Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Conduit redirect and Whitesmoke toolbar in Chrome


  • This topic is locked This topic is locked
23 replies to this topic

#1 GTRaines

GTRaines

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 02 August 2012 - 08:00 PM

I've spent a week trying to get rid of this counfounded Whitesmoke toolbar, but haven't been able to. It pops up every time I open Chrome, but not when I open Internet Explorer. Also, my Chrome homepage redirects to http://search.conduit.com/?ctid=CT3198785&SearchSource=48 whenever I open it. I have followed all the preliminary steps in the forum intro. DDS log below-Many Thanks:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Garett Raines at 20:39:49 on 2012-08-02
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6058.4317 [GMT -4:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe
C:\windows\system32\conhost.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\1Password\Agile1pService.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\windows\system32\LMabcoms.exe
C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\System32\TPHDEXLG64.exe
C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\windows\system32\wbem\unsecapp.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Windows\System32\TpShocks.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Lexmark\Monitor\ACJ\LMabMON.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Lexmark\ErrorApp\lmab1err.exe
C:\Users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\system32\wbem\unsecapp.exe
C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
C:\windows\system32\DllHost.exe
C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe
C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\windows\system32\taskhost.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Windows\System32\TpShocks.exe
C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
C:\Program Files\Lexmark\Monitor\ACJ\LMabMON.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe
C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe
C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\windows\system32\LogonUI.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
mStart Page = hxxp://lenovo.msn.com
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: EgisPBIE Class: {7b51ccbe-4af9-44a6-bdab-d7f7e4c4e6f9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: 1Password: {cb1a24da-7416-4921-a0cf-5aa1160aae2a} - C:\PROGRA~2\1PASSW~1\AGILE1~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [LMab1err] C:\Program Files\Lexmark\ErrorApp\LMab1err.exe
mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe /run
mRun: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"
mRun: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [PC Antivirus] "C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe" /minimize
mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\GARETT~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\GARETT~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: {00FAC6C9-C494-4AD8-B3C0-DE677AFDDBD8} - {5D7B119E-062F-476B-A5E7-797FAF554BA2} - C:\PROGRA~2\1PASSW~1\AGILE1~1.DLL
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{5E0FD0BF-5A2D-4329-93D8-7C61C3DC2A75} : DhcpNameServer = 65.32.5.111 65.32.5.112
TCP: Interfaces\{5E0FD0BF-5A2D-4329-93D8-7C61C3DC2A75}\16474777966696 : DhcpNameServer = 192.168.5.1
TCP: Interfaces\{5E0FD0BF-5A2D-4329-93D8-7C61C3DC2A75}\6456C696369647F65737F564275656F575966696F543F534573747F6D6562737 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{5E0FD0BF-5A2D-4329-93D8-7C61C3DC2A75}\66275656F557E637563657275646F577966696 : DhcpNameServer = 192.168.2.1 192.168.1.1
TCP: Interfaces\{867BD309-7BC3-4D23-AEF4-C6795DFFB5CD} : DhcpNameServer = 65.32.5.111 65.32.5.112
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: EgisPBIE Class: {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll
BHO-X64: EgisPBIE - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: 1Password: {CB1A24DA-7416-4921-A0CF-5AA1160AAE2A} - C:\PROGRA~2\1PASSW~1\AGILE1~1.DLL
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun-x64: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe /run
mRun-x64: [PLTSR] "C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe"
mRun-x64: [YouCam Mirage] "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
mRun-x64: [YouCam Tray] "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s
mRun-x64: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
mRun-x64: [UpdatePRCShortCut] "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [PC Antivirus] "C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe" /minimize
mRun-x64: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
============= SERVICES / DRIVERS ===============
.
R0 fbfmon;fbfmon;C:\windows\system32\drivers\fbfmon.sys --> C:\windows\system32\drivers\fbfmon.sys [?]
R0 LHDmgr;LHDmgr;C:\windows\system32\DRIVERS\LhdX64.sys --> C:\windows\system32\DRIVERS\LhdX64.sys [?]
R0 TPDIGIMN;TPDIGIMN;C:\windows\system32\DRIVERS\ApsHM64.sys --> C:\windows\system32\DRIVERS\ApsHM64.sys [?]
R1 BPntDrv;BPntDrv;C:\windows\system32\drivers\BPntDrv.sys --> C:\windows\system32\drivers\BPntDrv.sys [?]
R1 EgisTecFF;EgisTecFF;C:\windows\system32\DRIVERS\EgisTecFF.sys --> C:\windows\system32\DRIVERS\EgisTecFF.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 Agile1Password;1Password;C:\Program Files (x86)\1Password\Agile1pService.exe [2011-7-4 767240]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2011-2-27 499200]
R2 EgisTec Service Help;EgisTec Service Help;C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]
R2 EgisTec Service;EgisTec Service;C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]
R2 EgisTec Ticket Service;EgisTec Ticket Service;C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]
R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);C:\windows\system32\Drivers\FPSensor.sys --> C:\windows\system32\Drivers\FPSensor.sys [?]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-3-16 476728]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-5-18 2656280]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2011-2-27 885248]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;C:\windows\system32\DRIVERS\AcpiVpc.sys --> C:\windows\system32\DRIVERS\AcpiVpc.sys [?]
