Spyware / Malware / Virus Removal

Think Im Infected HELP [Closed]

4 min read

Looking for the outcome? Ask AI

Mainsy1690 Topic Starter

Post #1October 29, 2013, 9:40 AM UTC last edited October 29, 2013, 11:41 AM UTC

EDIT by paws: Topic moved from Windows forum:

Hello I fixed my computer not so long ago from Trojans now I think they have came back I am getting warnings

L logfile created on: 29/10/2013 09:24:35 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

5.91 Gb Total Physical Memory | 4.31 Gb Available Physical Memory | 72.91% Memory free
11.83 Gb Paging File | 10.22 Gb Available in Paging File | 86.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 440.59 Gb Total Space | 337.01 Gb Free Space | 76.49% Space Free | Partition Type: NTFS

Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found –
PRC - [2013/10/07 15:01:54 | 000,313,856 | —- | M] (g10 Code GmbH) – C:\Program Files (x86)\GNU\GnuPG\gpg-agent.exe
PRC - [2013/10/07 14:54:10 | 000,218,112 | —- | M] () – C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
PRC - [2013/09/15 13:34:06 | 000,059,720 | —- | M] (Apple Inc.) – C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
PRC - [2013/09/03 21:17:22 | 000,832,360 | —- | M] (Spigot, Inc.) – C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.exe
PRC - [2013/06/26 18:21:50 | 000,207,528 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2013/06/26 18:21:46 | 000,523,944 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2013/05/21 04:44:22 | 000,144,368 | R— | M] (Symantec Corporation) – C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe
PRC - [2013/05/10 07:57:22 | 000,065,640 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/03/21 04:33:38 | 000,806,784 | —- | M] (Adobe Systems Incorporated) – C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2011/06/08 16:41:42 | 000,118,784 | —- | M] (Lenovo) – C:\Windows\jmesoft\hotkey.exe
PRC - [2011/05/17 21:54:44 | 000,024,576 | —- | M] () – C:\Windows\jmesoft\JME_LOAD.exe
PRC - [2011/03/16 04:47:40 | 000,032,768 | —- | M] () – C:\Windows\jmesoft\Service.exe
PRC - [2011/01/29 07:29:36 | 000,136,488 | —- | M] (CyberLink) – C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
PRC - [2010/08/27 08:32:50 | 004,577,760 | —- | M] () – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe
PRC - [2010/08/19 14:25:00 | 000,272,864 | —- | M] () – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe
PRC - [2009/12/05 00:59:28 | 000,103,720 | —- | M] (CyberLink) – C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe

========== Modules (No Company Name) ==========

MOD - [2013/10/07 14:49:56 | 000,628,224 | —- | M] () – C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
MOD - [2013/10/07 14:49:04 | 000,069,632 | —- | M] () – C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
MOD - [2013/10/07 14:47:08 | 000,037,888 | —- | M] () – C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
MOD - [2013/10/07 14:44:20 | 000,050,176 | —- | M] () – C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
MOD - [2013/09/14 00:51:02 | 000,087,952 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
MOD - [2013/09/14 00:50:36 | 001,242,952 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
MOD - [2012/05/30 14:51:08 | 000,699,280 | R— | M] () – C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll
MOD - [2012/02/20 20:29:04 | 000,087,912 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 20:28:42 | 001,242,472 | —- | M] () – C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/08/27 08:32:50 | 004,577,760 | —- | M] () – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe
MOD - [2010/07/08 10:24:42 | 000,258,048 | —- | M] () – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvcLib.dll
MOD - [2009/12/05 01:04:32 | 000,013,096 | —- | M] () – C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
MOD - [2009/12/05 00:59:54 | 000,619,816 | —- | M] () – C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll

