Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser redirects, very very slow


  • This topic is locked This topic is locked
24 replies to this topic

#1 DocMccoy

DocMccoy

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 05 November 2012 - 08:28 AM

Babylon search got installed on my machine I've gotten rdi of it(so i think) but browser redirects on searches and Bablyon still comes up when I open new tab. The problem is bad with Firefox. Also notice problems with Interent Explore. Browsers are very slow since this happened.

DDS (Ver_2012-10-19.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.7.2
Run by Rob at 8:11:20 on 2012-11-05
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8183.6000 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\Secunia\PSI\PSIA.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Secunia\PSI\sua.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\McAfee\MAT\McPvTray.exe
C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
C:\Windows\splwow64.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Iomega\Iomega Encryption\Iomega Encryption.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
uURLSearchHooks: FCToolbarURLSearchHook Class: {f78bf7a8-cf12-4de7-a6da-c463d1b539a7} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Helper.dll
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120309072432.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
TB: Dogpile Bundle Toolbar: {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - C:\Program Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_Plugin.exe -update plugin
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{4662807B-87DE-4687-A53D-4A01E05AAA66} : DHCPNameServer = 192.168.1.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg pku2u livessp
x64-mStart Page = hxxp://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
x64-BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\SystemCore\ScriptSn.20120309072432.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RunDLLEntry_THXCfg] C:\Windows\System32\RunDLL32.exe C:\Windows\System32\THXCfg64.dll,RunDLLEntry THXCfg64
x64-Run: [RunDLLEntry_EptMon] C:\Windows\System32\RunDLL32.exe C:\Windows\System32\EptMon64.dll,RunDLLEntry EptMon64
x64-Run: [McPvTray_exe] "C:\Program Files\McAfee\MAT\McPvTray.exe"
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
x64-Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll
x64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll
x64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - plugin: c:\progra~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: C:\Users\Rob\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2012-10-27 22:26; [email protected]; C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
FF - user.js: extensions.funmoods.hmpg - true
FF - user.js: extensions.funmoods.hmpgUrl - hxxp://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
FF - user.js: extensions.funmoods.dfltSrch - true
FF - user.js: extensions.funmoods.srchPrvdr - Search
FF - user.js: extensions.funmoods.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods.newTabUrl - hxxp://searchfunmoods.com/?f=2&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://searchfunmoods.com/?f=3&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438&q=
FF - user.js: extensions.funmoods.id - B8AC6FCD780D3804
FF - user.js: extensions.funmoods.instlDay - 15640
FF - user.js: extensions.funmoods.vrsn - 1.5.23.22
FF - user.js: extensions.funmoods.vrsni - 1.5.23.22
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2222:26:26
FF - user.js: extensions.funmoods.prtnrId - funmoods
FF - user.js: extensions.funmoods.prdct - funmoods
FF - user.js: extensions.funmoods.aflt - aln
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods.tlbrId - base
FF - user.js: extensions.funmoods.instlRef - aln
FF - user.js: extensions.funmoods.dfltLng -
FF - user.js: extensions.funmoods.excTlbr - false
FF - user.js: extensions.funmoods.autoRvrt - false
FF - user.js: extensions.funmoods.envrmnt - production
FF - user.js: extensions.funmoods.isdcmntcmplt - true
FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=dccd3804000000000000b8ac6fcd780d&q=
FF - user.js: extensions.BabylonToolbar.id - dccd3804000000000000b8ac6fcd780d
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15641
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.3.8
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.3.8
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.3.88:10:11
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
.
============= SERVICES / DRIVERS ===============
.
R0 McPvDrv;McPvDrv Driver;C:\Windows\System32\drivers\McPvDrv.sys [2011-12-23 71800]
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-1-5 647080]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2011-12-23 284648]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-9-14 55280]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\System32\drivers\mfenlfk.sys [2011-12-23 75808]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-9-14 203264]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-9-14 13336]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-12-23 249936]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-12-23 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-12-23 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [2011-12-23 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-12-23 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-12-23 208536]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2011-12-23 161168]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2011-8-24 430136]
R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-10-14 994360]
R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-9-14 1692480]
R2 WajamUpdater;WajamUpdater;C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [2012-10-5 109064]
R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2010-9-14 6853632]
R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-9-14 263680]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2011-12-23 65264]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2011-12-23 229528]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2011-12-23 481768]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 OXSDIDRV_x64;Oxford Semi eSATA Filter (x64);C:\Windows\System32\drivers\OXSDIDRV_x64.sys [2009-9-28 51760]
R3 PSI;PSI;C:\Windows\System32\drivers\psi_mf.sys [2010-9-1 17976]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-9-14 242720]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-9-14 295424]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\System32\drivers\WSDPrint.sys [2009-7-13 23040]
S2 clr_optimization_v2.0.50727_6432;Microsoft .NET Framework NGEN v2.0.50727_X64 ;c:\programdata\wlancfg32.exe --> c:\programdata\wlancfg32.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_3232;Microsoft .NET Framework NGEN v4.0.30319_X86 ;c:\programdata\wshirda32.exe --> c:\programdata\wshirda32.exe [?]
S2 clr_optimization_v4.0.30319_323232;Microsoft .NET Framework NGEN v4.0.30319_X86 ;c:\programdata\printui32.exe --> c:\programdata\printui32.exe [?]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 clr_optimization_v4.0.30319_6432;Microsoft .NET Framework NGEN v4.0.30319_X64 ;c:\programdata\utildll32.exe --> c:\programdata\utildll32.exe [?]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-9-22 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-11 253600]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-2-28 183560]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-9-22 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-9-3 227232]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2011-12-23 100912]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-27 115168]
S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe [2009-6-26 1124848]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-4-5 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-5-10 51712]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-9-23 1255736]
.
=============== Created Last 30 ================
.
2012-11-05 12:03:03 -------- d-----w- C:\Program Files (x86)\PLX Technology
2012-11-05 12:02:52 31280 ----a-w- C:\Windows\System32\drivers\OXUDIDRV_x64.sys
2012-11-05 12:02:47 -------- d-----w- C:\Program Files\Iomega
2012-11-05 12:02:45 -------- d-----w- C:\Users\Rob\AppData\Local\Downloaded Installations
2012-11-05 02:07:11 -------- d-----w- C:\Program Files (x86)\Runtime Software
2012-11-03 18:50:18 -------- d-----w- C:\Program Files (x86)\Cobian Backup 11
2012-10-28 12:10:00 -------- d-----w- C:\Users\Rob\AppData\Local\Wajam
2012-10-28 12:09:59 -------- d-----w- C:\Program Files (x86)\Wajam
2012-10-28 12:07:44 -------- d-----w- C:\Users\Rob\AppData\Roaming\Babylon
2012-10-28 12:07:44 -------- d-----w- C:\ProgramData\Babylon
2012-10-28 02:26:41 -------- d-----w- C:\Users\Rob\AppData\Roaming\.minecraft
2012-10-28 02:26:40 -------- d-----w- C:\Users\Rob\AppData\Local\Vid-Saver
2012-10-28 02:26:37 -------- d-----w- C:\Program Files (x86)\Vid-Saver
2012-10-28 02:26:26 -------- d-----w- C:\Program Files (x86)\Funmoods
2012-10-27 04:51:52 261600 ----a-w- C:\Program Files (x86)\Mozilla Firefox\updated\components\browsercomps.dll
2012-10-27 04:51:51 73696 ----a-w- C:\Program Files (x86)\Mozilla Firefox\updated\breakpadinjector.dll
2012-10-27 04:51:51 18912 ----a-w- C:\Program Files (x86)\Mozilla Firefox\updated\AccessibleMarshal.dll
2012-10-21 19:45:13 -------- d-----w- C:\Program Files (x86)\MSECache
2012-10-19 01:23:10 96224 ----a-w- C:\Program Files (x86)\Mozilla Firefox\webapprt-stub.exe
2012-10-19 01:23:10 157272 ----a-w- C:\Program Files (x86)\Mozilla Firefox\webapp-uninstaller.exe
2012-10-10 11:31:53 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2012-10-10 05:58:55 220160 ----a-w- C:\Windows\System32\wintrust.dll
2012-10-10 05:58:54 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-10-10 05:58:41 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-10-10 05:58:40 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-10-10 05:58:26 715776 ----a-w- C:\Windows\System32\kerberos.dll
2012-10-10 05:58:26 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll
2012-10-10 05:58:22 1464320 ----a-w- C:\Windows\System32\crypt32.dll
2012-10-10 05:58:22 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-10-10 05:58:21 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-10-10 05:58:20 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-10-10 05:58:20 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-10-10 05:58:20 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
.