R3 bpenum;Intel® Centrino® WiMAX Enumerator;C:\windows\system32\DRIVERS\bpenum.sys --> C:\windows\system32\DRIVERS\bpenum.sys [?]
R3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\windows\system32\DRIVERS\bpmp.sys --> C:\windows\system32\DRIVERS\bpmp.sys [?]
R3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;C:\windows\system32\Drivers\bpusb.sys --> C:\windows\system32\Drivers\bpusb.sys [?]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\system32\DRIVERS\clwvd.sys --> C:\windows\system32\DRIVERS\clwvd.sys [?]
R3 IntcDAud;Intel® Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\windows\system32\DRIVERS\NETwNs64.sys --> C:\windows\system32\DRIVERS\NETwNs64.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUVStor.sys --> C:\windows\system32\Drivers\RtsUVStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SPUVCbv;SPUVCb Driver Service;C:\windows\system32\Drivers\usbvideo.sys --> C:\windows\system32\Drivers\usbvideo.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\windows\system32\DRIVERS\vwifimp.sys --> C:\windows\system32\DRIVERS\vwifimp.sys [?]
R3 wdkmd;Intel WiDi KMD;C:\windows\system32\DRIVERS\WDKMD.sys --> C:\windows\system32\DRIVERS\WDKMD.sys [?]
R3 WSDPrintDevice;WSD Print Support via UMB;C:\windows\system32\DRIVERS\WSDPrint.sys --> C:\windows\system32\DRIVERS\WSDPrint.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-18 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-12 250056]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\windows\system32\Drivers\ssadadb.sys --> C:\windows\system32\Drivers\ssadadb.sys [?]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-5-18 136176]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-2 340240]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\windows\system32\DRIVERS\ssadbus.sys --> C:\windows\system32\DRIVERS\ssadbus.sys [?]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\windows\system32\DRIVERS\ssadmdfl.sys --> C:\windows\system32\DRIVERS\ssadmdfl.sys [?]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\windows\system32\DRIVERS\ssadmdm.sys --> C:\windows\system32\DRIVERS\ssadmdm.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\system32\Drivers\usbaapl64.sys --> C:\windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S3 wsvd;wsvd;C:\windows\system32\DRIVERS\wsvd.sys --> C:\windows\system32\DRIVERS\wsvd.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-08-02 16:15:51 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2D7858E7-C7A3-443E-945B-D488BFC44258}\offreg.dll
2012-08-02 00:14:02 -------- d-----w- C:\Program Files (x86)\Runtime Software
2012-08-01 23:39:47 -------- d-sh--w- C:\$RECYCLE.BIN
2012-08-01 21:39:52 98816 ----a-w- C:\windows\sed.exe
2012-08-01 21:39:52 518144 ----a-w- C:\windows\SWREG.exe
2012-08-01 21:39:52 256000 ----a-w- C:\windows\PEV.exe
2012-08-01 21:39:52 208896 ----a-w- C:\windows\MBR.exe
2012-08-01 02:26:45 -------- d-----w- C:\Users\Garett Raines\AppData\Roaming\Malwarebytes
2012-08-01 02:26:36 -------- d-----w- C:\ProgramData\Malwarebytes
2012-08-01 02:26:35 24904 ----a-w- C:\windows\System32\drivers\mbam.sys
2012-08-01 02:26:35 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-31 10:09:31 -------- d-----w- C:\Users\Garett Raines\AppData\Local\CRE
2012-07-31 10:09:25 -------- d-----w- C:\Users\Garett Raines\AppData\Roaming\.minecraft
2012-07-31 10:09:22 -------- d-----w- C:\Program Files (x86)\Conduit
2012-07-31 10:09:20 -------- d-----w- C:\Users\Garett Raines\AppData\Local\Conduit
2012-07-31 10:06:00 9133488 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2D7858E7-C7A3-443E-945B-D488BFC44258}\mpengine.dll
2012-07-21 20:26:50 -------- d-----w- C:\Users\Garett Raines\AppData\Local\Yahoo!
2012-07-21 20:26:50 -------- d-----w- C:\Users\Garett Raines\AppData\Local\NanoService
2012-07-14 19:15:30 -------- d--h--w- C:\Users\Garett Raines\AppData\Roaming\RPPrivate
2012-07-12 01:52:26 3148800 ----a-w- C:\windows\System32\win32k.sys
2012-07-11 15:12:44 458704 ----a-w- C:\windows\System32\drivers\cng.sys
.
==================== Find3M ====================
.