========== Services (SafeList) ==========

SRV:64bit: - [2013/09/17 15:23:46 | 001,471,352 | —- | M] (Flexera Software LLC) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe – (FlexNet Licensing Service 64)
SRV:64bit: - [2013/05/27 05:50:47 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2010/10/25 16:42:10 | 000,164,008 | —- | M] (Intel Corporation) [Auto | Running] – C:\Windows\SysNative\IPROSetMonitor.exe – (Intel®
SRV:64bit: - [2010/09/23 02:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV - [2013/10/09 17:57:42 | 000,257,416 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/10/07 14:54:10 | 000,218,112 | —- | M] () [Auto | Running] – C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe – (DirMngr)
SRV - [2013/10/01 10:00:28 | 000,118,680 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/06/26 18:21:50 | 000,207,528 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe – (sftvsa)
SRV - [2013/06/26 18:21:46 | 000,523,944 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe – (sftlist)
SRV - [2013/05/21 04:44:22 | 000,144,368 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe – (NIS)
SRV - [2013/05/10 07:57:22 | 000,065,640 | —- | M] (Adobe Systems Incorporated) [Auto | Running] – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe – (AdobeARMservice)
SRV - [2011/03/16 04:47:40 | 000,032,768 | —- | M] () [Auto | Running] – C:\Windows\jmesoft\Service.exe – (JME Keyboard)
SRV - [2010/08/19 14:25:00 | 000,272,864 | —- | M] () [Auto | Running] – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe – (WSWNDA3100)
SRV - [2010/03/18 12:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 12:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2009/06/10 21:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys – (esgiguard)
DRV:64bit: - [2013/06/26 18:21:50 | 000,023,208 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftvollh.sys – (Sftvol)
DRV:64bit: - [2013/06/26 18:21:48 | 000,028,840 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftredirlh.sys – (Sftredir)
DRV:64bit: - [2013/06/26 18:21:46 | 000,273,576 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftplaylh.sys – (Sftplay)
DRV:64bit: - [2013/06/26 18:21:44 | 000,767,144 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Sftfslh.sys – (Sftfs)
DRV:64bit: - [2013/06/18 16:51:48 | 000,177,312 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS – (SymEvent)
DRV:64bit: - [2013/05/23 05:25:28 | 001,139,800 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\symefa64.sys – (SymEFA)
DRV:64bit: - [2013/05/21 05:02:00 | 000,493,656 | —- | M] (Symantec Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\symds64.sys – (SymDS)
DRV:64bit: - [2013/05/16 05:02:14 | 000,796,760 | —- | M] (Symantec Corporation) [File_System | System | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\srtsp64.sys – (SRTSP)
DRV:64bit: - [2013/04/25 00:43:56 | 000,433,752 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\symnets.sys – (SymNetS)
DRV:64bit: - [2013/04/24 19:28:08 | 000,042,184 | —- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\taphss6.sys – (taphss6)
DRV:64bit: - [2013/04/16 02:41:14 | 000,169,048 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\ccsetx64.sys – (ccSet_NIS)
DRV:64bit: - [2013/03/05 01:40:08 | 000,224,416 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\ironx64.sys – (SymIRON)
DRV:64bit: - [2013/03/05 01:21:35 | 000,036,952 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\NISx64\1404000.028\srtspx64.sys – (SRTSPX)
DRV:64bit: - [2012/12/13 13:50:36 | 000,054,784 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2012/04/06 18:15:10 | 000,038,632 | —- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\taphss.sys – (taphss)
DRV:64bit: - [2012/03/01 06:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/01/27 20:58:23 | 000,057,952 | —- | M] (Lenovo) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fbfmon.sys – (fbfmon)
DRV:64bit: - [2012/01/27 20:58:23 | 000,013,408 | —- | M] (Lenovo) [Kernel | System | Running] – C:\Windows\SysNative\drivers\BPntDrv.sys – (BPntDrv)
DRV:64bit: - [2011/12/15 17:29:42 | 000,031,232 | —- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\tap0901.sys – (tap0901)
DRV:64bit: - [2011/07/26 08:22:48 | 012,288,480 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2011/03/28 01:52:09 | 000,243,456 | —- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\vmc412.sys – (VMC412)
DRV:64bit: - [2011/03/11 06:41:12 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/03/11 06:41:12 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/01/29 07:29:58 | 000,031,088 | —- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\clwvd.sys – (clwvd)
DRV:64bit: - [2010/12/28 02:57:42 | 000,056,912 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\EloMTUsb.sys – (EloMTUsb)
DRV:64bit: - [2010/11/21 03:24:33 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/21 03:23:47 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/21 03:23:47 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/10/29 09:19:20 | 000,326,760 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\RtsPStor.sys – (RSPCIESTOR)
DRV:64bit: - [2010/10/27 23:42:32 | 000,315,568 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\e1c62x64.sys – (e1cexpress)
DRV:64bit: - [2010/08/19 21:51:44 | 002,366,464 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2010/08/09 10:23:12 | 001,444,736 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Yatinavrr.SYS – (ATIAVPCI)
DRV:64bit: - [2010/07/14 01:57:08 | 000,069,736 | —- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\itecir.sys – (itecir)
DRV:64bit: - [2010/02/03 10:20:32 | 000,047,632 | —- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\npf.sys – (NPF)
DRV:64bit: - [2009/11/06 07:40:26 | 000,838,136 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\bcmwlhigh664.sys – (BCMH43XX)
DRV:64bit: - [2009/07/21 22:20:06 | 000,121,840 | —- | M] (CyberLink) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wsvd.sys – (wsvd)
DRV:64bit: - [2009/07/14 01:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 01:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 01:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 21:59:33 | 005,020,672 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2009/06/10 20:35:33 | 000,389,120 | —- | M] (Marvell) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\yk62x64.sys – (yukonw7)
DRV:64bit: - [2009/06/10 20:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 20:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 20:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 20:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2008/04/08 14:43:04 | 000,020,832 | —- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ddcdrv.sys – (WinI2C-DDC)
DRV:64bit: - [2007/01/19 17:24:24 | 000,025,312 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | Disabled | Stopped] – C:\Windows\SysNative\drivers\SCMNdisP.sys – (SCMNdisP)
DRV - [2013/10/28 20:21:31 | 000,521,816 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\IPSDefs\20131025.002\IDSviA64.sys – (IDSVia64)
DRV - [2013/10/22 23:11:13 | 001,524,824 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20131022.001\BHDrvx64.sys – (BHDrvx64)
DRV - [2013/09/27 09:36:26 | 002,099,288 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20131028.003\ex64.sys – (NAVEX15)
DRV - [2013/09/27 09:36:26 | 000,126,040 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20131028.003\eng64.sys – (NAVENG)
DRV - [2013/08/27 07:14:40 | 000,484,952 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys – (eeCtrl)
DRV - [2013/08/27 07:14:40 | 000,140,376 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/03/23 02:13:08 | 000,015,712 | —- | M] (Nicomsoft Ltd.) [Kernel | Boot | Running] – C:\Windows\SysWOW64\drivers\ddcdrv.sys – (WinI2C-DDC)
DRV - [2009/07/14 01:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7XXXX