==================== Find3M ====================
.
2012-10-10 11:31:38 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-10-10 11:31:38 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-08-31 18:19:35 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-08-22 18:12:50 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-08-22 18:12:40 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys
2012-08-22 18:12:40 376688 ----a-w- C:\Windows\System32\drivers\netio.sys
2012-08-22 18:12:33 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
2012-08-21 21:01:00 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe
2012-08-20 18:48:44 362496 ----a-w- C:\Windows\System32\wow64win.dll
2012-08-20 18:48:44 243200 ----a-w- C:\Windows\System32\wow64.dll
2012-08-20 18:48:44 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2012-08-20 18:48:43 215040 ----a-w- C:\Windows\System32\winsrv.dll
2012-08-20 18:48:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2012-08-20 18:48:35 424448 ----a-w- C:\Windows\System32\KernelBase.dll
2012-08-20 18:46:22 338432 ----a-w- C:\Windows\System32\conhost.exe
2012-08-20 17:40:21 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2012-08-20 17:38:44 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2012-08-20 17:38:26 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2012-08-20 17:37:19 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2012-08-20 17:37:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2012-08-20 15:38:21 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2012-08-20 15:38:20 2048 ----a-w- C:\Windows\SysWow64\user.exe
2012-08-20 15:33:28 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-08-20 15:33:28 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-20 15:33:28 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-08-20 15:33:28 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 8:20:34.98 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 05 November 2012 - 01:10 PM

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.




These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

  • Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

--RogueKiller--

  • Download & SAVE to your Desktop RogueKiller or from here
  • Quit all programs that you may have started.
  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[1].txt on your Desktop
  • Exit/Close RogueKiller+

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 05 November 2012 - 10:21 PM

Results of screen317's Security Check version 0.99.54
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
McAfee Anti-Virus and Anti-Spyware
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
SpywareBlaster 4.4
Secunia PSI (2.0.0.4003)
Malwarebytes Anti-Malware version 1.65.1.1000
JavaFX 2.1.1
Java™ 6 Update 31
Java 7 Update 7
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.2.202.228 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader X 10.1.1 Adobe Reader out of Date!
Mozilla Firefox (16.0.2)
Google Chrome 21.0.1180.83
Google Chrome 21.0.1180.89
Google Chrome 22.0.1229.79
Google Chrome 22.0.1229.92
Google Chrome 22.0.1229.94
````````Process Check: objlist.exe by Laurent````````
WinPatrol winpatrol.exe
BillP Studios WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

# AdwCleaner v2.006 - Logfile created 11/05/2012 at 22:10:20
# Updated 30/10/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Rob - MAIN
# Boot Mode : Normal
# Running from : C:\Users\Rob\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : WajamUpdater

***** [Files / Folders] *****

File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\searchplugins\funmoods.xml
File Deleted : C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\searchplugins\mywebsearch.xml
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\Dogpile Bundle Toolbar
Folder Deleted : C:\Program Files (x86)\Funmoods
Folder Deleted : C:\Program Files (x86)\Wajam
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\Users\Rob\AppData\Local\Wajam
Folder Deleted : C:\Users\Rob\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Rob\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Rob\AppData\LocalLow\Funmoods
Folder Deleted : C:\Users\Rob\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dogpile Bundle Toolbar
Folder Deleted : C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
Folder Deleted : C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\Funmoods
Key Deleted : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BFE4B5CB-63F7-4A51-9266-6167655D5B4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C80BDEB2-8735-44C6-BD55-A1CCD555667A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BFE4B5CB-63F7-4A51-9266-6167655D5B4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C80BDEB2-8735-44C6-BD55-A1CCD555667A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F78BF7A8-CF12-4DE7-A6DA-C463D1B539A7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0003491.Sandbox
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0003491.Sandbox.1
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.FCTB000060231Pos
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.FCTB000060231Pos.1
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.IEToolbar
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.IEToolbar.1
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.JSOptionsImpl
Key Deleted : HKLM\SOFTWARE\Classes\FCTB000060231.JSOptionsImpl.1
Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook
Key Deleted : HKLM\SOFTWARE\Classes\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\SOFTWARE\FCTB000060231
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}
Key Deleted : HKLM\Software\Wajam
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BFE4B5CB-63F7-4A51-9266-6167655D5B4F}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C80BDEB2-8735-44C6-BD55-A1CCD555667A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F78BF7A8-CF12-4DE7-A6DA-C463D1B539A7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C80BDEB2-8735-44C6-BD55-A1CCD555667A}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F78BF7A8-CF12-4DE7-A6DA-C463D1B539A7}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438 --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://searchfunmoods.com/?f=2&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438 --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (en-GB)

Profile name : default
File : C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\prefs.js

C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\user.js ... Deleted !

Deleted : user_pref("extensions.BabylonToolbar.admin", false);
Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Deleted : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Deleted : user_pref("extensions.BabylonToolbar.excTlbr", false);
Deleted : user_pref("extensions.BabylonToolbar.id", "dccd3804000000000000b8ac6fcd780d");
Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15641");
Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8");
Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=115036&tt=4312_[...]
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.88:10:11");
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationThankYouPage", true);
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationTime", 1351391191);
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationUserSettings.searchUserConifrmation", false[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationUserSettings.setHomepage", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationUserSettings.setNewTab", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.InstallationUserSettings.setSearch", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.active", true);
Deleted : user_pref("extensions.crossriderapp3491.3491.addressbar", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.backgroundver", 12);
Deleted : user_pref("extensions.crossriderapp3491.3491.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp3491.3491.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie.InstallationTime.value", "1351391191");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_aoi.value", "1351391191");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_blocklist.expiration", "Mon Nov 05 2012 22:[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_country_code.expiration", "Mon Nov 12 2012 [...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_country_code.value", "%22US%22");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_crr.value", "1352170919");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_hotfix20111102645.value", "%221%22");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_parent_zoneid.value", "%2270036%22");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_pc_20120828.value", "1351391221541");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_product_id.value", "%221250%22");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie._GPL_zoneid.value", "%2299029%22");
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.cookie.dbtest.value", "1351391220178");
Deleted : user_pref("extensions.crossriderapp3491.3491.description", "Vid-Saver allows you to download your fa[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.domain", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.group", 0);
Deleted : user_pref("extensions.crossriderapp3491.3491.homepage", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.iframe", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.InstallerIdentifiers.expiration", "Fri Feb 0[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.InstallerIdentifiers.value", "%7B%22installe[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_appVer.value", "55");
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_nextCheck.expiration", "Tue Nov 06[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.SoftwareDetected.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.name", "Vid-Saver");
Deleted : user_pref("extensions.crossriderapp3491.3491.newtab", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.opensearch", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000014.ver", 7);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000015.name", "GPL Background (BG)");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_1000015.ver", 4);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_15.code", "(function(f){var u={};var e=M[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_16.code", "(function(f,B){if(typeof(B)==[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_16.ver", 3);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins_lists.plugins_0", "17,14,16,47,1000015");
Deleted : user_pref("extensions.crossriderapp3491.3491.plugins_lists.plugins_1", "17,14,13,16,15,1000014");
Deleted : user_pref("extensions.crossriderapp3491.3491.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]
Deleted : user_pref("extensions.crossriderapp3491.3491.pluginsversion", 16);
Deleted : user_pref("extensions.crossriderapp3491.3491.publisher", "215 Apps");
Deleted : user_pref("extensions.crossriderapp3491.3491.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp3491.3491.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp3491.3491.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp3491.3491.thankyou", "hxxp://vid-saver.com/thankyou.html");
Deleted : user_pref("extensions.crossriderapp3491.3491.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp3491.3491.ver", 55);
Deleted : user_pref("extensions.crossriderapp3491.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp3491.apps", "3491");
Deleted : user_pref("extensions.crossriderapp3491.bic", "13aa5318df9813dad53d6d6a4eef237c");
Deleted : user_pref("extensions.crossriderapp3491.cid", 3491);
Deleted : user_pref("extensions.crossriderapp3491.firstrun", false);
Deleted : user_pref("extensions.crossriderapp3491.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp3491.installationdate", 1351391219);
Deleted : user_pref("extensions.crossriderapp3491.lastcheck", 22536182);
Deleted : user_pref("extensions.crossriderapp3491.lastcheckitem", 22536188);
Deleted : user_pref("extensions.crossriderapp3491.modetype", "production");
Deleted : user_pref("extensions.crossriderapp3491.reportInstall", true);
Deleted : user_pref("extensions.enabledAddons", "{000F1EA4-5E08-4564-A29B-29076F63A37A}:1.0.3.126,crossriderap[...]
