DDS LOG

Here is my log from DDS, I hope this is the correct way to post it.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Kaitlyn at 21:39:14 on 2012-05-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4007.1971 [GMT -4:00]
.
AV: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
SP: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\System32\spoolsv.exe
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\iYogi\iPNA\iPNA.exe
C:\Program Files (x86)\iYogi Support Dock\pccare\IYSODefragSrv64.exe
C:\Program Files (x86)\PDF Complete\pdfsvc.exe
C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files (x86)\iYogi\SDiManage\IYogiMonitoringSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\iYogi Support Dock\Services\CommAgent\SupportDockService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\iYogi\SDiManage\Monitor.Event.Agent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\iYogi\SDiManage\Monitor.GetSnmpInfo.Agent.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\iYogi\SDiManage\Monitor.GetInfo.Agent.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Nmap\nmap.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\splwow64.exe
C:\Program Files (x86)\Nmap\nmap.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe,
BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1078\TmIEPlg32.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\TmBpIe32.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
uRun: [Spotify Web Helper] "C:\Users\Kaitlyn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
mRun: [iYogi Support Dock] "C:\Program Files (x86)\iYogi Support Dock\iYogiSupportDock.exe"
uPolicies-explorer: HideSCAHealth = 1 (0x1)
uPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{11C5D845-75F5-49C1-97B6-A7A14E5390BB} : NameServer = 4.2.2.2,4.2.2.3
TCP: Interfaces\{11C5D845-75F5-49C1-97B6-A7A14E5390BB} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1D75F2EF-8E3F-4708-8B3E-E342FEE045DD} : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\7.1.1102\7.1.1102\TmBpIe32.dll
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\2.0.1313\6.8.1078\TmIEPlg32.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {2D46B6DC-2207-486B-B523-A557E6D54B47} - C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe -ClearIconCache
BHO-X64: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.0.1313\6.8.1078\TmIEPlg32.dll
BHO-X64: Trend Micro NSC BHO - No File
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1102\7.1.1102\TmBpIe32.dll
BHO-X64: TmBpIeBHO - No File
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [iYogi Support Dock] "C:\Program Files (x86)\iYogi Support Dock\iYogiSupportDock.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Kaitlyn\AppData\Roaming\Mozilla\Firefox\Profiles\6l4ngl3e.New\
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\CambridgeSoft\ChemOffice2010\ChemDrawMGH\NPCDPMGH32.DLL
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\Program Files (x86)\Virtual Earth 3D\npVE3D.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Default\AppData\Local\HuluDesktop\instances\0.9.13.1\nphdplg.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
.
============= SERVICES / DRIVERS ===============
.
R1 tmevtmgr;tmevtmgr;C:\Windows\system32\DRIVERS\tmevtmgr.sys --> C:\Windows\system32\DRIVERS\tmevtmgr.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-6-1 89600]
R2 Amsp;Trend Micro Solution Platform;C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe [2012-3-22 275912]
R2 CalendarSynchService;CalendarSynchService;C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2010-8-5 16384]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2011-9-9 86072]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]
R2 iPNA;iPNA;C:\Program Files (x86)\iYogi\iPNA\iPNA.exe [2012-2-27 30448]
R2 IYSODiskOptimizer;IYSODiskOptimizer;C:\Program Files (x86)\iYogi Support Dock\pccare\iysoDefragSrv64.exe [2012-4-28 286720]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-4-17 654408]
R2 pdfcDispatcher;PDF Document Manager;C:\Program Files (x86)\PDF Complete\pdfsvc.exe [2011-6-1 1127448]
R2 PdiService;Portrait Displays SDK Service;C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-6-1 109168]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
R2 SDiManage;SDiManage;C:\Program Files (x86)\iYogi\SDiManage\IYogiMonitoringSvc.exe [2011-11-3 17408]
R2 SupportDockService.exe;Support Dock Service;C:\Program Files (x86)\iYogi Support Dock\Services\CommAgent\SupportDockService.exe [2012-3-2 78336]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-6-1 2656280]
R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys --> C:\Windows\system32\DRIVERS\itecir.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\drivers\HECIx64.sys --> C:\Windows\system32\drivers\HECIx64.sys [?]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\system32\DRIVERS\netr28x.sys --> C:\Windows\system32\DRIVERS\netr28x.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