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,DefaultNetworkProfile = 1462632
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com?type=714647&fr=spigot-yhp-ie
IE - HKCU\..\SearchScopes,DefaultScope = {793EEF25-E45F-4209-BF8D-A83718688ADE}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…1I7DSGQ_enGB488
IE - HKCU\..\SearchScopes\{793EEF25-E45F-4209-BF8D-A83718688ADE}: "URL" = http://uk.search.yahoo.com/search?fr=chr-g…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=714647"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "https://www.google.co.uk/"
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:12.0.3.2%20-%201
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p="
FF - prefs.js..network.proxy.socks: "117.121.237.218:8082"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\coFFPlgn\ [2013/10/29 07:45:52 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\IPSFF [2013/10/09 18:23:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/06/16 17:01:39 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Extensions
[2013/09/11 16:49:58 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2013/09/27 16:26:18 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\dj4fvqfn.default\extensions
[2013/09/27 16:26:17 | 000,700,980 | —- | M] () (No name found) – C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\dj4fvqfn.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
[2013/09/11 17:27:15 | 000,000,921 | —- | M] () – C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\dj4fvqfn.default\searchplugins\yahoo.xml
[2013/10/01 10:00:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/10/01 10:00:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/10/01 10:00:28 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/10/09 18:23:39 | 000,000,000 | —D | M] (Norton Vulnerability Protection) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\IPSFF