Deleted : user_pref("extensions.funmoods.aflt", "aln");
Deleted : user_pref("extensions.funmoods.autoRvrt", false);
Deleted : user_pref("extensions.funmoods.brwsrsrc", "ietlbr");
Deleted : user_pref("extensions.funmoods.cntry", "US");
Deleted : user_pref("extensions.funmoods.cv", "cv5");
Deleted : user_pref("extensions.funmoods.dfltLng", "");
Deleted : user_pref("extensions.funmoods.dfltSrch", true);
Deleted : user_pref("extensions.funmoods.dfltlng", "en");
Deleted : user_pref("extensions.funmoods.dfltsrch", true);
Deleted : user_pref("extensions.funmoods.dnsErr", true);
Deleted : user_pref("extensions.funmoods.envrmnt", "production");
Deleted : user_pref("extensions.funmoods.excTlbr", false);
Deleted : user_pref("extensions.funmoods.hdrMd5", "1A7F423FC430F4CA1294CA51C8990F9E");
Deleted : user_pref("extensions.funmoods.hmpg", true);
Deleted : user_pref("extensions.funmoods.hmpgUrl", "hxxp://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2[...]
Deleted : user_pref("extensions.funmoods.hrdid", "B8AC6FCD780D3804");
Deleted : user_pref("extensions.funmoods.id", "B8AC6FCD780D3804");
Deleted : user_pref("extensions.funmoods.instlDay", "15640");
Deleted : user_pref("extensions.funmoods.instlRef", "aln");
Deleted : user_pref("extensions.funmoods.instlday", "15640");
Deleted : user_pref("extensions.funmoods.instlref", "aln");
Deleted : user_pref("extensions.funmoods.isdcmntcmplt", true);
Deleted : user_pref("extensions.funmoods.keywordurl", "");
Deleted : user_pref("extensions.funmoods.lastVrsnTs", "1.5.23.2222:26:26");
Deleted : user_pref("extensions.funmoods.mntrvrsn", "1.3.0");
Deleted : user_pref("extensions.funmoods.newTab", true);
Deleted : user_pref("extensions.funmoods.newTabUrl", "hxxp://searchfunmoods.com/?f=2&a=aln&chnl=aln&cd=2XzuyEt[...]
Deleted : user_pref("extensions.funmoods.newtab", true);
Deleted : user_pref("extensions.funmoods.newtaburl", "hxxp://searchfunmoods.com/?f=2&a=aln&chnl=aln&cd=2XzuyEt[...]
Deleted : user_pref("extensions.funmoods.prdct", "funmoods");
Deleted : user_pref("extensions.funmoods.prtnrId", "funmoods");
Deleted : user_pref("extensions.funmoods.prtnrid", "funmoods");
Deleted : user_pref("extensions.funmoods.savedVrsnTs", "1");
Deleted : user_pref("extensions.funmoods.sg", "none");
Deleted : user_pref("extensions.funmoods.smplGrp", "none");
Deleted : user_pref("extensions.funmoods.smplgrp", "none");
Deleted : user_pref("extensions.funmoods.srch", "");
Deleted : user_pref("extensions.funmoods.srchPrvdr", "Search");
Deleted : user_pref("extensions.funmoods.srchprvdr", "Search");
Deleted : user_pref("extensions.funmoods.tlbrId", "base");
Deleted : user_pref("extensions.funmoods.tlbrSrchUrl", "hxxp://searchfunmoods.com/?f=3&a=aln&chnl=aln&cd=2Xzuy[...]
Deleted : user_pref("extensions.funmoods.tlbrid", "base");
Deleted : user_pref("extensions.funmoods.tlbrsrchurl", "hxxp://searchfunmoods.com/?f=3&a=aln&chnl=aln&cd=2Xzuy[...]
Deleted : user_pref("extensions.funmoods.vrsn", "1.5.23.22");
Deleted : user_pref("extensions.funmoods.vrsnTs", "1.5.23.2222:26:26");
Deleted : user_pref("extensions.funmoods.vrsni", "1.5.23.22");
Deleted : user_pref("extensions.funmoods.vrsnts", "1.5.23.2222:26:26");
Deleted : user_pref("extensions.funmoods_i.newTab", true);
Deleted : user_pref("extensions.funmoods_i.smplGrp", "none");
Deleted : user_pref("extensions.funmoods_i.vrsnTs", "1.5.23.2222:26:26");
Deleted : user_pref("extensions.mywebsearch.openSearchURL", "hxxp://search.mywebsearch.com/mywebsearch/opensea[...]
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.yahoo.com/search?fr=mcafee&p=");
Deleted : user_pref("playsushi.position.button", true);

*************************

AdwCleaner[S1].txt - [31164 octets] - [05/11/2012 22:10:20]

########## EOF - C:\AdwCleaner[S1].txt - [31225 octets] ##########

RogueKiller V8.2.2 [11/03/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website: http://tigzy.geekstogo.com/roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Rob [Admin rights]
Mode : Scan -- Date : 11/05/2012 22:14:53

Bad processes : 0

Registry Entries : 14
[RUN][BLACKLIST DLL] HKLM\[...]\Run : RunDLLEntry_THXCfg (C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64) -> FOUND
[RUN][BLACKLIST DLL] HKLM\[...]\Run : RunDLLEntry_EptMon (C:\Windows\system32\RunDLL32.exe C:\Windows\system32\EptMon64.dll,RunDLLEntry EptMon64) -> FOUND
[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowVideos (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

Particular Files / Folders:

Driver : [NOT LOADED]

Infection : Root.MBR

HOSTS File:
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost


MBR Check:

+++++ PhysicalDrive0: WDC WD1001FAES-75W7A0 +++++
--- User ---
[MBR] 3be8d77f4a4a967a128cff04f41eb711
[BSP] 4556c1c5d7172108693fe5d86725391e : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 11142 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 22900736 | Size: 942672 Mo
User != LL1 ... KO!
--- LL1 ---
[MBR] 1a5d9c36848dfbf83ba820070b734d02
[BSP] 4556c1c5d7172108693fe5d86725391e : Windows Vista MBR Code [possible maxSST in 3!]
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 11142 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 22900736 | Size: 942672 Mo
3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 1953495040 | Size: 10 Mo
User != LL2 ... KO!
--- LL2 ---
[MBR] 1a5d9c36848dfbf83ba820070b734d02
[BSP] 4556c1c5d7172108693fe5d86725391e : Windows Vista MBR Code [possible maxSST in 3!]
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 11142 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 22900736 | Size: 942672 Mo
3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 1953495040 | Size: 10 Mo

Finished : << RKreport[1]_S_11052012_02d2214.txt >>
RKreport[1]_S_11052012_02d2214.txt

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 05 November 2012 - 10:27 PM

Greetings

I need you to make a bootable usb and to make a screenshot for me - follow the instructions below to do this

How to create a bootable Puppy USB Drive

  • Download and save a copy of the latest Puppy ISO file
  • Download and save a copy of Unetbootin for Windows.
  • Insert an empty formatted USB drive into a USB port on the computer that's being used to create the bootable USB.
  • Launch Unetbootin ....
  • Ensure that Disk Image is selected.
  • Using the browse button ... browse to and select the Puppy ISO file.
  • Ensure that Type: is set to USB Drive and that the Drive: letter corresponds to the USB drive.
  • Click OK
Unetbootin will now copy the Puppy files to the USB and make it a bootable device.

Next

You need to change the boot order of the computer to boot from a USB drive ....

  • Read HERE for instructions how to do this.

Now boot into Puppylinux

when you get to the desktop Click on each of the drive items found in the bottom left corner to mount them (when mounted they will have a red cross next to them)

Next - Launch GParted which is found at Menu > System > GParted partition manager,
Click to select All Drives then click Okay
I need you to take a screenshot of the window that opens up - to do this follow these instructions

To take a screenshot in Puppy ....

With the GParted window open ...

  • Click menu > Graphic > mtPaint-snapshot screen capture
  • A small window will open ....

    • Click Capture Now
    • Click OK
  • The mtPaint program will open ....
    • Click File > Save
    • Double click on ../
    • Double click on mnt/
    • Double click on sdb1/
    • Set File Format to JPEG
    • Enter screenshot1 into the text box
    • Click OK

This will save a file screenshot1.jpeg into the USB drive, paste or attach this to your next post

Next

  • Click menu > shutdown > power off computer
  • If prompted to save the session click on No

Puppy will now close down.