RUnknown SASKUTIL;SASKUTIL; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-2-17 682040]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-15 257696]
S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;\??\C:\Windows\system32\drivers\BVRPMPR5a64.SYS --> C:\Windows\system32\drivers\BVRPMPR5a64.SYS [?]
S3 Impcd;Impcd;C:\Windows\system32\drivers\Impcd.sys --> C:\Windows\system32\drivers\Impcd.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-25 129976]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S4 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 136176]
S4 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-23 136176]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-05-06 16:44:22 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{A1800150-94F7-4794-96B3-AF23A36CC290}
2012-05-06 16:44:10 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{4FC8512B-1460-4A00-ABE6-C743D8B575F3}
2012-05-06 01:44:11 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{820424B8-1C60-44F5-8A1E-06C24795F677}
2012-05-06 01:44:00 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{9BAC00B5-EA45-4DF2-81A1-5CEA6035A7ED}
2012-05-05 23:10:58 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{050F5F4D-12AF-43F7-8D69-4A826B6288A0}
2012-05-05 23:09:18 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{3A2D3B31-BC2A-4669-B191-5880BD63F268}
2012-05-05 19:00:37 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{91FF4770-8970-461C-82C2-0936E9D1C2B9}
2012-05-05 18:59:09 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\{159E211F-40C8-48F5-AB89-78E3D3C0CECF}
2012-04-28 22:35:53 17640 ----a-w- C:\Windows\System32\roboot64.exe
2012-04-28 22:35:38 -------- d-----w- C:\APCT
2012-04-28 22:33:03 -------- d-----w- C:\ProgramData\iYogi
2012-04-26 01:08:32 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2012-04-26 01:08:26 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-26 01:08:26 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-25 03:52:46 -------- d-----w- C:\Program Files\ESET
2012-04-20 22:39:10 -------- d-----w- C:\ProgramData\Blio
2012-04-20 22:39:07 -------- d-----w- C:\Users\Kaitlyn\AppData\Roaming\Blio
2012-04-17 22:12:52 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-04-16 04:05:04 8744608 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2012-04-16 03:33:16 419488 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-04-14 19:48:53 -------- d-----w- C:\PFS6_TMP
2012-04-14 19:48:51 -------- d-----w- C:\ProgramData\Panasonic
2012-04-14 19:45:08 -------- d-----w- C:\Users\Kaitlyn\AppData\Local\Panasonic
2012-04-14 19:42:57 80024 ----a-w- C:\Windows\SysWow64\PICSDK.dll
2012-04-14 19:42:57 71840 ----a-w- C:\Windows\SysWow64\EPPicMgr.dll
2012-04-14 19:42:57 501912 ----a-w- C:\Windows\SysWow64\PICSDK2.dll
2012-04-14 19:42:57 120992 ----a-w- C:\Windows\SysWow64\EpPicPrt.dll
2012-04-14 19:42:57 108704 ----a-w- C:\Windows\SysWow64\PICEntry.dll
2012-04-14 19:42:00 -------- d-----w- C:\Program Files (x86)\Common Files\Panasonic
2012-04-14 19:41:42 -------- d-----w- C:\Program Files\Microsoft Synchronization Services
2012-04-14 19:41:42 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition
2012-04-14 19:41:39 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2012-04-12 03:00:09 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2012-04-12 03:00:09 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-04-12 03:00:09 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-04-12 03:00:09 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-04-12 03:00:09 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-04-12 03:00:09 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-04-12 03:00:09 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
.
==================== Find3M ====================
.
2012-05-05 12:05:07 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-17 22:13:29 711240 ----a-w- C:\Windows\isRS-000.tmp
2012-04-04 02:42:17 5276432 ----a-w- C:\Windows\uninst.exe
2012-03-22 14:40:40 56 ----a-w- C:\Windows\System32\SupportTool.exe.bat
2012-03-22 14:39:30 91920 ----a-w- C:\Windows\System32\drivers\tmactmon.sys
2012-03-22 14:39:30 70928 ----a-w- C:\Windows\System32\drivers\tmevtmgr.sys
2012-03-22 14:39:30 167696 ----a-w- C:\Windows\System32\drivers\tmcomm.sys
2012-03-22 14:39:30 105744 ----a-w- C:\Windows\System32\drivers\tmtdi.sys
2012-03-18 00:45:30 691 ----a-w- C:\Users\Kaitlyn\AppData\Roaming\GetValue.vbs
2012-03-18 00:45:30 35 ----a-w- C:\Users\Kaitlyn\AppData\Roaming\SetValue.bat
2012-03-18 00:45:29 2244 ----a-w- C:\Windows\SysWow64\tmp.reg
2012-03-06 06:53:37 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-06 05:59:47 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-06 05:59:41 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll
2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll
2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-02-14 16:09:44 1070352 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
.
============= FINISH: 21:40:27.09 ===============