O1 HOSTS File: ([2013/08/24 00:03:12 | 000,000,021 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EloConfigDlg] C:\Program Files\Elo TouchSystems\EloConfig.exe (Tyco Electronics)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCEPServiceManager] C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [jmekey] C:\Windows\jmesoft\hotkey.exe (Lenovo)
O4 - HKLM..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe ()
O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\RunLDBS.exe (TODO: <公司名>)
O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [SearchProtection] C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.EXE (Spigot, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{99ABC1C1-2564-43BA-8A43-BCDDAA8CE327}: DhcpNameServer = 192.168.1.254 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/08/15 15:53:21 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{b93333e7-b7f0-11e1-bdb0-0025ab128718}\Shell - "" = AutoRun
O33 - MountPoints2\{b93333e7-b7f0-11e1-bdb0-0025ab128718}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/10/29 09:22:29 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2013/10/29 08:55:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\GNU
[2013/10/24 15:26:33 | 000,000,000 | —D | C] – C:\ProgramData\Oracle
[2013/10/24 15:23:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/10/24 15:23:46 | 000,264,616 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\javaws.exe
[2013/10/24 15:23:42 | 000,175,016 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\javaw.exe
[2013/10/24 15:23:42 | 000,174,504 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\java.exe
[2013/10/24 15:23:42 | 000,096,168 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\WindowsAccessBridge-32.dll
[2013/10/24 15:23:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/10/13 11:17:14 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/10/13 11:16:37 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013/10/13 11:16:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2013/10/13 11:16:37 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013/10/13 11:16:37 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013/10/13 11:13:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2013/10/09 18:11:55 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/10/09 18:11:55 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/10/09 18:11:54 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/10/09 18:11:54 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/10/09 18:11:54 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/10/09 18:11:54 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/10/09 18:11:54 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/10/09 18:11:54 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/10/09 18:11:54 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/10/09 18:11:54 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/10/09 18:11:54 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/10/09 18:11:53 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/10/09 18:11:52 | 003,959,296 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/10/09 18:11:52 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/10/09 18:11:52 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/10/09 12:32:16 | 000,633,856 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\comctl32.dll
[2013/10/09 12:32:08 | 000,368,128 | —- | C] (Adobe Systems Incorporated) – C:\windows\SysNative\atmfd.dll
[2013/10/09 12:32:08 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\windows\SysWow64\atmfd.dll
[2013/10/09 12:32:08 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\fontsub.dll
[2013/10/09 12:32:08 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\fontsub.dll
[2013/10/09 12:32:08 | 000,046,080 | —- | C] (Adobe Systems) – C:\windows\SysNative\atmlib.dll
[2013/10/09 12:32:08 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\lpk.dll
[2013/10/09 12:32:08 | 000,034,304 | —- | C] (Adobe Systems) – C:\windows\SysWow64\atmlib.dll
[2013/10/09 12:32:08 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dciman32.dll
[2013/10/09 12:31:57 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\hidclass.sys
[2013/10/09 12:31:57 | 000,032,896 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\hidparse.sys
[2013/10/09 12:31:53 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\davclnt.dll
[2013/10/09 12:31:40 | 005,549,504 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntoskrnl.exe
[2013/10/09 12:31:40 | 003,969,472 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntkrnlpa.exe
[2013/10/09 12:31:40 | 003,914,176 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntoskrnl.exe
[2013/10/09 12:31:40 | 001,732,032 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntdll.dll
[2013/10/09 12:31:40 | 000,878,080 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\advapi32.dll
[2013/10/09 12:31:40 | 000,859,648 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\tdh.dll
[2013/10/09 12:31:40 | 000,619,520 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\tdh.dll
[2013/10/09 12:31:39 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wow64.dll
[2013/10/09 12:31:39 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\setup16.exe
[2013/10/09 12:31:39 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntvdm64.dll
[2013/10/09 12:31:39 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\instnm.exe
[2013/10/09 12:31:39 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wow32.dll
[2013/10/09 12:31:39 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\user.exe
[2013/10/09 12:31:24 | 000,124,112 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\PresentationCFFRasterizerNative_v0300.dll
[2013/10/09 12:31:24 | 000,102,608 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
[2013/10/09 12:31:16 | 000,461,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\scavengeui.dll
[2013/10/09 12:31:14 | 000,325,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\usbport.sys
[2013/10/09 12:31:14 | 000,007,808 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\usbd.sys
[2013/10/01 10:00:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Firefox
[2013/09/30 20:56:24 | 000,626,688 | —- | C] (On2.com) – C:\windows\SysWow64\vp7vfw.dll
[2013/09/30 20:56:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VSO
[2013/09/30 20:56:23 | 001,184,984 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wvc1dmod.dll
[2013/01/28 15:40:13 | 000,082,816 | —- | C] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[1 C:\Users\User\Documents\*.tmp files -> C:\Users\User\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/10/29 09:22:29 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2013/10/29 09:22:00 | 000,000,912 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/10/29 09:01:45 | 000,000,732 | —- | M] () – C:\Users\User\AppData\Local\recently-used.xbel
[2013/10/29 09:00:17 | 000,006,045 | —- | M] () – C:\Users\User\Desktop\secret-key-CDA57B98.asc
[2013/10/29 08:57:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/10/29 08:55:19 | 000,001,117 | —- | M] () – C:\Users\Public\Desktop\GPA.lnk
[2013/10/29 08:55:13 | 000,000,022 | —- | M] () – C:\windows\S.dirmngr
[2013/10/29 07:52:45 | 000,020,688 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/10/29 07:52:45 | 000,020,688 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/10/29 07:51:19 | 000,780,196 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2013/10/29 07:51:19 | 000,665,000 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2013/10/29 07:51:19 | 000,125,478 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2013/10/29 07:45:47 | 000,153,675 | —- | M] () – C:\windows\SysNative\fastboot.set
[2013/10/29 07:45:23 | 000,000,908 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/10/29 07:45:13 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/10/29 07:45:07 | 468,008,959 | -HS- | M] () – C:\hiberfil.sys
[2013/10/14 20:34:39 | 000,000,017 | —- | M] () – C:\windows\SysWow64\shortcut_ex.dat
[2013/10/13 11:17:14 | 000,001,783 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2013/10/09 18:23:08 | 005,074,560 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2013/10/09 18:10:11 | 000,765,664 | —- | M] () – C:\windows\SysWow64\PerfStringBackup.INI
[2013/10/09 17:57:40 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerApp.exe
[2013/10/09 17:57:40 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/10/08 06:50:37 | 000,096,168 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\WindowsAccessBridge-32.dll
[2013/10/08 06:46:52 | 000,264,616 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\javaws.exe
[2013/10/08 06:46:47 | 000,175,016 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\javaw.exe
[2013/10/08 06:46:23 | 000,174,504 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\java.exe
[2013/09/30 20:56:27 | 000,099,384 | —- | M] () – C:\Users\User\AppData\Roaming\inst.exe
[2013/09/30 20:56:27 | 000,082,816 | —- | M] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[2013/09/30 20:56:27 | 000,007,859 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2013/09/30 20:56:27 | 000,001,167 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2013/09/30 20:56:26 | 000,001,224 | —- | M] () – C:\Users\User\Desktop\ConvertXtoDVD 5.lnk
[1 C:\Users\User\Documents\*.tmp files -> C:\Users\User\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/10/29 09:01:45 | 000,000,732 | —- | C] () – C:\Users\User\AppData\Local\recently-used.xbel
[2013/10/29 09:00:17 | 000,006,045 | —- | C] () – C:\Users\User\Desktop\secret-key-CDA57B98.asc
[2013/10/29 08:55:16 | 000,001,117 | —- | C] () – C:\Users\Public\Desktop\GPA.lnk
[2013/10/29 08:55:13 | 000,000,022 | —- | C] () – C:\windows\S.dirmngr
[2013/10/14 20:34:39 | 000,000,017 | —- | C] () – C:\windows\SysWow64\shortcut_ex.dat
[2013/10/13 11:17:14 | 000,001,783 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2013/09/30 20:56:27 | 000,099,384 | —- | C] () – C:\Users\User\AppData\Roaming\inst.exe
[2013/09/30 20:56:25 | 000,001,224 | —- | C] () – C:\Users\User\Desktop\ConvertXtoDVD 5.lnk
[2013/09/17 15:24:39 | 000,000,153 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2013/04/16 12:58:34 | 000,000,064 | —- | C] () – C:\windows\GPlrLanc.dat
[2013/01/28 15:40:13 | 000,007,859 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2013/01/28 15:40:13 | 000,001,167 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2012/07/24 10:24:36 | 000,000,000 | —- | C] () – C:\windows\SysWow64\cd.dat
[2012/07/19 16:11:28 | 000,053,299 | —- | C] () – C:\windows\SysWow64\pthreadVC.dll
[2012/06/30 16:09:17 | 000,000,000 | —- | C] () – C:\windows\PowerReg.dat
[2012/06/22 12:49:43 | 000,765,664 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2012/06/21 17:45:59 | 000,000,190 | —- | C] () – C:\windows\ODBCINST.INI
[2012/06/17 16:30:07 | 000,000,530 | —- | C] () – C:\windows\eReg.dat
[2012/01/27 20:09:24 | 000,201,728 | —- | C] () – C:\windows\SetDrive.exe
[2012/01/27 20:09:23 | 000,036,864 | —- | C] () – C:\windows\WinWait.exe
[2011/11/29 15:38:12 | 000,974,848 | —- | C] () – C:\windows\SysWow64\cis-2.4.dll
[2011/11/29 15:38:12 | 000,081,920 | —- | C] () – C:\windows\SysWow64\issacapi_bs-2.3.dll
[2011/11/29 15:38:12 | 000,065,536 | —- | C] () – C:\windows\SysWow64\issacapi_pe-2.3.dll
[2011/11/29 15:38:12 | 000,057,344 | —- | C] () – C:\windows\SysWow64\issacapi_se-2.3.dll

========== ZeroAccess Check ==========

[2009/07/14 04:55:00 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/07/26 02:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/26 01:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 01:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 03:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 01:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

HijackThis

MSIE: Internet Explorer v10.0 (10.00.9200.16720)
Boot mode: Normal

Running processes:
C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.exe
C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\GNU\GnuPG\gpg-agent.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\User\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com?type=714647&fr=spigot-yhp-ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe 1
O4 - HKLM\..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\RunLDBS.exe 1
O4 - HKLM\..\Run: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
O4 - HKLM\..\Run: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCEPServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SearchProtection] "C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.EXE" /autostart
O4 - Global Startup: NETGEAR WNDA3100v2 Smart Wizard.lnk = ?
O4 - Global Startup: SRS Premium Sound.lnk = C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DirMngr - Unknown owner - C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: FlexNet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: WSWNDA3100 - Unknown owner - C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe

–
End of file - 10789 bytes

Jo*

Post #2October 29, 2013, 11:57 AM UTC

Hello Mainsy1690,

my name is Jo and I will help you with your computer problems.