remove the usb and save it - we will use it again - boot back into windows and send me the screen capture

gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 07 November 2012 - 01:34 PM

Couldn't paste the screenshot, so I am attaching it.

Attached Files



#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 07 November 2012 - 05:11 PM

Hello

NOTE** Please read completely before proceeding

I want you to boot back into GParted and I want you to right click on the 2nd partition (SDA2) and select manage flags - then select boot

click on apply and exit out of gparted and boot back into windows and report back here

NOTE** if you have trouble booting into windows then I want you to do the same procedure for the 3rd partition (SDA3)

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 07 November 2012 - 06:33 PM

I followed the instructions regarding GParted and the 2nd partition.
I am reporting back

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 07 November 2012 - 07:30 PM

very good Now I would like you to boot back into GParted one last time and this time right click on the hidden partition (SDA4) and select delete

click on apply and boot back into windows and report back here please
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 07 November 2012 - 11:29 PM

hidden partition was deleted

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 07 November 2012 - 11:40 PM

Hello

How are things doing now?

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 09 November 2012 - 06:58 PM

Below is the log from Combofix. Firefox redirects from google searches are even worse now. My browser speed is good, though



ComboFix 12-11-09.02 - Rob 11/09/2012 18:37:19.4.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8183.6638 [GMT -5:00]
Running from: c:\users\Rob\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Vid-Saver
c:\program files (x86)\Vid-Saver\ButtonUtil.dll
c:\program files (x86)\Vid-Saver\Vid-Saver-bg.exe
c:\program files (x86)\Vid-Saver\Vid-Saver.exe
c:\program files (x86)\Vid-Saver\Vid-Saver.ico
c:\program files (x86)\Vid-Saver\Vid-Saver.ini
c:\program files (x86)\Vid-Saver\Vid-SaverInstaller.log
c:\programdata\c4d3f03
c:\users\Rob\AppData\Local\Vid-Saver
c:\users\Rob\AppData\Local\Vid-Saver\Chrome\Vid-Saver.crx
.
.
((((((((((((((((((((((((( Files Created from 2012-10-09 to 2012-11-09 )))))))))))))))))))))))))))))))
.
.
2012-11-09 23:42 . 2012-11-09 23:42 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-11-09 23:42 . 2012-11-09 23:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-05 12:03 . 2012-11-05 12:03 -------- d-----w- c:\program files (x86)\PLX Technology
2012-11-05 12:02 . 2010-05-25 13:14 31280 ----a-w- c:\windows\system32\drivers\OXUDIDRV_x64.sys
2012-11-05 12:02 . 2012-11-05 12:02 -------- d-----w- c:\program files\Iomega
2012-11-05 12:02 . 2012-11-05 12:02 -------- d-----w- c:\users\Rob\AppData\Local\Downloaded Installations
2012-11-05 02:07 . 2012-11-05 02:07 -------- d-----w- c:\program files (x86)\Runtime Software
2012-11-03 18:50 . 2012-11-03 18:55 -------- d-----w- c:\program files (x86)\Cobian Backup 11
2012-10-28 02:26 . 2012-10-28 02:30 -------- d-----w- c:\users\Rob\AppData\Roaming\.minecraft
2012-10-27 04:51 . 2012-10-19 01:23 261600 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\components\browsercomps.dll
2012-10-27 04:51 . 2012-10-19 01:23 73696 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\breakpadinjector.dll
2012-10-27 04:51 . 2012-10-19 01:23 18912 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\AccessibleMarshal.dll
2012-10-21 19:45 . 2012-10-21 19:45 -------- d-----w- c:\program files (x86)\MSECache
2012-10-19 01:23 . 2012-10-28 02:26 96224 ----a-w- c:\program files (x86)\Mozilla Firefox\webapprt-stub.exe
2012-10-19 01:23 . 2012-10-28 02:26 157272 ----a-w- c:\program files (x86)\Mozilla Firefox\webapp-uninstaller.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-10 11:31 . 2012-10-10 11:31 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-10-10 11:31 . 2012-08-17 13:06 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-10-10 11:31 . 2010-09-14 19:05 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-10-10 07:01 . 2010-09-24 18:23 65309168 ----a-w- c:\windows\system32\MRT.exe
2012-09-14 19:19 . 2012-10-10 05:58 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-10 05:58 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-08-31 18:19 . 2012-10-10 05:59 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 18:03 . 2012-10-10 05:59 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-10 05:59 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 05:59 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-08-24 18:05 . 2012-10-10 05:58 220160 ----a-w- c:\windows\system32\wintrust.dll
2012-08-24 16:57 . 2012-10-10 05:58 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-08-24 11:15 . 2012-09-23 07:00 17810944 ----a-w- c:\windows\system32\mshtml.dll
2012-08-24 10:39 . 2012-09-23 07:00 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-08-24 10:31 . 2012-09-23 07:00 2312704 ----a-w- c:\windows\system32\jscript9.dll
2012-08-24 10:22 . 2012-09-23 07:00 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-08-24 10:21 . 2012-09-23 07:00 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-08-24 10:20 . 2012-09-23 07:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 10:18 . 2012-09-23 07:00 237056 ----a-w- c:\windows\system32\url.dll
2012-08-24 10:17 . 2012-09-23 07:00 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-08-24 10:14 . 2012-09-23 07:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 10:14 . 2012-09-23 07:00 816640 ----a-w- c:\windows\system32\jscript.dll
2012-08-24 10:13 . 2012-09-23 07:00 599040 ----a-w- c:\windows\system32\vbscript.dll
2012-08-24 10:12 . 2012-09-23 07:00 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-08-24 10:11 . 2012-09-23 07:00 729088 ----a-w- c:\windows\system32\msfeeds.dll
2012-08-24 10:10 . 2012-09-23 07:00 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-08-24 10:09 . 2012-09-23 07:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-08-24 10:04 . 2012-09-23 07:00 248320 ----a-w- c:\windows\system32\ieui.dll
2012-08-24 06:59 . 2012-09-23 07:00 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-08-24 06:51 . 2012-09-23 07:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-08-24 06:51 . 2012-09-23 07:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-08-24 06:47 . 2012-09-23 07:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-08-24 06:47 . 2012-09-23 07:00 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-08-24 06:43 . 2012-09-23 07:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-08-22 18:12 . 2012-09-12 02:20 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 18:12 . 2012-09-12 02:20 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 18:12 . 2012-09-12 02:20 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 18:12 . 2012-09-12 02:20 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-21 21:01 . 2012-09-26 17:53 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-08-20 18:48 . 2012-10-10 05:59 243200 ----a-w- c:\windows\system32\wow64.dll
2012-08-20 18:48 . 2012-10-10 05:59 362496 ----a-w- c:\windows\system32\wow64win.dll
2012-08-20 18:48 . 2012-10-10 05:59 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2012-08-20 18:48 . 2012-10-10 05:59 215040 ----a-w- c:\windows\system32\winsrv.dll
2012-08-20 18:48 . 2012-10-10 05:59 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2012-08-20 18:48 . 2012-10-10 05:59 424448 ----a-w- c:\windows\system32\KernelBase.dll
2012-08-20 18:48 . 2012-10-10 05:59 1162240 ----a-w- c:\windows\system32\kernel32.dll
2012-08-20 18:46 . 2012-10-10 05:59 338432 ----a-w- c:\windows\system32\conhost.exe
2012-08-20 18:38 . 2012-10-10 05:59 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-08-20 18:38 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-08-20 17:40 . 2012-10-10 05:59 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2012-08-20 17:38 . 2012-10-10 05:59 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-08-20 17:38 . 2012-10-10 05:59 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2012-08-20 17:37 . 2012-10-10 05:59 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2012-08-20 17:37 . 2012-10-10 05:59 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll
2012-08-20 17:32 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-08-20 17:32 . 2012-10-10 05:59 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2011-05-15 325512]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2011-08-24 651832]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-09-25 560128]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v2.0.50727_6432;Microsoft .NET Framework NGEN v2.0.50727_X64 ;c:\programdata\wlancfg32.exe [x]
R2 clr_optimization_v4.0.30319_3232;Microsoft .NET Framework NGEN v4.0.30319_X86 ;c:\programdata\wshirda32.exe [x]
R2 clr_optimization_v4.0.30319_323232;Microsoft .NET Framework NGEN v4.0.30319_X86 ;c:\programdata\printui32.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 clr_optimization_v4.0.30319_6432;Microsoft .NET Framework NGEN v4.0.30319_X64 ;c:\programdata\utildll32.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [2010-09-03 227232]
R3 OXSDIDRV_x64;Oxford Semi eSATA Filter (x64);c:\windows\system32\DRIVERS\OXSDIDRV_x64.sys [2009-09-28 51760]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-23 1255736]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-17 203264]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [2012-01-13 103440]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2011-08-24 430136]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-03-12 242720]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-11-28 295424]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 23:31]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22 16:17]
.