Hello and Welcome to Bleeping Computer!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Security Check

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
• do you need more time?
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Hello I am not sure where the reply is.. I certainly do want to reply! thanks kris

My log is listed as above. I have not received any further instructions..unless I am missing them someplace..thanks Kris

Hello

you Don't see post #2 above?

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Sorry Gringo, I mistook that as a generic "you may be asked" I didn't realize it was for me. I am not very computer literate I'm afraid and am new to posting on here. But I am very grateful for your help I will try and do as you ask. Thanks so much for your help!I don't know how to copy to notebook so I will see what I can do. I'm a nurse and work long irregular hours so please don't give up on me replying! Now I'm going back to do the combo fix..thanks!!!

no problem and if there is something you don't understand just let me know


gringo

I must have done something very wrong. I ran combofix after disabling trendmicro (which I have since reinstalled)and I copied the log for you. However when i was trying to come back onto the internet when I clicked any button on any file in the whole computer I got a message which stated this file has been marked for registry deletion or something to that effect and I was not able to open anything on the entire computer! Not pictures or anything. I had to use the system restore to get the computer to run again. I will show you the file that combo fix made:
ComboFix 12-05-13.04 - Kaitlyn 05/13/2012 21:54:43.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4007.2199 [GMT -4:00]
Running from: c:\users\Kaitlyn\Downloads\ComboFix.exe
AV: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
SP: Trend Micro Titanium Maximum Security 2012 *Disabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Kaitlyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A90D6F30-B60E-4405-A2E9-5574B56DBCD6}.xps
c:\users\Kaitlyn\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F6F7E02F-ED6E-401D-8DF4-0E31580B1590}.xps
c:\windows\isRS-000.tmp
c:\windows\SysWow64\404Fix.exe
c:\windows\SysWow64\Agent.OMZ.Fix.exe
c:\windows\SysWow64\dumphive.exe
c:\windows\SysWow64\IEDFix.C.exe
c:\windows\SysWow64\IEDFix.exe
c:\windows\SysWow64\o4Patch.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\Process.exe
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\SrchSTS.exe
c:\windows\SysWow64\tmp.reg
c:\windows\SysWow64\VACFix.exe
c:\windows\SysWow64\VCCLSID.exe
c:\windows\SysWow64\wpcap.dll
c:\windows\SysWow64\WS2Fix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2012-04-14 to 2012-05-14 )))))))))))))))))))))))))))))))
.
.
2012-05-14 02:00 . 2012-05-14 02:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-11 02:57 . 2012-03-03 06:35 1544704 ----a-w- c:\windows\system32\DWrite.dll
2012-05-11 02:57 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-05-11 02:57 . 2012-03-31 06:05 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-11 02:57 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-11 02:57 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-11 02:57 . 2012-03-31 03:10 3146240 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 02:56 . 2012-03-17 07:58 75120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-11 02:56 . 2012-03-31 05:42 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-11 02:56 . 2012-03-31 05:40 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 02:56 . 2012-03-31 04:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 02:56 . 2012-03-30 11:35 1918320 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-11 02:56 . 2012-03-31 05:40 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-11 02:56 . 2012-03-31 05:40 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-04-28 22:35 . 2011-08-24 14:55 17640 ----a-w- c:\windows\system32\roboot64.exe
2012-04-28 22:35 . 2012-04-28 22:35 -------- d-----w- C:\APCT
2012-04-28 22:33 . 2012-04-28 22:33 -------- d-----w- c:\programdata\iYogi
2012-04-17 01:23 . 2012-03-13 04:38 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-04-17 01:23 . 2012-03-13 04:38 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-04-17 01:23 . 2012-03-13 04:38 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-04-17 01:23 . 2012-03-13 04:38 2106216 ----a-w- c:\program files (x86)\Mozilla Firefox\D3DCompiler_43.dll
2012-04-17 01:23 . 2012-03-13 04:38 1998168 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dx9_43.dll
2012-04-16 04:05 . 2012-05-05 12:05 8744608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-16 03:33 . 2012-05-05 12:05 419488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-14 19:48 . 2012-04-14 19:58 -------- d-----w- C:\PFS6_TMP