Please be advised that I am currently in training, so my responses will need to be approved by one of our experts before I post them. This is only to ensure you are receiving accurate instructions. It may cause a delay in my replies.

Please follow these guidelines:

Logs can take a while to research, so please be patient.
Read and follow the instructions in the sequence they are posted.
print or copy & save instructions.
Do not install / uninstall any applications, unless otherwise instructed.
Use only that tools you have been instructed to use.
Copy and Paste the log files inside your post, unless otherwise instructed.
Ask for clarification, if you have any questions.
Stay with this topic ‘til you get the “all clean” post.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

I will return as soon as possible with more instructions.

Hello I fixed my computer not so long ago from Trojans now I think they have came back I am getting warnings

Which warnings do you get?

Jo*

Post #3October 29, 2013, 11:07 PM UTC

Hello Mainsy1690,

I fixed my computer not so long ago from Trojans now I think they have came back I am getting warnings

Which warnings do you get?

***

1. Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

3. Please download Malwarebytes Anti-Rootkit and save it to your desktop.

Be sure to print out and follow the instructions provided on that same page.
Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
Scan your system for malware
If malware is found - do not press the Clean up button, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.

If there is no malware found, please let me know as well.

***

Jo*

Post #4November 1, 2013, 5:28 PM UTC

Hi,

it has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you are having problems and still need help.

Note: Threads will be closed if no response after 3 days.

Mainsy1690

Post #5November 1, 2013, 9:19 PM UTC

Hello sorry for the late reply, when I try to open security check my norton does not trust it

Jo*

Post #6November 2, 2013, 8:00 AM UTC

Hello Mainsy1690,

Security Checkis a specialized tool and doesn't contain the signatures of a commercially available product.
That is why norton is complaining, but the tool is safe to use.

Please disable Norton:
How to Disable your Security Programs, Antivirus/Firewalls/AntiMalware Programs

Download and run the tool…

Then Enable your Security Programs again!

Mainsy1690

Post #7November 2, 2013, 9:15 AM UTC

Results of screen317's Security Check version 0.99.76
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
JavaFX 2.1.1
Java 7 Update 45
Adobe Flash Player 11.9.900.117
Adobe Reader 10.1.8 Adobe Reader out of Date!
Mozilla Firefox (24.0)
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

Mainsy1690

Post #8November 2, 2013, 9:21 AM UTC

OTL logfile created on: 02/11/2013 09:15:41 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\User\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16721)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

5.91 Gb Total Physical Memory | 4.41 Gb Available Physical Memory | 74.48% Memory free
11.83 Gb Paging File | 10.27 Gb Available in Paging File | 86.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 440.59 Gb Total Space | 338.46 Gb Free Space | 76.82% Space Free | Partition Type: NTFS

Computer Name: USER-PC | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\User\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe ()
PRC - C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.exe (Spigot, Inc.)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Windows\jmesoft\hotkey.exe (Lenovo)
PRC - C:\Windows\jmesoft\JME_LOAD.exe ()
PRC - C:\Windows\jmesoft\Service.exe ()
PRC - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe ()
PRC - C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe ()
PRC - C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe ()
MOD - C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvcLib.dll ()
MOD - C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (FlexNet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software LLC)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (Intel(R) – C:\Windows\SysNative\IPROSetMonitor.exe (Intel Corporation)
SRV:64bit: - (wlcrasvc) – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (DirMngr) – C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe ()
SRV - (MozillaMaintenance) – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (sftvsa) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) – C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (NIS) – C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (Symantec Corporation)
SRV - (AdobeARMservice) – C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (JME Keyboard) – C:\Windows\jmesoft\Service.exe ()
SRV - (WSWNDA3100) – C:\Program Files (x86)\NETGEAR\WNDA3100v2\WifiSvc.exe ()
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV:64bit: - (Sftvol) – C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) – C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) – C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) – C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\drivers\NISx64\1404000.028\symefa64.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\drivers\NISx64\1404000.028\symds64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\NISx64\1404000.028\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\drivers\NISx64\1404000.028\symnets.sys (Symantec Corporation)
DRV:64bit: - (taphss6) – C:\Windows\SysNative\drivers\taphss6.sys (Anchorfree Inc.)
DRV:64bit: - (ccSet_NIS) – C:\Windows\SysNative\drivers\NISx64\1404000.028\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\drivers\NISx64\1404000.028\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\NISx64\1404000.028\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (taphss) – C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc)
DRV:64bit: - (Fs_Rec) – C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (fbfmon) – C:\Windows\SysNative\drivers\fbfmon.sys (Lenovo)
DRV:64bit: - (BPntDrv) – C:\Windows\SysNative\drivers\BPntDrv.sys (Lenovo)
DRV:64bit: - (tap0901) – C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (igfx) – C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (VMC412) – C:\Windows\SysNative\drivers\vmc412.sys (Vimicro Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (clwvd) – C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (EloMTUsb) – C:\Windows\SysNative\drivers\EloMTUsb.sys ()
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (RSPCIESTOR) – C:\Windows\SysNative\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (e1cexpress) – C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (ATIAVPCI) – C:\Windows\SysNative\drivers\Yatinavrr.SYS (ATI Technologies Inc.)
DRV:64bit: - (itecir) – C:\Windows\SysNative\drivers\itecir.sys (ITE Tech. Inc. )
DRV:64bit: - (NPF) – C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (BCMH43XX) – C:\Windows\SysNative\drivers\bcmwlhigh664.sys (Broadcom Corporation)
DRV:64bit: - (wsvd) – C:\Windows\SysNative\drivers\wsvd.sys (CyberLink)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (WinI2C-DDC) – C:\Windows\SysNative\drivers\ddcdrv.sys (Nicomsoft Ltd.)
DRV:64bit: - (SCMNdisP) – C:\Windows\SysNative\drivers\SCMNdisP.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (IDSVia64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\IPSDefs\20131101.001\IDSviA64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\BASHDefs\20131022.001\BHDrvx64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20131101.018\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\Definitions\VirusDefs\20131101.018\eng64.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (WinI2C-DDC) – C:\Windows\SysWOW64\drivers\ddcdrv.sys (Nicomsoft Ltd.)
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7XXXX