2012-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22 16:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-23 10081312]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - ExtSQL: 2012-10-27 22:26; [email protected]; c:\users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Dogpile Bundle Toolbar - c:\program files (x86)\Dogpile Bundle Toolbar\Uninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1749379041-22199340-4008944452-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1749379041-22199340-4008944452-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-11-09 18:44:03
ComboFix-quarantined-files.txt 2012-11-09 23:44
.
Pre-Run: 759,799,271,424 bytes free
Post-Run: 760,670,375,936 bytes free
.
- - End Of File - - A4ACC0DAD5C43D7075FC09178B24463B

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 10 November 2012 - 02:08 AM

Hello

Lets get a deeper look into the system and see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened and the that I need posted back here
    • Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
  • Please post the contents of OTL.txt in your next reply.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 10 November 2012 - 04:56 PM

OTL logfile created on: 11/10/2012 4:44:58 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Rob\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.99 Gb Total Physical Memory | 6.12 Gb Available Physical Memory | 76.62% Memory free
15.98 Gb Paging File | 12.92 Gb Available in Paging File | 80.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 920.58 Gb Total Space | 707.10 Gb Free Space | 76.81% Space Free | Partition Type: NTFS

Computer Name: MAIN | User Name: Rob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Rob\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - c:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe (SoftThinks - Dell)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\McAfee Security Scan\2.1.121\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\761fd1afc17f11bf6d49c3a7d16465ca\System.Web.Services.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\635b3aec298ad5e8c903b2323d79cc5a\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\BillP Studios\WinPatrol\sqlite3.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\SdbShared.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\SdbShared.XmlSerializers.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\SdbUI.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\BalloonWindow.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Online\CppUtils.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (mfevtp) -- C:\Windows\SysNative\mfevtps.exe (McAfee, Inc.)
SRV:64bit: - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV:64bit: - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV:64bit: - (MSK80Service) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McProxy) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (mcpltsvc) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNaiAnn) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McMPFSvc) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (HomeNetSvc) -- C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (mfecore) -- C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (DockLoginService) -- C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (McAfee SiteAdvisor Service) -- c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe (McAfee, Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (PMBDeviceInfoProvider) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (SoftThinks SAS)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (GoToAssist) -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe (McAfee, Inc.)
SRV - (MOBKbackup) -- C:\Program Files (x86)\McAfee Online Backup\MOBKbackup.exe (McAfee, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (RoxMediaDB10) -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe (Sonic Solutions)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (cfwids) -- C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.)
DRV:64bit: - (mfewfpk) -- C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.)
DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (mfefirek) -- C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfeapfk) -- C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.)
DRV:64bit: - (mfencrk) -- C:\Windows\SysNative\drivers\mfencrk.sys (McAfee, Inc.)
DRV:64bit: - (mfencbdc) -- C:\Windows\SysNative\drivers\mfencbdc.sys (McAfee, Inc.)
DRV:64bit: - (HipShieldK) -- C:\Windows\SysNative\drivers\HipShieldK.sys (McAfee, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (MOBKFilter) -- C:\Windows\SysNative\drivers\MOBK.sys (Mozy, Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (OXSDIDRV_x64) -- C:\Windows\SysNative\drivers\OXSDIDRV_x64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (RxFilter) -- C:\Windows\SysWOW64\drivers\RxFilter.sys (Sonic Solutions)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
IE:64bit: - HKLM\..\SearchScopes\{500C247F-33E4-4DB8-82E8-8FF49BCEC2CA}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{196EE42B-5C61-91B6-B322-4738FBB9E770}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 33 BB 88 00 55 AD AA 46 AC 05 EE D5 9A B1 69 94 [binary data]
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {544F32E6-5618-471C-B429-0C1B36742EE4}
IE - HKCU\..\SearchScopes\{02987B97-2BDE-436E-B6E6-BBE1BDF14B34}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true& user_id=%userid&tool_id=60231&qkw={searchTerms}
IE - HKCU\..\SearchScopes\{196EE42B-5C61-91B6-B322-4738FBB9E770}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}
IE - HKCU\..\SearchScopes\{544F32E6-5618-471C-B429-0C1B36742EE4}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
IE - HKCU\..\SearchScopes\{75EE8510-3202-41A2-B965-18FA2513C86B}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=66C186BA-7B51-4A50-9AC5-4B9613AE0D80&apn_sauid=D171BAE5-208E-4065-B98D-B642EAE9534F
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: {000F1EA4-5E08-4564-A29B-29076F63A37A}:1.0.3.126
FF - prefs.js..extensions.enabledAddons: [email protected]:0.85.55
FF - prefs.js..extensions.enabledAddons: [email protected]:2.5
FF - prefs.js..extensions.enabledAddons: {4ED1F68A-5463-4931-9384-8FFF5ED91D92}:3.5.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {000F1EA4-5E08-4564-A29B-29076F63A37A}:1.0.3.126
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.2.1
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@soe.sony.com/installer,version=1.0.3: C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}\plugins\npsoe.dll ()
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Rob\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012/11/09 19:48:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/27 21:26:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/17 08:06:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\McAfee\MSK [2012/11/09 19:31:44 | 000,000,000 | ---D | M]

[2010/09/22 00:22:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Extensions
[2012/11/05 22:10:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions
[2010/09/26 15:04:32 | 000,000,000 | ---D | M] () -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\{000F1EA4-5E08-4564-A29B-29076F63A37A}
[2012/10/27 21:26:40 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
[2012/10/27 21:26:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content\extensionCode
[1832/11/28 23:15:48 | 000,004,816 | ---- | M] () (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
[2012/11/03 13:59:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/11/09 19:48:08 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES (X86)\MCAFEE\SITEADVISOR
[2012/10/27 21:26:52 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/04/14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011/03/18 13:32:12 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
[2012/06/24 15:49:52 | 000,001,525 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/09/09 12:50:13 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/06/24 15:49:52 | 000,000,935 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/06/24 15:49:52 | 000,001,166 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/12/26 06:14:56 | 000,002,024 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2012/10/18 20:23:08 | 000,002,058 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
[2012/06/24 15:49:52 | 000,001,121 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/11/09 18:42:39 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [mcpltui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe (Dell)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4662807B-87DE-4687-A53D-4A01E05AAA66}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/09 20:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2012/11/09 19:35:45 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/11/09 19:31:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfeeMOBK
[2012/11/09 19:31:46 | 000,197,264 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\HipShieldK.sys
[2012/11/09 19:31:46 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Online Backup
[2012/11/09 19:31:45 | 000,066,040 | ---- | C] (Mozy, Inc.) -- C:\Windows\SysNative\drivers\MOBK.sys
[2012/11/09 19:31:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Online Backup
[2012/11/09 19:31:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee.com
[2012/11/09 19:30:57 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee.com
[2012/11/09 19:30:57 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2012/11/09 19:23:00 | 000,177,680 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe
[2012/11/09 19:22:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\McAfee
[2012/11/09 18:44:05 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/11/09 18:34:35 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/11/09 18:34:35 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/11/09 18:34:35 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/11/09 18:34:29 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/11/09 18:21:28 | 004,998,937 | R--- | C] (Swearware) -- C:\Users\Rob\Desktop\ComboFix.exe
[2012/11/06 21:18:42 | 005,145,088 | ---- | C] (Geza Kovacs) -- C:\Users\Rob\Desktop\unetbootin-windows-581.exe
[2012/11/05 22:14:24 | 000,000,000 | ---D | C] -- C:\Users\Rob\Desktop\RK_Quarantine
[2012/11/05 07:03:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PLX Technology
[2012/11/05 07:02:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iomega
[2012/11/05 07:02:47 | 000,000,000 | ---D | C] -- C:\Program Files\Iomega
[2012/11/05 07:02:45 | 000,000,000 | ---D | C] -- C:\Users\Rob\AppData\Local\Downloaded Installations
[2012/11/04 21:07:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runtime Software
[2012/11/04 21:07:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Runtime Software
[2012/11/03 13:50:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cobian Backup 11
[2012/11/01 11:34:56 | 000,000,000 | ---D | C] -- C:\Users\Rob\Desktop\All sizes _ Pow Wow - Seneca Nation... Salamanca, NY _ Flickr - Photo Sharing!_files
[2012/10/29 08:30:30 | 000,069,672 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\cfwids.sys
[2012/10/29 08:27:26 | 000,339,392 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfewfpk.sys
[2012/10/29 08:25:16 | 000,771,096 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfehidk.sys
[2012/10/29 08:24:14 | 000,515,528 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfefirek.sys
[2012/10/29 08:23:24 | 000,309,400 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeavfk.sys
[2012/10/29 08:23:02 | 000,178,840 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeapfk.sys
[2012/10/27 21:26:41 | 000,000,000 | ---D | C] -- C:\Users\Rob\AppData\Roaming\.minecraft
[2012/10/21 14:45:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache
[2011/11/11 08:27:42 | 001,393,736 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Rob\gotomypc_626.exe
[2010/09/22 00:33:38 | 001,062,984 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Users\Rob\gotomypc_540.exe

========== Files - Modified Within 30 Days ==========