2012-08-01 22:03:44 4273464 ----a-w- C:\windows\uninst.exe
2012-07-28 16:36:30 70344 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-28 16:36:30 426184 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2012-06-22 19:44:32 476936 ----a-w- C:\windows\SysWow64\npdeployJava1.dll
2012-06-22 19:44:32 472840 ----a-w- C:\windows\SysWow64\deployJava1.dll
2012-06-07 23:42:50 499712 ----a-w- C:\windows\SysWow64\msvcp71.dll
2012-06-07 23:42:50 348160 ----a-w- C:\windows\SysWow64\msvcr71.dll
2012-06-06 06:06:16 2004480 ----a-w- C:\windows\System32\msxml6.dll
2012-06-06 06:06:16 1881600 ----a-w- C:\windows\System32\msxml3.dll
2012-06-06 06:02:54 1133568 ----a-w- C:\windows\System32\cdosys.dll
2012-06-06 05:05:52 1390080 ----a-w- C:\windows\SysWow64\msxml6.dll
2012-06-06 05:05:52 1236992 ----a-w- C:\windows\SysWow64\msxml3.dll
2012-06-06 05:03:06 805376 ----a-w- C:\windows\SysWow64\cdosys.dll
2012-06-02 22:15:31 2622464 ----a-w- C:\windows\System32\wucltux.dll
2012-06-02 22:15:08 99840 ----a-w- C:\windows\System32\wudriver.dll
2012-06-02 19:19:42 186752 ----a-w- C:\windows\System32\wuwebv.dll
2012-06-02 19:15:12 36864 ----a-w- C:\windows\System32\wuapp.exe
2012-06-02 12:12:17 2311680 ----a-w- C:\windows\System32\jscript9.dll
2012-06-02 12:05:28 1392128 ----a-w- C:\windows\System32\wininet.dll
2012-06-02 12:04:50 1494528 ----a-w- C:\windows\System32\inetcpl.cpl
2012-06-02 12:01:40 173056 ----a-w- C:\windows\System32\ieUnatt.exe
2012-06-02 11:57:08 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2012-06-02 08:33:25 1800192 ----a-w- C:\windows\SysWow64\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- C:\windows\SysWow64\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2012-06-02 05:48:16 95600 ----a-w- C:\windows\System32\drivers\ksecdd.sys
2012-06-02 05:48:16 151920 ----a-w- C:\windows\System32\drivers\ksecpkg.sys
2012-06-02 05:45:31 340992 ----a-w- C:\windows\System32\schannel.dll
2012-06-02 05:44:21 307200 ----a-w- C:\windows\System32\ncrypt.dll
2012-06-02 04:40:42 22016 ----a-w- C:\windows\SysWow64\secur32.dll
2012-06-02 04:40:39 225280 ----a-w- C:\windows\SysWow64\schannel.dll
2012-06-02 04:39:10 219136 ----a-w- C:\windows\SysWow64\ncrypt.dll
2012-06-02 04:34:09 96768 ----a-w- C:\windows\SysWow64\sspicli.dll
2012-05-31 16:25:12 279656 ------w- C:\windows\System32\MpSigStub.exe
.
============= FINISH: 20:40:23.40 ===============

BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 04 August 2012 - 12:51 AM

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Security Check

  • Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.



Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 04 August 2012 - 11:57 AM

Gringo:

Thank you for the help. I have run Security Checkup and ComboFix (security software disabled) per your instructions, with no problems. The logs are pasted below. After running both, I opened Chrome and it still redirects to Conduit with the Whitesmoke toolbar present. Thus, no improvement yet.



FROM SECURITY CHECKUP:

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
Java™ 6 Update 33
Java version out of Date!
Adobe Reader X (10.1.3)
Google Chrome 20.0.1132.57
Google Chrome 21.0.1180.60
Google Chrome plugins...
Google Chrome VisualElementsManifest.xml..
````````Process Check: objlist.exe by Laurent````````
PC Antivirus PCAntivirus.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````




FROM COMBOFIX:


ComboFix 12-08-04.02 - Garett Raines 08/04/2012 12:28:45.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6058.4524 [GMT -4:00]
Running from: c:\users\Garett Raines\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-04 to 2012-08-04 )))))))))))))))))))))))))))))))
.
.
2012-08-04 16:37 . 2012-08-04 16:37 -------- d-----w- c:\users\Yajamj\AppData\Local\temp
2012-08-04 16:37 . 2012-08-04 16:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-03 23:30 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E152A547-D46C-4085-840A-1F67F80963AE}\mpengine.dll
2012-08-03 00:59 . 2012-08-03 00:59 -------- d-----w- c:\users\Garett Raines\AppData\Local\Adobe
2012-08-02 00:14 . 2012-08-02 00:14 -------- d-----w- c:\program files (x86)\Runtime Software
2012-08-01 03:01 . 2012-08-01 03:01 -------- d-----w- c:\users\Yajamj\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\programdata\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-01 02:26 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Local\CRE
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\.minecraft
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\program files (x86)\Conduit
2012-07-31 10:09 . 2012-07-31 23:18 -------- d-----w- c:\users\Garett Raines\AppData\Local\Conduit
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\Yahoo!