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,DefaultNetworkProfile = 1462632
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com?type=714647&fr=spigot-yhp-ie
IE - HKCU\..\SearchScopes,DefaultScope = {793EEF25-E45F-4209-BF8D-A83718688ADE}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7DSGQ_enGB488
IE - HKCU\..\SearchScopes\{793EEF25-E45F-4209-BF8D-A83718688ADE}: "URL" = http://uk.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=714647&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=714647"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "https://www.google.co.uk/"
FF - prefs.js..extensions.enabledAddons: %7BBBDA0591-3099-440a-AA10-41764D9DB4DB%7D:12.0.3.2%20-%201
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:24.0
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p="
FF - prefs.js..network.proxy.socks: "117.121.237.218:8082"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\coFFPlgn\ [2013/11/02 08:45:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\IPSFF [2013/10/09 18:23:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 24.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/06/16 17:01:39 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Extensions
[2013/09/11 16:49:58 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2013/09/27 16:26:18 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\dj4fvqfn.default\extensions
[2013/09/27 16:26:17 | 000,700,980 | —- | M] () (No name found) – C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\dj4fvqfn.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
[2013/09/11 17:27:15 | 000,000,921 | —- | M] () – C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\dj4fvqfn.default\searchplugins\yahoo.xml
[2013/10/01 10:00:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/10/01 10:00:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/10/01 10:00:28 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/10/09 18:23:39 | 000,000,000 | —D | M] (Norton Vulnerability Protection) – C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.2.0.19\IPSFF