[2012/11/10 16:41:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/10 16:21:51 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/11/10 16:21:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/11/09 22:13:00 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/11/09 20:47:46 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/09 20:47:46 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/09 20:45:32 | 000,780,156 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/11/09 20:45:32 | 000,660,732 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/11/09 20:45:32 | 000,121,402 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/11/09 20:44:46 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Internet Security.lnk
[2012/11/09 20:40:00 | 2140,344,319 | -HS- | M] () -- C:\hiberfil.sys
[2012/11/09 18:42:39 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/11/09 18:21:28 | 004,998,937 | R--- | M] (Swearware) -- C:\Users\Rob\Desktop\ComboFix.exe
[2012/11/06 23:01:06 | 000,360,418 | ---- | M] () -- C:\Users\Rob\Desktop\screenshot1.jpg
[2012/11/06 21:18:55 | 005,145,088 | ---- | M] (Geza Kovacs) -- C:\Users\Rob\Desktop\unetbootin-windows-581.exe
[2012/11/06 21:17:42 | 139,005,952 | ---- | M] () -- C:\Users\Rob\Desktop\lupu-528.005.iso
[2012/11/05 21:50:58 | 000,430,592 | ---- | M] () -- C:\Users\Rob\Desktop\RogueKiller.exe
[2012/11/05 21:49:38 | 000,540,977 | ---- | M] () -- C:\Users\Rob\Desktop\adwcleaner.exe
[2012/11/05 21:37:33 | 000,881,833 | ---- | M] () -- C:\Users\Rob\Desktop\SecurityCheck.exe
[2012/11/05 08:09:07 | 000,000,000 | ---- | M] () -- C:\Users\Rob\defogger_reenable
[2012/11/05 07:02:48 | 000,002,767 | ---- | M] () -- C:\Users\Public\Desktop\Iomega Encryption.lnk
[2012/11/04 23:14:45 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.165
[2012/11/04 23:14:45 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.164
[2012/11/04 23:14:45 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.163
[2012/11/04 23:14:45 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.162
[2012/11/04 23:14:45 | 113,873,408 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.166
[2012/11/04 23:14:45 | 081,917,242 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.xml
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.161
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.160
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.159
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.158
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.157
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.156
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.155
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.154
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.153
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.152
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.151
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.150
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.149
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.148
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.147
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.146
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.145
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.144
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.143
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.142
[2012/11/04 23:14:44 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.141
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.140
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.139
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.138
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.137
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.136
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.135
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.134
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.133
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.132
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.131
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.130
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.129
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.128
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.127
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.126
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.125
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.124
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.123
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.122
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.121
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.120
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.119
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.118
[2012/11/04 23:14:43 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.117
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.116
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.115
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.114
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.113
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.112
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.111
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.110
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.109
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.108
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.107
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.106
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.105
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.104
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.103
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.102
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.101
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.100
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.099
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.098
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.097
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.096
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.095
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.094
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.093
[2012/11/04 23:14:42 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.092
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.091
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.090
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.089
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.088
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.087
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.086
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.085
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.084
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.083
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.082
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.081
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.080
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.079
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.078
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.077
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.076
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.075
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.074
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.073
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.072
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.071
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.070
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.069
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.068
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.067
[2012/11/04 23:14:41 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.066
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.065
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.064
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.063
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.062
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.061
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.060
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.059
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.058
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.057
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.056
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.055
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.054
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.053
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.052
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.051
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.050
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.049
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.048
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.047
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.046
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.045
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.044
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.043
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.042
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.041
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.040
[2012/11/04 23:14:40 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.039
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.038
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.037
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.036
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.035
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.034
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.033
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.032
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.031
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.030
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.029
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.028
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.027
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.026
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.025
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.024
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.023
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.022
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.021
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.020
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.019
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.018
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.017
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.016
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.015
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.014
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.013
[2012/11/04 23:14:39 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.012
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.dat
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.011
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.010
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.009
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.008
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.007
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.006
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.005
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.004
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.003
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.002
[2012/11/04 23:14:38 | 688,128,000 | ---- | M] () -- C:\Users\Rob\Documents\Drive_C.001
[2012/11/04 21:07:20 | 000,001,133 | ---- | M] () -- C:\Users\Rob\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/11/04 21:07:18 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/11/03 22:16:45 | 002,258,806 | ---- | M] () -- C:\Users\Rob\Desktop\IMG.jpg
[2012/11/03 19:23:41 | 000,043,532 | ---- | M] () -- C:\Users\Rob\Desktop\figure1longhouselg.gif
[2012/11/01 11:53:48 | 000,035,157 | ---- | M] () -- C:\Users\Rob\Desktop\seneca-pow-wow-page-2-copy.jpg
[2012/11/01 11:49:46 | 000,054,176 | ---- | M] () -- C:\Users\Rob\Desktop\320px-Iroquois_6_Nations_map_c1720.png
[2012/11/01 11:47:33 | 000,245,576 | ---- | M] () -- C:\Users\Rob\Desktop\SENECA-POWWOW.jpg
[2012/11/01 11:44:30 | 000,025,506 | ---- | M] () -- C:\Users\Rob\Desktop\natives.jpg