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\NanoService
2012-07-14 19:15 . 2012-07-14 19:15 -------- d--h--w- c:\users\Garett Raines\AppData\Roaming\RPPrivate
2012-07-12 01:52 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 15:12 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 23:18 . 2012-04-12 16:54 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-03 23:18 . 2011-07-25 21:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-01 22:03 . 2012-02-08 15:30 4273464 ----a-w- c:\windows\uninst.exe
2012-07-12 01:49 . 2011-07-19 12:24 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-22 19:44 . 2012-06-22 19:44 476936 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-06-22 19:44 . 2011-07-05 07:45 472840 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-07 23:42 . 2011-12-07 01:19 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-06-07 23:42 . 2011-12-07 01:19 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-06-02 22:19 . 2012-06-22 19:51 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 19:51 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-22 19:51 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 19:51 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 19:51 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-22 19:51 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-22 19:51 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19 . 2012-06-22 19:51 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:15 . 2012-06-22 19:51 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 16:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-01_21.51.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-21 03:09 . 2012-08-04 16:12 56316 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-08-04 16:12 39850 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-07-04 02:45 . 2012-08-04 16:12 17850 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-332865389-3069509686-3046347489-1001_UserData.bin
+ 2011-05-18 04:08 . 2012-08-04 16:27 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-05-18 04:08 . 2012-08-04 16:27 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-08-01 21:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-04 16:27 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-05-18 04:59 . 2012-08-03 23:21 2984 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-08-04 16:16 . 2012-08-04 16:16 9560 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_48.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 4280 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_32.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 2456 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_24.bin
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-08-04 16:10 . 2012-08-04 16:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-08-04 16:10 . 2012-08-04 16:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 466632 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.dll
+ 2012-04-12 16:54 . 2012-08-03 23:18 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
- 2012-04-12 16:54 . 2012-07-28 16:36 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2011-07-05 00:20 . 2012-08-03 23:18 297012 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2011-07-03 13:26 . 2012-08-03 14:45 325148 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:36 . 2012-08-01 15:10 624412 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-08-04 16:16 624412 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-08-04 16:16 106756 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-08-01 15:10 106756 c:\windows\system32\perfc009.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 513224 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.dll
- 2009-07-14 05:01 . 2012-08-01 21:50 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-08-03 23:30 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-07-23 03:30 . 2012-08-01 21:50 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
+ 2011-07-23 03:30 . 2012-08-03 23:30 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
+ 2011-07-10 20:20 . 2012-08-03 23:30 20910996 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"LMab1err"="c:\program files\Lexmark\ErrorApp\LMab1err.exe" [2010-03-26 582312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-11-05 407920]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-11-05 202096]
"VitaKeyTSR"="c:\program files (x86)\EgisTec BioExcess\EgisTSR.exe" [2010-12-13 383344]
"PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400]
"YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2010-12-24 136488]
"YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2010-12-24 224352]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"PC Antivirus"="c:\program files (x86)\PC Antivirus\PCAntivirus.exe" [2012-02-08 47556368]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-03-17 728120]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-06-07 296056]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Garett Raines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-2-17 113664]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2011-2-25 15776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 36328]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-05 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-05-18 57952]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2011-05-18 39008]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [2009-12-09 23648]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-05-18 13408]
S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys [2011-05-18 55880]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-05-18 22912]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-05-18 20328]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-05-18 62584]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Agile1Password;1Password;c:\program files (x86)\1Password\Agile1pService.exe [2011-08-17 767240]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2011-02-27 499200]
S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]
S2 EgisTec Service;EgisTec Service;c:\program files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]
S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2010-10-31 35952]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-03-17 476728]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2011-02-27 885248]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2011-05-18 29792]
S3 bpenum;Intel® Centrino® WiMAX Enumerator;c:\windows\system32\DRIVERS\bpenum.sys [2011-02-17 75264]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;c:\windows\system32\DRIVERS\bpmp.sys [2011-02-17 174080]
S3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;c:\windows\system32\Drivers\bpusb.sys [2011-02-17 81920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-12-24 31088]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-11-09 8500736]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-31 333928]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\usbvideo.sys [2010-11-21 184960]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 23:18]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001Core.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-22 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001UA.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-22 04:50]
.
2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003Core.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003UA.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-02 c:\windows\Tasks\Norton Security Scan for Garett Raines.job
- c:\progra~2\NORTON~2\Engine\372~1.5\Nss.exe [2012-06-09 09:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-29 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-29 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-29 418840]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2011-03-01 1617920]
"TpShocks"="c:\windows\System32\TpShocks.exe" [2010-03-15 231328]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2011-05-18 9769888]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2011-05-18 5908928]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-05-18 114688]
"WrtMon.exe"="c:\windows\system32\spool\drivers\x64\3\WrtMon.exe" [2007-07-18 20480]
"LMPSSDMON"="c:\program files\Lexmark\Monitor\ACJ\LMabMON.exe" [2010-03-26 753664]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 65.32.1.65 65.32.1.70
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-04 12:49:33
ComboFix-quarantined-files.txt 2012-08-04 16:49
ComboFix2.txt 2012-08-01 23:05
ComboFix3.txt 2012-08-01 21:56
.
Pre-Run: 294,891,147,264 bytes free
Post-Run: 295,234,457,600 bytes free
.
- - End Of File - - 129D379EE3C6D5756BC613CA17BC5C5F

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 04 August 2012 - 02:49 PM

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Folder::
c:\program files (x86)\Conduit
c:\users\Garett Raines\AppData\Local\Conduit

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 05 August 2012 - 01:42 PM

Hi Gringo. I ran CFScript in ComboFix with no problems. The log is pasted below. After running, I opened Chrome and it still redirects to Conduit with the Whitesmoke toolbar present. Thus, no improvement yet.