2012-04-14 19:48 . 2012-04-14 19:48 -------- d-----w- c:\programdata\Panasonic
2012-04-14 19:45 . 2012-04-14 19:45 -------- d-----w- c:\users\Kaitlyn\AppData\Local\Panasonic
2012-04-14 19:42 . 2007-06-22 04:10 501912 ----a-w- c:\windows\SysWow64\PICSDK2.dll
2012-04-14 19:42 . 2006-10-31 04:10 71840 ----a-w- c:\windows\SysWow64\EPPicMgr.dll
2012-04-14 19:42 . 2006-10-31 04:10 120992 ----a-w- c:\windows\SysWow64\EpPicPrt.dll
2012-04-14 19:42 . 2006-10-20 04:10 80024 ----a-w- c:\windows\SysWow64\PICSDK.dll
2012-04-14 19:42 . 2006-10-20 04:10 108704 ----a-w- c:\windows\SysWow64\PICEntry.dll
2012-04-14 19:42 . 2012-04-14 19:42 -------- d-----w- c:\users\Kaitlyn\AppData\Roaming\InstallShield
2012-04-14 19:42 . 2012-04-14 19:42 -------- d-----w- c:\program files (x86)\Common Files\Panasonic
2012-04-14 19:41 . 2012-04-14 19:41 -------- d-----w- c:\program files (x86)\Panasonic
2012-04-14 19:41 . 2012-04-14 19:41 -------- d-----w- c:\program files\Microsoft Synchronization Services
2012-04-14 19:41 . 2012-04-14 19:41 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-04-14 19:41 . 2012-04-14 19:41 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 12:05 . 2011-09-21 11:01 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-04 02:42 . 2012-04-04 02:42 5276432 ----a-w- c:\windows\uninst.exe
2012-03-22 14:40 . 2012-03-22 14:40 56 ----a-w- c:\windows\system32\SupportTool.exe.bat
2012-03-22 14:39 . 2012-03-22 14:40 105744 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2012-03-22 14:39 . 2012-03-22 14:40 91920 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2012-03-22 14:39 . 2012-03-22 14:40 70928 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2012-03-22 14:39 . 2012-03-22 14:40 167696 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2012-03-19 02:24 . 2012-03-19 02:24 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-19 02:24 . 2012-03-19 02:24 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-19 02:24 . 2012-03-19 02:24 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-03-19 02:24 . 2012-03-19 02:24 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-03-19 02:24 . 2012-03-19 02:24 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-03-19 02:24 . 2012-03-19 02:24 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-03-19 02:24 . 2012-03-19 02:24 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-03-19 02:24 . 2012-03-19 02:24 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-03-19 02:24 . 2012-03-19 02:24 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-03-19 02:24 . 2012-03-19 02:24 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-03-19 02:24 . 2012-03-19 02:24 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-03-19 02:24 . 2012-03-19 02:24 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-03-19 02:24 . 2012-03-19 02:24 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-19 02:24 . 2012-03-19 02:24 448512 ----a-w- c:\windows\system32\html.iec
2012-03-19 02:24 . 2012-03-19 02:24 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-03-19 02:24 . 2012-03-19 02:24 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-03-19 02:24 . 2012-03-19 02:24 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-03-19 02:24 . 2012-03-19 02:24 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-19 02:24 . 2012-03-19 02:24 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-03-19 02:24 . 2012-03-19 02:24 222208 ----a-w- c:\windows\system32\msls31.dll
2012-03-19 02:24 . 2012-03-19 02:24 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-19 02:24 . 2012-03-19 02:24 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-03-19 02:24 . 2012-03-19 02:24 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-03-19 02:24 . 2012-03-19 02:24 160256 ----a-w- c:\windows\system32\wextract.exe
2012-03-19 02:24 . 2012-03-19 02:24 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-03-19 02:24 . 2012-03-19 02:24 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-03-19 02:24 . 2012-03-19 02:24 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-03-19 02:24 . 2012-03-19 02:24 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-03-19 02:24 . 2012-03-19 02:24 12288 ----a-w- c:\windows\system32\mshta.exe
2012-03-19 02:24 . 2012-03-19 02:24 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-03-19 02:24 . 2012-03-19 02:24 114176 ----a-w- c:\windows\system32\admparse.dll
2012-03-19 02:24 . 2012-03-19 02:24 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-19 02:24 . 2012-03-19 02:24 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-03-19 02:24 . 2012-03-19 02:24 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-03-18 00:45 . 2012-03-18 00:45 691 ----a-w- c:\users\Kaitlyn\AppData\Roaming\GetValue.vbs
