LeapFrog\\LeapFrog Connect\\LeapFrogConnect.exe"=
"i:\\Program Files\\FrostWire 5\\FrostWire.exe"=
"i:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"i:\\Documents and Settings\\Kate\\Application Data\\Spotify\\spotify.exe"=
"i:\\Program Files\\Skype\\Phone\\Skype.exe"=
"i:\\Program Files\\Hero Lab\\HeroLab.exe"=
"i:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R2 Skype C2C Service;Skype C2C Service;i:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-08-14 3291008]
R2 SkypeUpdate;Skype Updater;i:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]
R3 ivusb;Initio Driver for USB Default Controller;i:\windows\system32\DRIVERS\ivusb.sys [2010-07-29 25112]
S0 SymDS;Symantec Data Store;i:\windows\system32\drivers\N360\0502020.003\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;i:\windows\system32\drivers\N360\0502020.003\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;i:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20130924.001\BHDrvx86.sys [2013-09-24 1097304]
S1 crlscsi;crlscsi; [x]
S1 SymIRON;Symantec Iron Driver;i:\windows\system32\drivers\N360\0502020.003\Ironx86.SYS [2010-11-16 136312]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;i:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-08-23 13672]
S2 N360;Norton Security Suite;i:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe [2011-04-17 130008]
S2 UMVPFSrv;UMVPFSrv;i:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]
S3 EraserUtilDrv11311;EraserUtilDrv11311;i:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11311.sys [2013-08-27 108120]
S3 IDSxpx86;IDSxpx86;i:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20130927.001\IDSxpx86.sys [2013-08-14 380832]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - TRUESIGHT
*Deregistered* - aswMBR
*Deregistered* - TrueSight
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
atixsaudio
USB_RNDIS_XP
wintabservice
se59mdfl
cis1284
atkdisplf
aswlsvc
COMMONFX.DLL
tcpipBM
moufiltr
bdss
ldlcserv
nvrd64
imaservice
sskbfd
pctfw1
iaimtv2
s7oppitx
UCTblHid
VAIOMediaPlatform-MusicServer-HTTP
vmusb
pae_avs
VIAPFD
LEX_AS_NIC_SERVICE_YNOS
abnetmon
pptchpad
dlartl_n
eskerlicensecontrol
TMKEmu
{d31a0762-0ceb-444e-acff-b049a1f6fe91}
siswlsvc
db2remotecmd
k750mdfl
yats32
pdfcreatormessages
sis162u
ccs
Pcatip
NvNdis
pca
AffinegyService
agrsrvce
W700mdm
pdscheduler
artourservice
PID_PEPI
DXEC02
rp32service
neokdss
smwdm
ZY202_XP
umpusbxp
LXARScan
windowblinds
dvd_2K
CdaD10BA
bwcsrv
ntcharge
ppmoucls
LMouKE
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN
napagent
hkmsvc
uploadmgr
TermService
ip6fwhlp
mhn
sacsvr
trksvr
.
Rebuilding … You need to reboot your machine for this to take effect.
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 —-a-w- i:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-21 07:26 1177552 —-a-w- i:\program files\Google\Chrome\Application\29.0.1547.76\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-29 i:\windows\Tasks\Adobe Flash Player Updater.job
- i:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-15 16:10]
.
2013-09-27 i:\windows\Tasks\AppleSoftwareUpdate.job
- i:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2013-09-29 i:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- i:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 01:29]
.
2013-09-29 i:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- i:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 01:29]
.
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver; - i:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.2.253
TCP: Interfaces\{8D00E7CB-22FA-4BCC-9896-9EB830DD3762}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - i:\documents and settings\Michael\Application Data\Mozilla\Firefox\Profiles\hspagxlb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;=
FF - ExtSQL: !HIDDEN! 2009-07-01 03:08; {20a82645-c095-46ed-80e3-08825760534b}; i:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-29 16:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"i:\program files\Norton Security Suite\Engine\5.2.2.3\ccSvcHst.exe\" /s \"N360\" /m \"i:\program files\Norton Security Suite\Engine\5.2.2.3\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,2e,4a,3c,50,f7,b6,45,8a,0a,7f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8b,2e,4a,3c,50,f7,b6,45,8a,0a,7f,\
.
[HKEY_USERS\S-1-5-21-220523388-1715567821-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@i:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="i:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(716)
i:\windows\system32\Ati2evxx.dll
i:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'winlogon.exe'(2932)
i:\windows\system32\Ati2evxx.dll
i:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(4108)
i:\windows\system32\WININET.dll
i:\program files\Google\Drive\googledrivesync32.dll
i:\program files\Windows Desktop Search\deskbar.dll
i:\program files\Windows Desktop Search\en-us\dbres.dll.mui
i:\program files\Windows Desktop Search\dbres.dll
i:\program files\Windows Desktop Search\wordwheel.dll
i:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
i:\program files\Windows Desktop Search\msnlExtRes.dll
i:\windows\system32\ieframe.dll
i:\windows\system32\webcheck.dll
i:\windows\system32\WPDShServiceObj.dll
i:\windows\system32\PortableDeviceTypes.dll
i:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-09-29 16:19:36
ComboFix-quarantined-files.txt 2013-09-29 23:19
ComboFix2.txt 2013-09-28 22:44
ComboFix3.txt 2012-04-01 21:24
ComboFix4.txt 2012-03-31 16:50
.
Pre-Run: 11,933,130,752 bytes free
Post-Run: 12,025,069,568 bytes free
.
- - End Of File - - FF22C66B4D9DB350187AD4A71B7F4F7F
8F558EB6672622401DA993E1E865C861