COMBOFIX LOG:


ComboFix 12-08-04.02 - Garett Raines 08/04/2012 17:52:52.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6058.4557 [GMT -4:00]
Running from: c:\users\Garett Raines\Desktop\ComboFix.exe
Command switches used :: c:\users\Garett Raines\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Conduit
c:\program files (x86)\Conduit\Community Alerts\Alert.dll
c:\users\Garett Raines\AppData\Local\Conduit
.
.
((((((((((((((((((((((((( Files Created from 2012-07-04 to 2012-08-04 )))))))))))))))))))))))))))))))
.
.
2012-08-04 22:00 . 2012-08-04 22:00 -------- d-----w- c:\users\Yajamj\AppData\Local\temp
2012-08-04 22:00 . 2012-08-04 22:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-03 23:30 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E152A547-D46C-4085-840A-1F67F80963AE}\mpengine.dll
2012-08-03 00:59 . 2012-08-03 00:59 -------- d-----w- c:\users\Garett Raines\AppData\Local\Adobe
2012-08-02 00:14 . 2012-08-02 00:14 -------- d-----w- c:\program files (x86)\Runtime Software
2012-08-01 03:01 . 2012-08-01 03:01 -------- d-----w- c:\users\Yajamj\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\programdata\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-01 02:26 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Local\CRE
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\.minecraft
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\Yahoo!
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\NanoService
2012-07-14 19:15 . 2012-07-14 19:15 -------- d--h--w- c:\users\Garett Raines\AppData\Roaming\RPPrivate
2012-07-12 01:52 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 15:12 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 23:18 . 2012-04-12 16:54 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-03 23:18 . 2011-07-25 21:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-01 22:03 . 2012-02-08 15:30 4273464 ----a-w- c:\windows\uninst.exe
2012-07-12 01:49 . 2011-07-19 12:24 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-22 19:44 . 2012-06-22 19:44 476936 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-06-22 19:44 . 2011-07-05 07:45 472840 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-07 23:42 . 2011-12-07 01:19 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-06-07 23:42 . 2011-12-07 01:19 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-06-02 22:19 . 2012-06-22 19:51 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 19:51 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-22 19:51 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 19:51 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 19:51 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-22 19:51 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-22 19:51 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19 . 2012-06-22 19:51 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:15 . 2012-06-22 19:51 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 16:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-01_21.51.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-21 03:09 . 2012-08-04 16:12 56316 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-08-04 16:12 39850 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-07-04 02:45 . 2012-08-04 16:12 17850 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-332865389-3069509686-3046347489-1001_UserData.bin
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-05-18 04:08 . 2012-08-04 17:59 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-05-18 04:08 . 2012-08-04 17:59 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-08-01 21:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-04 17:59 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-05-18 04:59 . 2012-08-03 23:21 2984 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-08-04 16:16 . 2012-08-04 16:16 9560 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_48.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 4280 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_32.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 2456 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_24.bin
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-08-04 17:59 . 2012-08-04 17:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-08-04 17:59 . 2012-08-04 17:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 466632 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.dll
+ 2012-04-12 16:54 . 2012-08-03 23:18 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
- 2012-04-12 16:54 . 2012-07-28 16:36 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2011-07-05 00:20 . 2012-08-04 21:49 297108 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2011-07-03 13:26 . 2012-08-04 21:02 325252 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2012-08-04 18:03 624412 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-08-01 15:10 624412 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-08-01 15:10 106756 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-08-04 18:03 106756 c:\windows\system32\perfc009.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 513224 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.dll
- 2009-07-14 05:01 . 2012-08-01 21:50 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-08-04 17:20 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-07-23 03:30 . 2012-08-04 17:20 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
- 2011-07-23 03:30 . 2012-08-01 21:50 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
+ 2011-07-10 20:20 . 2012-08-04 17:20 21105304 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"LMab1err"="c:\program files\Lexmark\ErrorApp\LMab1err.exe" [2010-03-26 582312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-11-05 407920]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-11-05 202096]
"VitaKeyTSR"="c:\program files (x86)\EgisTec BioExcess\EgisTSR.exe" [2010-12-13 383344]
"PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400]
"YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2010-12-24 136488]
"YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2010-12-24 224352]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"PC Antivirus"="c:\program files (x86)\PC Antivirus\PCAntivirus.exe" [2012-02-08 47556368]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-03-17 728120]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-06-07 296056]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Garett Raines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-2-17 113664]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2011-2-25 15776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 36328]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-05 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-05-18 57952]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2011-05-18 39008]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [2009-12-09 23648]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-05-18 13408]
S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys [2011-05-18 55880]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-05-18 22912]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-05-18 20328]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-05-18 62584]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Agile1Password;1Password;c:\program files (x86)\1Password\Agile1pService.exe [2011-08-17 767240]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2011-02-27 499200]
S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]
S2 EgisTec Service;EgisTec Service;c:\program files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]
S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2010-10-31 35952]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-03-17 476728]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2011-02-27 885248]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2011-05-18 29792]
S3 bpenum;Intel® Centrino® WiMAX Enumerator;c:\windows\system32\DRIVERS\bpenum.sys [2011-02-17 75264]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;c:\windows\system32\DRIVERS\bpmp.sys [2011-02-17 174080]
S3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;c:\windows\system32\Drivers\bpusb.sys [2011-02-17 81920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-12-24 31088]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-11-09 8500736]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-31 333928]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\usbvideo.sys [2010-11-21 184960]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 23:18]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001Core.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-22 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001UA.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-22 04:50]
.