[2012/11/01 11:37:32 | 000,094,208 | ---- | M] () -- C:\Users\Rob\Desktop\All sizes _ Pow Wow - Seneca Nation... Salamanca, NY _ Flickr - Photo Sharing!.htm
[2012/11/01 11:29:35 | 000,018,710 | ---- | M] () -- C:\Users\Rob\Desktop\us-ny-Seneca.jpg
[2012/11/01 11:26:45 | 000,153,466 | ---- | M] () -- C:\Users\Rob\Documents\New Photo Print.el6
[2012/11/01 10:10:06 | 000,003,079 | ---- | M] () -- C:\Users\Rob\Desktop\club.jpg
[2012/11/01 10:09:35 | 000,006,329 | ---- | M] () -- C:\Users\Rob\Desktop\war club.jpg
[2012/11/01 10:07:02 | 000,006,166 | ---- | M] () -- C:\Users\Rob\Desktop\stone hammer.jpg
[2012/11/01 10:05:19 | 000,066,569 | ---- | M] () -- C:\Users\Rob\Desktop\Philip's-war-club.jpg
[2012/11/01 07:56:49 | 000,008,110 | ---- | M] () -- C:\Users\Rob\Documents\seneca.jpg
[2012/10/31 14:41:47 | 000,167,836 | ---- | M] () -- C:\Users\Rob\Desktop\Cornplanter.jpg
[2012/10/29 20:57:27 | 000,101,845 | ---- | M] () -- C:\Users\Rob\Desktop\144983.700x700.jpg
[2012/10/29 10:48:38 | 000,320,688 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/10/29 09:36:04 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/29 08:30:30 | 000,069,672 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\cfwids.sys
[2012/10/29 08:27:26 | 000,339,392 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfewfpk.sys
[2012/10/29 08:27:16 | 000,177,680 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe
[2012/10/29 08:25:16 | 000,771,096 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfehidk.sys
[2012/10/29 08:24:14 | 000,515,528 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfefirek.sys
[2012/10/29 08:23:24 | 000,309,400 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeavfk.sys
[2012/10/29 08:23:02 | 000,178,840 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\drivers\mfeapfk.sys
[2012/10/28 17:00:01 | 000,108,267 | ---- | M] () -- C:\Users\Rob\Desktop\cclub2.jpg
[2012/10/28 16:59:47 | 000,034,948 | ---- | M] () -- C:\Users\Rob\Desktop\club 1.jpg
[2012/10/27 21:26:53 | 000,002,046 | ---- | M] () -- C:\Users\Rob\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/27 21:26:28 | 000,290,500 | ---- | M] () -- C:\Users\Rob\AppData\Local\funmoods-speeddial_sf.crx
[2012/10/24 22:23:15 | 000,053,607 | ---- | M] () -- C:\Users\Rob\Desktop\068.350x350.jpg
[2012/10/23 15:24:28 | 000,012,520 | ---- | M] () -- C:\Users\Rob\Documents\cartoon-frankenstein-12.gif
[2012/10/22 20:59:44 | 000,352,578 | ---- | M] () -- C:\Users\Rob\Documents\cute_cyclops_by_demonisha-d3i6c5i.jpg

========== Files Created - No Company Name ==========

[2012/11/09 19:32:08 | 000,001,846 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Internet Security.lnk
[2012/11/09 19:31:24 | 000,002,946 | ---- | C] () -- C:\Windows\SysNative\drivers\mfencbdc.inf
[2012/11/09 19:31:24 | 000,002,641 | ---- | C] () -- C:\Windows\SysNative\drivers\mfencrk.inf
[2012/11/09 18:34:35 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/11/09 18:34:35 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/11/09 18:34:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/11/09 18:34:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/11/09 18:34:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/11/07 13:27:00 | 000,360,418 | ---- | C] () -- C:\Users\Rob\Desktop\screenshot1.jpg
[2012/11/06 20:40:39 | 139,005,952 | ---- | C] () -- C:\Users\Rob\Desktop\lupu-528.005.iso
[2012/11/05 21:50:55 | 000,430,592 | ---- | C] () -- C:\Users\Rob\Desktop\RogueKiller.exe
[2012/11/05 21:49:34 | 000,540,977 | ---- | C] () -- C:\Users\Rob\Desktop\adwcleaner.exe
[2012/11/05 21:37:32 | 000,881,833 | ---- | C] () -- C:\Users\Rob\Desktop\SecurityCheck.exe
[2012/11/05 08:09:07 | 000,000,000 | ---- | C] () -- C:\Users\Rob\defogger_reenable
[2012/11/05 07:02:52 | 000,031,280 | ---- | C] () -- C:\Windows\SysNative\drivers\OXUDIDRV_x64.sys
[2012/11/05 07:02:48 | 000,002,767 | ---- | C] () -- C:\Users\Public\Desktop\Iomega Encryption.lnk
[2012/11/04 22:08:45 | 113,873,408 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.166
[2012/11/04 22:08:34 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.165
[2012/11/04 22:08:26 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.164
[2012/11/04 22:08:21 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.163
[2012/11/04 22:08:01 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.162
[2012/11/04 22:07:31 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.161
[2012/11/04 22:07:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.160
[2012/11/04 22:07:11 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.159
[2012/11/04 22:07:09 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.158
[2012/11/04 22:06:50 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.157
[2012/11/04 22:06:12 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.156
[2012/11/04 22:06:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.155
[2012/11/04 22:05:53 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.154
[2012/11/04 22:05:44 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.153
[2012/11/04 22:05:42 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.152
[2012/11/04 22:05:21 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.151
[2012/11/04 22:04:59 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.150
[2012/11/04 22:04:44 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.149
[2012/11/04 22:04:36 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.148
[2012/11/04 22:04:26 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.147
[2012/11/04 22:04:17 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.146
[2012/11/04 22:04:08 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.145
[2012/11/04 22:04:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.144
[2012/11/04 22:03:50 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.143
[2012/11/04 22:03:41 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.142
[2012/11/04 22:03:32 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.141
[2012/11/04 22:03:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.140
[2012/11/04 22:03:13 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.139
[2012/11/04 22:03:04 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.138
[2012/11/04 22:02:59 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.137
[2012/11/04 22:02:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.136
[2012/11/04 22:02:24 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.135
[2012/11/04 22:02:09 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.134
[2012/11/04 22:01:45 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.133
[2012/11/04 22:01:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.132
[2012/11/04 22:01:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.131
[2012/11/04 22:00:38 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.130
[2012/11/04 22:00:16 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.129
[2012/11/04 21:59:58 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.128
[2012/11/04 21:59:38 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.127
[2012/11/04 21:59:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.126
[2012/11/04 21:58:50 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.125
[2012/11/04 21:58:26 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.124
[2012/11/04 21:58:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.123
[2012/11/04 21:57:42 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.122
[2012/11/04 21:57:20 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.121
[2012/11/04 21:57:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.120
[2012/11/04 21:56:38 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.119
[2012/11/04 21:56:16 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.118
[2012/11/04 21:55:54 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.117
[2012/11/04 21:55:32 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.116
[2012/11/04 21:55:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.115
[2012/11/04 21:54:52 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.114
[2012/11/04 21:54:30 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.113
[2012/11/04 21:54:10 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.112
[2012/11/04 21:53:49 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.111
[2012/11/04 21:53:26 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.110
[2012/11/04 21:53:06 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.109
[2012/11/04 21:52:44 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.108
[2012/11/04 21:52:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.107
[2012/11/04 21:52:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.106
[2012/11/04 21:51:40 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.105
[2012/11/04 21:51:20 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.104
[2012/11/04 21:50:57 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.103
[2012/11/04 21:50:35 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.102
[2012/11/04 21:50:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.101
[2012/11/04 21:49:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.100
[2012/11/04 21:49:24 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.099
[2012/11/04 21:48:46 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.098
[2012/11/04 21:48:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.097
[2012/11/04 21:47:58 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.096
[2012/11/04 21:47:34 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.095
[2012/11/04 21:47:08 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.094
[2012/11/04 21:46:40 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.093
[2012/11/04 21:46:15 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.092
[2012/11/04 21:45:48 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.091
[2012/11/04 21:45:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.090
[2012/11/04 21:44:58 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.089
[2012/11/04 21:44:32 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.088
[2012/11/04 21:44:10 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.087
[2012/11/04 21:43:46 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.086
[2012/11/04 21:43:22 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.085
[2012/11/04 21:42:58 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.084
[2012/11/04 21:42:37 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.083
[2012/11/04 21:42:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.082
[2012/11/04 21:41:48 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.081
[2012/11/04 21:41:24 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.080
[2012/11/04 21:41:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.079
[2012/11/04 21:40:37 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.078
[2012/11/04 21:40:12 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.077
[2012/11/04 21:39:48 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.076
[2012/11/04 21:39:24 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.075
[2012/11/04 21:39:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.074
[2012/11/04 21:38:37 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.073
[2012/11/04 21:38:12 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.072
[2012/11/04 21:37:51 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.071
[2012/11/04 21:37:28 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.070
[2012/11/04 21:37:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.069
[2012/11/04 21:36:40 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.068
[2012/11/04 21:36:16 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.067
[2012/11/04 21:35:52 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.066
[2012/11/04 21:35:27 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.065
[2012/11/04 21:34:46 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.064
[2012/11/04 21:34:26 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.063
[2012/11/04 21:34:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.062
[2012/11/04 21:33:36 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.061
[2012/11/04 21:33:10 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.060