O1 HOSTS File: ([2013/08/24 00:03:12 | 000,000,021 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EloConfigDlg] C:\Program Files\Elo TouchSystems\EloConfig.exe (Tyco Electronics)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCEPServiceManager] C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [jmekey] C:\Windows\jmesoft\hotkey.exe (Lenovo)
O4 - HKLM..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe ()
O4 - HKLM..\Run: [Lenovo Dynamic Brightness System] C:\Program Files\Lenovo\Lenovo Brightness System\RunLDBS.exe (TODO: <公司名>)
O4 - HKLM..\Run: [Lenovo Eye Distance System] C:\Program Files\Lenovo\Lenovo Eye Distance System\Lenovo Eye Distance System.exe (Lenovo)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [SearchProtection] C:\Users\User\AppData\Roaming\Search Protection\SearchProtection.EXE (Spigot, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{99ABC1C1-2564-43BA-8A43-BCDDAA8CE327}: DhcpNameServer = 192.168.1.254 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/08/15 15:53:21 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{b93333e7-b7f0-11e1-bdb0-0025ab128718}\Shell - "" = AutoRun
O33 - MountPoints2\{b93333e7-b7f0-11e1-bdb0-0025ab128718}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/11/01 21:15:45 | 012,576,792 | —- | C] (Malwarebytes Corp.) – C:\Users\User\Desktop\mbar-1.07.0.1007.exe
[2013/10/29 19:45:46 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/10/29 19:45:21 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013/10/29 19:45:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2013/10/29 19:45:21 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013/10/29 19:45:21 | 000,000,000 | —D | C] – C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013/10/29 09:36:15 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2013/10/29 09:22:29 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2013/10/29 08:55:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\GNU
[2013/10/24 15:26:33 | 000,000,000 | —D | C] – C:\ProgramData\Oracle
[2013/10/24 15:23:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2013/10/24 15:23:46 | 000,264,616 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\javaws.exe
[2013/10/24 15:23:42 | 000,175,016 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\javaw.exe
[2013/10/24 15:23:42 | 000,174,504 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\java.exe
[2013/10/24 15:23:42 | 000,096,168 | —- | C] (Oracle Corporation) – C:\windows\SysWow64\WindowsAccessBridge-32.dll
[2013/10/24 15:23:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/10/13 11:13:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
[2013/10/09 18:11:55 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ieui.dll
[2013/10/09 18:11:55 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ieui.dll
[2013/10/09 18:11:54 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesysprep.dll
[2013/10/09 18:11:54 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesysprep.dll
[2013/10/09 18:11:54 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\RegisterIEPKEYs.exe
[2013/10/09 18:11:54 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\RegisterIEPKEYs.exe
[2013/10/09 18:11:54 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iesetup.dll
[2013/10/09 18:11:54 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iesetup.dll
[2013/10/09 18:11:54 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ie4uinit.exe
[2013/10/09 18:11:54 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\iernonce.dll
[2013/10/09 18:11:54 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\iernonce.dll
[2013/10/09 18:11:53 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\msfeeds.dll
[2013/10/09 18:11:52 | 003,959,296 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript9.dll
[2013/10/09 18:11:52 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\jscript.dll
[2013/10/09 18:11:52 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\jscript.dll
[2013/10/09 12:32:16 | 000,633,856 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\comctl32.dll
[2013/10/09 12:32:08 | 000,368,128 | —- | C] (Adobe Systems Incorporated) – C:\windows\SysNative\atmfd.dll
[2013/10/09 12:32:08 | 000,295,424 | —- | C] (Adobe Systems Incorporated) – C:\windows\SysWow64\atmfd.dll
[2013/10/09 12:32:08 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\fontsub.dll
[2013/10/09 12:32:08 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\fontsub.dll
[2013/10/09 12:32:08 | 000,046,080 | —- | C] (Adobe Systems) – C:\windows\SysNative\atmlib.dll
[2013/10/09 12:32:08 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\lpk.dll
[2013/10/09 12:32:08 | 000,034,304 | —- | C] (Adobe Systems) – C:\windows\SysWow64\atmlib.dll
[2013/10/09 12:32:08 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\dciman32.dll
[2013/10/09 12:31:57 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\hidclass.sys
[2013/10/09 12:31:57 | 000,032,896 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\hidparse.sys
[2013/10/09 12:31:53 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\davclnt.dll
[2013/10/09 12:31:40 | 005,549,504 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntoskrnl.exe
[2013/10/09 12:31:40 | 003,969,472 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntkrnlpa.exe
[2013/10/09 12:31:40 | 003,914,176 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntoskrnl.exe
[2013/10/09 12:31:40 | 001,732,032 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\ntdll.dll
[2013/10/09 12:31:40 | 000,878,080 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\advapi32.dll
[2013/10/09 12:31:40 | 000,859,648 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\tdh.dll
[2013/10/09 12:31:40 | 000,619,520 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\tdh.dll
[2013/10/09 12:31:39 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\wow64.dll
[2013/10/09 12:31:39 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\setup16.exe
[2013/10/09 12:31:39 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\ntvdm64.dll
[2013/10/09 12:31:39 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\instnm.exe
[2013/10/09 12:31:39 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\wow32.dll
[2013/10/09 12:31:39 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\user.exe
[2013/10/09 12:31:24 | 000,124,112 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\PresentationCFFRasterizerNative_v0300.dll
[2013/10/09 12:31:24 | 000,102,608 | —- | C] (Microsoft Corporation) – C:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
[2013/10/09 12:31:16 | 000,461,312 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\scavengeui.dll
[2013/10/09 12:31:14 | 000,325,120 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\usbport.sys
[2013/10/09 12:31:14 | 000,007,808 | —- | C] (Microsoft Corporation) – C:\windows\SysNative\drivers\usbd.sys
[2013/01/28 15:40:13 | 000,082,816 | —- | C] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[1 C:\Users\User\Documents\*.tmp files -> C:\Users\User\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/11/02 08:57:00 | 000,000,830 | —- | M] () – C:\windows\tasks\Adobe Flash Player Updater.job
[2013/11/02 08:52:13 | 000,020,688 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/11/02 08:52:13 | 000,020,688 | -H– | M] () – C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/11/02 08:49:25 | 000,780,196 | —- | M] () – C:\windows\SysNative\PerfStringBackup.INI
[2013/11/02 08:49:25 | 000,665,000 | —- | M] () – C:\windows\SysNative\perfh009.dat
[2013/11/02 08:49:25 | 000,125,478 | —- | M] () – C:\windows\SysNative\perfc009.dat
[2013/11/02 08:45:19 | 000,138,777 | —- | M] () – C:\windows\SysNative\fastboot.set
[2013/11/02 08:44:50 | 000,000,908 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/02 08:44:49 | 000,000,022 | —- | M] () – C:\windows\S.dirmngr
[2013/11/02 08:44:42 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2013/11/02 08:44:36 | 468,008,959 | -HS- | M] () – C:\hiberfil.sys
[2013/11/01 22:22:56 | 000,000,912 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/01 21:15:49 | 012,576,792 | —- | M] (Malwarebytes Corp.) – C:\Users\User\Desktop\mbar-1.07.0.1007.exe
[2013/11/01 21:14:34 | 000,891,184 | —- | M] () – C:\Users\User\Desktop\SecurityCheck.exe
[2013/10/29 19:45:48 | 000,001,783 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2013/10/29 14:45:20 | 000,000,822 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2013/10/29 09:39:15 | 000,625,664 | —- | M] () – C:\Users\User\Desktop\dds.scr
[2013/10/29 09:36:15 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2013/10/29 09:22:29 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2013/10/29 09:01:45 | 000,000,732 | —- | M] () – C:\Users\User\AppData\Local\recently-used.xbel
[2013/10/29 09:00:17 | 000,006,045 | —- | M] () – C:\Users\User\Desktop\secret-key-CDA57B98.asc
[2013/10/29 08:55:19 | 000,001,117 | —- | M] () – C:\Users\Public\Desktop\GPA.lnk
[2013/10/14 20:34:39 | 000,000,017 | —- | M] () – C:\windows\SysWow64\shortcut_ex.dat
[2013/10/09 18:23:08 | 005,074,560 | —- | M] () – C:\windows\SysNative\FNTCACHE.DAT
[2013/10/09 18:10:11 | 000,765,664 | —- | M] () – C:\windows\SysWow64\PerfStringBackup.INI
[2013/10/09 17:57:40 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerApp.exe
[2013/10/09 17:57:40 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/10/08 06:50:37 | 000,096,168 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\WindowsAccessBridge-32.dll
[2013/10/08 06:46:52 | 000,264,616 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\javaws.exe
[2013/10/08 06:46:47 | 000,175,016 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\javaw.exe
[2013/10/08 06:46:23 | 000,174,504 | —- | M] (Oracle Corporation) – C:\windows\SysWow64\java.exe
[1 C:\Users\User\Documents\*.tmp files -> C:\Users\User\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/11/02 08:44:49 | 000,000,022 | —- | C] () – C:\windows\S.dirmngr
[2013/11/01 21:14:33 | 000,891,184 | —- | C] () – C:\Users\User\Desktop\SecurityCheck.exe
[2013/10/29 19:45:47 | 000,001,783 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2013/10/29 09:39:08 | 000,625,664 | —- | C] () – C:\Users\User\Desktop\dds.scr
[2013/10/29 09:01:45 | 000,000,732 | —- | C] () – C:\Users\User\AppData\Local\recently-used.xbel
[2013/10/29 09:00:17 | 000,006,045 | —- | C] () – C:\Users\User\Desktop\secret-key-CDA57B98.asc
[2013/10/29 08:55:16 | 000,001,117 | —- | C] () – C:\Users\Public\Desktop\GPA.lnk
[2013/10/14 20:34:39 | 000,000,017 | —- | C] () – C:\windows\SysWow64\shortcut_ex.dat
[2013/09/30 20:56:27 | 000,099,384 | —- | C] () – C:\Users\User\AppData\Roaming\inst.exe
[2013/09/17 15:24:39 | 000,000,153 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2013/04/16 12:58:34 | 000,000,064 | —- | C] () – C:\windows\GPlrLanc.dat
[2013/01/28 15:40:13 | 000,007,859 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2013/01/28 15:40:13 | 000,001,167 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2012/07/24 10:24:36 | 000,000,000 | —- | C] () – C:\windows\SysWow64\cd.dat
[2012/07/19 16:11:28 | 000,053,299 | —- | C] () – C:\windows\SysWow64\pthreadVC.dll
[2012/06/30 16:09:17 | 000,000,000 | —- | C] () – C:\windows\PowerReg.dat
[2012/06/22 12:49:43 | 000,765,664 | —- | C] () – C:\windows\SysWow64\PerfStringBackup.INI
[2012/06/21 17:45:59 | 000,000,190 | —- | C] () – C:\windows\ODBCINST.INI
[2012/06/17 16:30:07 | 000,000,530 | —- | C] () – C:\windows\eReg.dat
[2012/01/27 20:09:24 | 000,201,728 | —- | C] () – C:\windows\SetDrive.exe
[2012/01/27 20:09:23 | 000,036,864 | —- | C] () – C:\windows\WinWait.exe
[2011/11/29 15:38:12 | 000,974,848 | —- | C] () – C:\windows\SysWow64\cis-2.4.dll
[2011/11/29 15:38:12 | 000,081,920 | —- | C] () – C:\windows\SysWow64\issacapi_bs-2.3.dll
[2011/11/29 15:38:12 | 000,065,536 | —- | C] () – C:\windows\SysWow64\issacapi_pe-2.3.dll
[2011/11/29 15:38:12 | 000,057,344 | —- | C] () – C:\windows\SysWow64\issacapi_se-2.3.dll