2012-08-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003Core.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003UA.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-02 c:\windows\Tasks\Norton Security Scan for Garett Raines.job
- c:\progra~2\NORTON~2\Engine\372~1.5\Nss.exe [2012-06-09 09:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-29 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-29 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-29 418840]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2011-03-01 1617920]
"TpShocks"="c:\windows\System32\TpShocks.exe" [2010-03-15 231328]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2011-05-18 9769888]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2011-05-18 5908928]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-05-18 114688]
"WrtMon.exe"="c:\windows\system32\spool\drivers\x64\3\WrtMon.exe" [2007-07-18 20480]
"LMPSSDMON"="c:\program files\Lexmark\Monitor\ACJ\LMabMON.exe" [2010-03-26 753664]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-04 18:11:30
ComboFix-quarantined-files.txt 2012-08-04 22:11
ComboFix2.txt 2012-08-04 16:49
ComboFix3.txt 2012-08-01 23:05
ComboFix4.txt 2012-08-01 21:56
.
Pre-Run: 295,288,897,536 bytes free
Post-Run: 294,857,781,248 bytes free
.
- - End Of File - - D0D397E1EFBB258A18E8A2731581EAF0

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 05 August 2012 - 03:19 PM

Greetings GTRaines


Chrome can be hard to remove things as our tools don't read it to well,

I want you to uninstall chrome and if asked about user data or settings then I want that removed also.

RESTART the computer and reinstall chrome - see if it has improved


Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 05 August 2012 - 04:49 PM

Gringo,

I uninstalled Chrome, restarted the computer, then reinstalled Chrome. The Whitesmoke toolbar was then present when I opened Chrome. I uninstalled Chrome again, restarted the computer, then reinstalled. Again, the Whitesmoke toolbar was present. However, when I went to Whitesmoke's settings and selected "remove", it actually disappeared. Right now, there's no sign of it. It seems strange that it could be voluntarily removed after all this, though.

Right now, there are no problems with my computer and I can't find any trace of Whitesmoke or the Conduit redirect.

Think I'm ok?

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 05 August 2012 - 04:59 PM

Greetings

I want to run this scan to make sure I don't see any traces of it anywhere


Download and run OTL

Download OTL by Old Timer and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened and the that I need posted back here
    • Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
  • Please post the contents of OTL.txt in your next reply.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 05 August 2012 - 08:47 PM

OTL text is pasted below. No problems running it, and still no sign of Whitesmoke.

Got my fingers crossed!


OTL OUTPUT:

OTL logfile created on: 8/5/2012 9:35:52 PM - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Garett Raines\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.92 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 67.66% Memory free
11.83 Gb Paging File | 9.79 Gb Available in Paging File | 82.73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 552.22 Gb Total Space | 274.74 Gb Free Space | 49.75% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 26.25 Gb Free Space | 90.55% Space Free | Partition Type: NTFS

Computer Name: GARETTRAINES-PC | User Name: Garett Raines | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\Garett Raines\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe (PC Antivirus Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\1Password\Agile1pService.exe (AgileBits)
PRC - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe (Egis Technology Inc. )
PRC - C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe (Egis Technology Inc. )
PRC - C:\Program Files\Lexmark\Monitor\ACJ\LMabMON.exe ()
PRC - C:\Program Files\Lexmark\ErrorApp\lmab1err.exe ( )
PRC - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\libglesv2.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\libegl.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\avutil-51.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\avformat-54.dll ()
MOD - C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\avcodec-54.dll ()
MOD - C:\Windows\SysWOW64\vipre.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\ProgramData\AVC1Data\w\vcore.dll ()
MOD - C:\ProgramData\AVC1Data\w\remediation.dll ()
MOD - C:\ProgramData\AVC1Data\w\libVvs.dll ()
MOD - C:\ProgramData\AVC1Data\w\libZip.dll ()
MOD - C:\ProgramData\AVC1Data\w\libRar.dll ()
MOD - C:\ProgramData\AVC1Data\w\libtd.dll ()
MOD - C:\ProgramData\AVC1Data\w\libRTF.dll ()
MOD - C:\ProgramData\AVC1Data\w\libOleA.dll ()
MOD - C:\ProgramData\AVC1Data\w\libNSIS.dll ()
MOD - C:\ProgramData\AVC1Data\w\libMsi.dll ()
MOD - C:\ProgramData\AVC1Data\w\libMsCab.dll ()
MOD - C:\ProgramData\AVC1Data\w\libEmail.dll ()
MOD - C:\ProgramData\AVC1Data\w\libMachoUniv.dll ()
MOD - C:\ProgramData\AVC1Data\w\libBase64.dll ()
MOD - C:\ProgramData\AVC1Data\w\lib7zip.dll ()
MOD - C:\ProgramData\AVC1Data\w\lgpl.dll ()
MOD - C:\Program Files\Lexmark\Monitor\ACJ\LMabDRS.dll ()
MOD - C:\Program Files\Lexmark\Monitor\ACJ\LMabMON.exe ()
MOD - C:\Program Files\Lexmark\Monitor\ACJ\LMabSCW.dll ()
MOD - C:\Program Files\Lexmark\Monitor\ACJ\lmabcaps.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (DMAgent) -- C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe (Red Bend Ltd.)