2012-03-18 00:45 . 2012-03-18 00:45 35 ----a-w- c:\users\Kaitlyn\AppData\Roaming\SetValue.bat
2012-03-01 06:46 . 2012-04-12 03:00 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-12 03:00 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-12 03:00 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-12 03:00 5120 ----a-w- c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-12 03:00 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-12 03:00 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 03:00 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-02-28 06:56 . 2012-04-12 03:01 2311168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 06:49 . 2012-04-12 03:01 1390080 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 06:48 . 2012-04-12 03:01 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 06:42 . 2012-04-12 03:01 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-28 01:18 . 2012-04-12 03:01 1799168 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-02-28 01:11 . 2012-04-12 03:01 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 03:01 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
2012-02-28 01:03 . 2012-04-12 03:01 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-02-17 06:38 . 2012-03-13 20:16 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-13 20:16 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-13 20:16 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-13 20:16 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-14 16:09 . 2012-02-14 16:09 1070352 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
"Spotify Web Helper"="c:\users\Kaitlyn\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-05 932528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"iYogi Support Dock"="c:\program files (x86)\iYogi Support Dock\iYogiSupportDock.exe" [2012-03-05 1641200]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-02-17 682040]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-26 129976]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R4 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-24 136176]
R4 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-24 136176]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-02 89600]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [2010-08-05 16384]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 iPNA;iPNA;c:\program files (x86)\iYogi\iPNA\iPNA.exe [2012-02-27 30448]
S2 IYSODiskOptimizer;IYSODiskOptimizer;c:\program files (x86)\iYogi Support Dock\pccare\IYSODefragSrv64.exe [2012-02-27 286720]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe [2011-02-01 1127448]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-03-09 109168]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S2 SDiManage;SDiManage;c:\program files (x86)\iYogi\SDiManage\IYogiMonitoringSvc.exe [2011-11-03 17408]
S2 SupportDockService.exe;Support Dock Service;c:\program files (x86)\iYogi Support Dock\Services\CommAgent\SupportDockService.exe [2012-03-02 78336]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-21 03:24 302592 ----a-w- c:\windows\System32\cmd.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 12:05]
.
2012-03-18 c:\windows\Tasks\Bomgar Task 127749.job
- c:\program files (x86)\Mozilla Firefox\firefox.exe [2012-04-17 01:08]
.
2012-01-03 c:\windows\Tasks\Bomgar Task 288726.job
- c:\program files (x86)\Mozilla Firefox\firefox.exe [2012-04-17 01:08]
.
2012-01-03 c:\windows\Tasks\Bomgar Task 318195.job
- c:\program files (x86)\Mozilla Firefox\firefox.exe [2012-04-17 01:08]
.
2012-03-18 c:\windows\Tasks\Bomgar Task 71214.job
- c:\program files (x86)\Mozilla Firefox\firefox.exe [2012-04-17 01:08]
.
2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-24 03:40]
.
2012-01-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-24 03:40]
.
2012-04-15 c:\windows\Tasks\HPCeeScheduleForKAITLYN-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2012-02-27 1304792]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2012-02-27 213824]
"combofix"="c:\combofix\CF7072.3XE" [2010-11-21 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{11C5D845-75F5-49C1-97B6-A7A14E5390BB}: NameServer = 4.2.2.2,4.2.2.3
FF - ProfilePath - c:\users\Kaitlyn\AppData\Roaming\Mozilla\Firefox\Profiles\6l4ngl3e.New\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
c:\program files (x86)\iYogi\SDiManage\Monitor.Event.Agent.exe
c:\program files (x86)\iYogi\SDiManage\Monitor.GetSnmpInfo.Agent.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2012-05-13 22:07:13 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-14 02:07
.
Pre-Run: 631,278,243,840 bytes free
Post-Run: 630,921,142,272 bytes free
.
- - End Of File - - 0077461EF7AE07C71F40B04FDE732A6A