[2012/11/04 21:32:46 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.059
[2012/11/04 21:32:24 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.058
[2012/11/04 21:32:00 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.057
[2012/11/04 21:31:30 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.056
[2012/11/04 21:31:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.055
[2012/11/04 21:30:38 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.054
[2012/11/04 21:30:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.053
[2012/11/04 21:29:51 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.052
[2012/11/04 21:29:06 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.051
[2012/11/04 21:28:46 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.050
[2012/11/04 21:28:25 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.049
[2012/11/04 21:28:02 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.048
[2012/11/04 21:27:38 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.047
[2012/11/04 21:27:14 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.046
[2012/11/04 21:26:50 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.045
[2012/11/04 21:26:25 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.044
[2012/11/04 21:26:03 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.043
[2012/11/04 21:25:42 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.042
[2012/11/04 21:25:15 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.041
[2012/11/04 21:25:06 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.040
[2012/11/04 21:24:57 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.039
[2012/11/04 21:24:48 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.038
[2012/11/04 21:24:39 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.037
[2012/11/04 21:24:30 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.036
[2012/11/04 21:24:20 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.035
[2012/11/04 21:24:12 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.034
[2012/11/04 21:24:04 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.033
[2012/11/04 21:24:01 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.032
[2012/11/04 21:23:39 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.031
[2012/11/04 21:23:17 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.030
[2012/11/04 21:22:53 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.029
[2012/11/04 21:22:33 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.028
[2012/11/04 21:22:13 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.027
[2012/11/04 21:21:51 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.026
[2012/11/04 21:21:28 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.025
[2012/11/04 21:21:07 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.024
[2012/11/04 21:20:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.023
[2012/11/04 21:20:27 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.022
[2012/11/04 21:20:07 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.021
[2012/11/04 21:19:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.020
[2012/11/04 21:19:29 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.019
[2012/11/04 21:19:07 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.018
[2012/11/04 21:18:44 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.017
[2012/11/04 21:18:15 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.016
[2012/11/04 21:17:55 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.015
[2012/11/04 21:17:34 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.014
[2012/11/04 21:17:13 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.013
[2012/11/04 21:16:49 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.012
[2012/11/04 21:16:25 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.011
[2012/11/04 21:15:59 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.010
[2012/11/04 21:15:36 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.009
[2012/11/04 21:15:10 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.008
[2012/11/04 21:14:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.007
[2012/11/04 21:14:17 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.006
[2012/11/04 21:13:45 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.005
[2012/11/04 21:13:19 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.004
[2012/11/04 21:12:57 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.003
[2012/11/04 21:11:37 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.002
[2012/11/04 21:10:41 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.001
[2012/11/04 21:09:47 | 688,128,000 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.dat
[2012/11/04 21:09:47 | 081,917,242 | ---- | C] () -- C:\Users\Rob\Documents\Drive_C.xml
[2012/11/04 21:07:20 | 000,001,133 | ---- | C] () -- C:\Users\Rob\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/11/04 21:07:18 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/11/03 22:15:27 | 002,258,806 | ---- | C] () -- C:\Users\Rob\Desktop\IMG.jpg
[2012/11/03 19:23:33 | 000,043,532 | ---- | C] () -- C:\Users\Rob\Desktop\figure1longhouselg.gif
[2012/11/01 11:53:48 | 000,035,157 | ---- | C] () -- C:\Users\Rob\Desktop\seneca-pow-wow-page-2-copy.jpg
[2012/11/01 11:49:46 | 000,054,176 | ---- | C] () -- C:\Users\Rob\Desktop\320px-Iroquois_6_Nations_map_c1720.png
[2012/11/01 11:47:33 | 000,245,576 | ---- | C] () -- C:\Users\Rob\Desktop\SENECA-POWWOW.jpg
[2012/11/01 11:44:30 | 000,025,506 | ---- | C] () -- C:\Users\Rob\Desktop\natives.jpg
[2012/11/01 11:35:13 | 000,094,208 | ---- | C] () -- C:\Users\Rob\Desktop\All sizes _ Pow Wow - Seneca Nation... Salamanca, NY _ Flickr - Photo Sharing!.htm
[2012/11/01 11:29:35 | 000,018,710 | ---- | C] () -- C:\Users\Rob\Desktop\us-ny-Seneca.jpg
[2012/11/01 10:10:06 | 000,003,079 | ---- | C] () -- C:\Users\Rob\Desktop\club.jpg
[2012/11/01 10:09:35 | 000,006,329 | ---- | C] () -- C:\Users\Rob\Desktop\war club.jpg
[2012/11/01 10:07:02 | 000,006,166 | ---- | C] () -- C:\Users\Rob\Desktop\stone hammer.jpg
[2012/11/01 10:05:18 | 000,066,569 | ---- | C] () -- C:\Users\Rob\Desktop\Philip's-war-club.jpg
[2012/11/01 07:56:49 | 000,008,110 | ---- | C] () -- C:\Users\Rob\Documents\seneca.jpg
[2012/10/31 14:41:47 | 000,167,836 | ---- | C] () -- C:\Users\Rob\Desktop\Cornplanter.jpg
[2012/10/29 20:57:27 | 000,101,845 | ---- | C] () -- C:\Users\Rob\Desktop\144983.700x700.jpg
[2012/10/28 17:00:01 | 000,108,267 | ---- | C] () -- C:\Users\Rob\Desktop\cclub2.jpg
[2012/10/28 16:59:47 | 000,034,948 | ---- | C] () -- C:\Users\Rob\Desktop\club 1.jpg
[2012/10/27 21:26:41 | 000,290,500 | ---- | C] () -- C:\Users\Rob\AppData\Local\funmoods-speeddial_sf.crx
[2012/10/24 22:23:15 | 000,053,607 | ---- | C] () -- C:\Users\Rob\Desktop\068.350x350.jpg
[2012/10/23 15:24:28 | 000,012,520 | ---- | C] () -- C:\Users\Rob\Documents\cartoon-frankenstein-12.gif
[2012/10/22 20:59:44 | 000,352,578 | ---- | C] () -- C:\Users\Rob\Documents\cute_cyclops_by_demonisha-d3i6c5i.jpg
[2012/10/21 14:46:00 | 000,002,543 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 07:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 76 bytes -> C:\Users\Rob\Desktop\figure1longhouselg.gif:Roxio EMC Stream
@Alternate Data Stream - 60 bytes -> C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo

< End of report >

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 135,821 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:10 AM

Posted 10 November 2012 - 05:40 PM

Hello

Run this custom script and when it is complete I need to know how the computer is doing

Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Posted Image textbox. Do not include the word Code
    :OTL
    IE - HKCU\..\URLSearchHook: - No CLSID value found
    FF - user.js - File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
    O4 - HKLM..\Run: [] File not found
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
    @Alternate Data Stream - 76 bytes -> C:\Users\Rob\Desktop\figure1longhouselg.gif:Roxio EMC Stream
    @Alternate Data Stream - 60 bytes -> C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo    
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://searchfunmoods.com/?f=1&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
    IE:64bit: - HKLM\..\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
    IE - HKLM\..\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
    IE - HKCU\..\SearchScopes\{02987B97-2BDE-436E-B6E6-BBE1BDF14B34}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true& user_id=%userid&tool_id=60231&qkw={searchTerms}
    IE - HKCU\..\SearchScopes\{544F32E6-5618-471C-B429-0C1B36742EE4}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=aln&chnl=aln&cd=2XzuyEtN2Y1L1Qzu0Bzz0A0CyC0F0C0DyBzztD0DtAzztDyEtN0D0Tzu0CtAtDtCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=740103438
    IE - HKCU\..\SearchScopes\{75EE8510-3202-41A2-B965-18FA2513C86B}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=66C186BA-7B51-4A50-9AC5-4B9613AE0D80&apn_sauid=D171BAE5-208E-4065-B98D-B642EAE9534F
    FF - prefs.js..extensions.enabledAddons: [email protected]:2.5
    [2012/10/27 21:26:40 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
    [2012/10/27 21:26:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content\extensionCode
    [1832/11/28 23:15:48 | 000,004,816 | ---- | M] () (No name found) -- C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]
    [2012/10/27 21:26:28 | 000,290,500 | ---- | M] () -- C:\Users\Rob\AppData\Local\funmoods-speeddial_sf.crx
    :Files
    ipconfig /flushdns /c
    :Commands
    [PURITY]
    [emptyjava]
    [EMPTYFLASH]
    
  • Then click the Run Fix button at the top.
  • Click Posted Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know How things are doing

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic


Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 DocMccoy

DocMccoy
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:05:10 AM

Posted 11 November 2012 - 07:30 AM

========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist\ deleted successfully.
ADS C:\Users\Rob\Desktop\figure1longhouselg.gif:Roxio EMC Stream deleted successfully.
ADS C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31B2267D-9A79-4494-96C4-37CE7C99ECDD}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{02987B97-2BDE-436E-B6E6-BBE1BDF14B34}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02987B97-2BDE-436E-B6E6-BBE1BDF14B34}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{544F32E6-5618-471C-B429-0C1B36742EE4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{544F32E6-5618-471C-B429-0C1B36742EE4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{75EE8510-3202-41A2-B965-18FA2513C86B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75EE8510-3202-41A2-B965-18FA2513C86B}\ not found.
Prefs.js: [email protected]:2.5 removed from extensions.enabledAddons
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\skin folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\locale\en-US folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\locale folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\defaults\preferences folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\defaults folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content\lib folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content\extensionCode folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome folder moved successfully.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected] folder moved successfully.
Folder C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected]\chrome\content\extensionCode\ not found.
C:\Users\Rob\AppData\Roaming\Mozilla\Firefox\Profiles\04qgfh5q.default\extensions\[email protected] moved successfully.
C:\Users\Rob\AppData\Local\funmoods-speeddial_sf.crx moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Rob\Desktop\cmd.bat deleted successfully.
C:\Users\Rob\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Public

User: Rob
->Java cache emptied: 761046 bytes

Total Java Files Cleaned = 1.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Rob
->Flash cache emptied: 436910 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 11112012_072144






Seems like the google search engine redirects have stopped




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users