SRV:64bit: - (WiMAXAppSrv) -- C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe (Intel® Corporation)
SRV:64bit: - (EvtEng) -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV:64bit: - (MyWiFiDHCPDNS) -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV:64bit: - (RegSrvc) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (lmab_device) -- C:\Windows\SysNative\lmabcoms.exe ( )
SRV:64bit: - (TPHDEXLGSVC) -- C:\Windows\SysNative\TPHDEXLG64.exe (Lenovo.)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (PMBDeviceInfoProvider) -- C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Agile1Password) -- C:\Program Files (x86)\1Password\Agile1pService.exe (AgileBits)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (EgisTec Service) -- C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe (Egis Technology Inc. )
SRV - (EgisTec Ticket Service) -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe (Egis Technology Inc. )
SRV - (EgisTec Service Help) -- C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe (Egis Technology Inc. )
SRV - (lmab_device) -- C:\Windows\SysWOW64\lmabcoms.exe ( )
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (YahooAUService) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)


========== Driver Services (SafeList) ==========

DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:64bit: - (fbfmon) -- C:\Windows\SysNative\drivers\fbfmon.sys (Lenovo)
DRV:64bit: - (BPntDrv) -- C:\Windows\SysNative\drivers\BPntDrv.sys (Lenovo)
DRV:64bit: - (LHDmgr) -- C:\Windows\SysNative\drivers\LhdX64.sys (Lenovo.)
DRV:64bit: - (ACPIVPC) -- C:\Windows\SysNative\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV:64bit: - (EgisTecFF) -- C:\Windows\SysNative\drivers\EgisTecFF.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (bpmp) -- C:\Windows\SysNative\drivers\bpmp.sys (Intel Corporation)
DRV:64bit: - (bpusb) -- C:\Windows\SysNative\drivers\bpusb.sys (Intel Corporation)
DRV:64bit: - (bpenum) -- C:\Windows\SysNative\drivers\bpenum.sys (Intel Corporation)
DRV:64bit: - (clwvd) -- C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:64bit: - (wdkmd) -- C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (RSUSBVSTOR) -- C:\Windows\SysNative\drivers\rtsuvstor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (FPSensor) -- C:\Windows\SysNative\drivers\FPSensor.sys (Egis Technology Inc.)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel® Corporation)
DRV:64bit: - (Shockprf) -- C:\Windows\SysNative\drivers\ApsX64.sys (Lenovo.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (TPDIGIMN) -- C:\Windows\SysNative\drivers\ApsHM64.sys (Lenovo.)
DRV:64bit: - (wsvd) -- C:\Windows\SysNative\drivers\wsvd.sys (CyberLink)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.msn.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{3A092259-42E2-4468-A4D1-759A260E3D65}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_enUS438
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7LENN_enUS438
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{6F0F1389-A505-4606-A1AB-35A687BEE703}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=92917EBF-62D3-4A50-91A3-F14969B10EEC&apn_sauid=DD33886F-65D4-4506-A2D0-BB14476FDBEA
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{81BBEEDA-8110-4139-BD08-0B68EBE0DCD1}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{A7587C91-36E6-4EF8-ADC3-232D8EB72EF4}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3198785
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{F7093CE6-3870-4713-92A6-2FDDB4F14F95}: "URL" = http://search.yahoo.com/search?p={searchTerms}&fr=chr-yie9
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{FF68022E-B846-4CEB-B76D-9272A6CFDF2E}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=chr-yie9
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Users\Garett Raines\AppData\Local\Roblox\Versions\version-844560f43f354d3f\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Garett Raines\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Garett Raines\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}: C:\Program Files (x86)\EgisTec BioExcess\FFExt [2011/05/18 00:34:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/19 18:12:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/19 18:12:23 | 000,000,000 | ---D | M]


========== Chrome ==========

CHR - homepage: http://www.yahoo.com/?ilc=1
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3198785
CHR - default_search_provider: suggest_url = http://search.conduit.com/
CHR - homepage: http://www.yahoo.com/?ilc=1
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Garett Raines\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Conduit Chrome Plugin (Enabled) = C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 6 U33 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.3 (Enabled) = C:\windows\SysWOW64\npdeployJava1.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Best Buy pc app Detector (Enabled) = C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll
CHR - plugin: RealNetworks™ Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer™ HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Download Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
CHR - plugin: Roblox Launcher Plugin (Enabled) = C:\Users\Garett Raines\AppData\Local\Roblox\Versions\version-844560f43f354d3f\\NPRobloxProxy.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll
CHR - Extension: WhiteSmoke US = C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\

O1 HOSTS File: ([2012/08/04 18:00:33 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\x64\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\EgisTec BioExcess\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (1Password) - {CB1A24DA-7416-4921-A0CF-5AA1160AAE2A} - C:\Program Files (x86)\1Password\Agile1pIE.dll (AgileBits)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [IntelWirelessWiMAX] C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation)
O4:64bit: - HKLM..\Run: [Lenovo EE Boot Optimizer] C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe (Lenovo)
O4:64bit: - HKLM..\Run: [LMPSSDMON] C:\Program Files\Lexmark\Monitor\ACJ\LMabMON.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TpShocks] C:\Windows\SysNative\TpShocks.exe (Lenovo.)