========== ZeroAccess Check ==========

[2009/07/14 04:55:00 | 000,000,227 | RHS- | M] () – C:\windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/07/26 02:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/26 01:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 01:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/21 03:24:25 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 01:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/04/16 13:03:51 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\.minecraft
[2013/04/16 12:59:39 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\.myibay
[2013/07/06 22:42:32 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\.purple
[2013/08/22 20:45:10 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Anvisoft
[2013/09/17 16:11:44 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Autodesk
[2013/06/19 20:05:03 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\DAEMON Tools Lite
[2013/09/13 22:01:26 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Free PDF Tablet
[2012/11/03 16:18:37 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\GameRanger
[2013/10/29 09:01:15 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\gnupg
[2013/03/03 18:45:50 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\gtk-2.0
[2012/06/30 16:27:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Leadertech
[2012/07/27 23:49:54 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\MAGIX
[2012/10/22 18:15:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Microgaming
[2013/09/11 15:42:26 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Notepad++
[2013/09/07 19:33:34 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\OpenOffice
[2012/06/30 19:17:10 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Origin
[2013/03/30 17:30:57 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\PacificPoker
[2012/06/25 21:14:50 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\PowerISO
[2012/06/18 13:07:50 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Samsung
[2013/09/11 16:49:55 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Search Protection
[2013/09/08 00:11:10 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\SoftGrid Client
[2012/12/10 19:42:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\SuperAdBlocker.com
[2012/06/22 12:50:39 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\TP
[2013/08/23 21:10:41 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Uniblue
[2013/10/29 14:46:12 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\uTorrent
[2013/10/29 14:46:13 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\Vso
[2013/06/08 18:21:52 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\WNR

========== Purity Check ==========

< End of report >

Mainsy1690

Post #9November 2, 2013, 9:33 AM UTC

There was no malware found

Jo*

Post #10November 2, 2013, 8:51 PM UTC

Hello Mainsy1690,

I fixed my computer not so long ago from Trojans now I think they have came back I am getting warnings
Which warnings do you get?

We need to know this!
Perhaps you can copy it from your Norton "history".

***

Please download AdwCleaner by Xplode and save to your Desktop.
Double-click AdwCleaner.exe
Vista / Windows 7/8 users right-click and select Run As Administrator.

Click on the Scan button.
AdwCleaner will begin…be patient as the scan may take some time to complete.
The actual line should say "Pending. Please uncheck elements you do not want to remove" => scan is complete.
After the scan has finished, click on the Report button…a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it.
If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

Jo*

Post #11November 5, 2013, 8:58 AM UTC

CatByte

Post #12November 6, 2013, 4:02 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Think Im Infected HELP [Closed]

✨ Ask AI

Ask AI