I hope this is helpful. Also in following your prior directions I installed a program which I can't remember now, which was supposed to disable something on the computer I think and I am missing a file now. I get a message every time I boot up the computer. I hope I am not too confusing. I am really a novice with all this. Thanks for your kindness and patience, Kris

Oops I just saw re-read your note about the marked for deletion and restart the computer. Should I do the combofix again? I'm so sorry..I have to bed now-early day tomorrow. Just let me know. Kris

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
• If an infected file is detected, the default action will be Cure, click on Continue.
• If a suspicious file is detected, the default action will be Skip, click on Continue.
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

• Double click the aswMBR.exe icon to run it
• it will ask to download extra definitions - ALLOW IT
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

Gringo the tdss killer found nothing and I couldn't right click on the log after I highlighted it. I 'm not sure what to do about that however here is the other log
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-05-14 18:14:51
-----------------------------
18:14:51.801 OS Version: Windows x64 6.1.7601 Service Pack 1
18:14:51.802 Number of processors: 4 586 0x2A07
18:14:51.802 ComputerName: KAITLYN-HP UserName: Kaitlyn
18:14:58.607 Initialize success
18:16:41.875 AVAST engine defs: 12051401
18:16:59.093 The log file has been saved successfully to "C:\Users\Kaitlyn\Documents\avast.txt"
18:17:04.374 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
18:17:04.376 Disk 0 Vendor: ST375052 HP40 Size: 715404MB BusType: 3
18:17:04.390 Disk 0 MBR read successfully
18:17:04.392 Disk 0 MBR scan
18:17:04.396 Disk 0 unknown MBR code
18:17:04.400 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
18:17:04.407 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 701277 MB offset 206848
18:17:04.436 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 14025 MB offset 1436422144
18:17:04.467 Disk 0 scanning C:\Windows\system32\drivers
18:17:15.434 Service scanning
18:17:32.086 Modules scanning
18:17:32.091 Disk 0 trace - called modules:
18:17:32.103 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
18:17:32.105 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80065e6060]
18:17:32.109 3 CLASSPNP.SYS[fffff88001ba543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800538b050]
18:17:38.736 AVAST engine scan C:\Windows
18:17:45.404 AVAST engine scan C:\Windows\system32
18:22:13.515 AVAST engine scan C:\Windows\system32\drivers
18:22:25.037 AVAST engine scan C:\Users\Kaitlyn
18:25:40.326 File: C:\Users\Kaitlyn\AppData\Local\Temp\nssC89E.tmp\clmreanvp.dll **INFECTED** Win32:Sefnit-GU [Drp]
18:26:48.959 File: C:\Users\Kaitlyn\AppData\Roaming\Mozilla\Mozilla\ruamntmv.dll **INFECTED** Win32:Dropper-KLA [Trj]
18:31:44.851 AVAST engine scan C:\ProgramData
18:33:36.603 Scan finished successfully
18:37:27.679 Disk 0 MBR has been saved successfully to "C:\Users\Kaitlyn\Documents\MBR.dat"
18:37:27.683 The log file has been saved successfully to "C:\Users\Kaitlyn\Documents\AVAST.1.txt"

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

File::
C:\Users\Kaitlyn\AppData\Local\Temp\nssC89E.tmp\clmreanvp.dll
C:\Users\Kaitlyn\AppData\Roaming\Mozilla\Mozilla\ruamntmv.dll

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
  
• report from Combofix
• let me know of any problems you may have had
• How is the computer doing now after running the script?

Gringo

Gringo, forgive me but I am as always confused. I should run :Run CFScript: this somewhere? Or the other files noted above. I tried to run :Run CFScript: but I wasn't sure where to do it. You will have t obe very specific because the computer jargon is waay over my head. I'm sorry. Kris