O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [PC Antivirus] C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe (PC Antivirus Inc.)
O4 - HKLM..\Run: [PLTSR] C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe (Egis Technology Inc. )
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe (Egis Technology Inc. )
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001..\Run: [LMab1err] C:\Program Files\Lexmark\ErrorApp\lmab1err.exe ( )
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy pc app.lnk = C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft)
O4 - Startup: C:\Users\Garett Raines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: 1Password - {00FAC6C9-C494-4AD8-B3C0-DE677AFDDBD8} - C:\Program Files (x86)\1Password\Agile1pIE.dll (AgileBits)
O9 - Extra 'Tools' menuitem : 1Password Ctrl+\ - {00FAC6C9-C494-4AD8-B3C0-DE677AFDDBD8} - C:\Program Files (x86)\1Password\Agile1pIE.dll (AgileBits)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E0FD0BF-5A2D-4329-93D8-7C61C3DC2A75}: DhcpNameServer = 65.32.5.111 65.32.5.112
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{867BD309-7BC3-4D23-AEF4-C6795DFFB5CD}: DhcpNameServer = 65.32.5.111 65.32.5.112
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/05 17:36:54 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/08/05 15:31:37 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/08/04 18:00:29 | 000,000,000 | ---D | C] -- C:\windows\temp
[2012/08/04 12:25:13 | 004,724,408 | R--- | C] (Swearware) -- C:\Users\Garett Raines\Desktop\ComboFix.exe
[2012/08/02 20:59:31 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Local\Adobe
[2012/08/02 20:38:18 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Garett Raines\Desktop\dds.com
[2012/08/01 20:14:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runtime Software
[2012/08/01 20:14:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Runtime Software
[2012/08/01 18:34:59 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\Desktop\tdsskiller
[2012/08/01 18:33:57 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\Desktop\GooredFix Backups
[2012/08/01 18:31:28 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Garett Raines\Desktop\GooredFix.exe
[2012/08/01 17:39:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2012/08/01 17:39:52 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2012/08/01 17:39:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2012/08/01 17:39:46 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/08/01 17:39:24 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2012/08/01 17:35:00 | 004,722,680 | R--- | C] (Swearware) -- C:\Users\Garett Raines\Desktop\svchost.exe.exe
[2012/07/31 22:29:58 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Garett Raines\Desktop\OTL.exe
[2012/07/31 22:26:45 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Roaming\Malwarebytes
[2012/07/31 22:26:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/31 22:26:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/07/31 22:26:35 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012/07/31 22:26:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/07/31 06:09:31 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Local\CRE
[2012/07/31 06:09:25 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Roaming\.minecraft
[2012/07/21 16:26:50 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Local\Yahoo!
[2012/07/21 16:26:50 | 000,000,000 | ---D | C] -- C:\Users\Garett Raines\AppData\Local\NanoService
[2012/07/14 15:15:30 | 000,000,000 | -H-D | C] -- C:\Users\Garett Raines\AppData\Roaming\RPPrivate
[2012/07/11 21:48:42 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\url.dll
[2012/07/11 21:48:42 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\url.dll
[2012/07/11 21:48:42 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\mshtmled.dll
[2012/07/11 21:48:42 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\mshtmled.dll
[2012/07/11 21:48:41 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieui.dll
[2012/07/11 21:48:41 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieui.dll
[2012/07/11 21:48:41 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ieUnatt.exe
[2012/07/11 21:48:41 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\ieUnatt.exe
[2012/07/11 21:48:40 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript9.dll
[2012/07/11 21:48:40 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\inetcpl.cpl
[2012/07/11 21:48:40 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\inetcpl.cpl
[2012/07/11 21:48:40 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\jscript.dll
[2012/07/11 21:48:40 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\jscript.dll
[2012/07/11 11:12:43 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\ncrypt.dll
[2012/07/11 11:12:38 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\msxml3r.dll
[2012/07/11 11:12:38 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\msxml3r.dll
[2012/07/11 11:12:36 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\windows\SysWow64\cdosys.dll
[2012/07/11 11:12:35 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\windows\SysNative\cdosys.dll
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/05 21:36:06 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012/08/05 21:27:08 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 21:27:08 | 000,021,280 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/05 21:27:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003UA.job
[2012/08/05 21:23:51 | 000,726,444 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012/08/05 21:23:51 | 000,624,412 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012/08/05 21:23:51 | 000,106,756 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012/08/05 21:19:51 | 000,305,377 | ---- | M] () -- C:\windows\SysNative\fastboot.set
[2012/08/05 21:19:15 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/05 21:19:00 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/08/05 21:18:54 | 469,372,927 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/05 17:45:00 | 000,000,940 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001UA.job
[2012/08/05 17:45:00 | 000,000,888 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001Core.job
[2012/08/05 17:36:57 | 000,002,411 | ---- | M] () -- C:\Users\Garett Raines\Desktop\Google Chrome.lnk
[2012/08/05 17:17:20 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/05 12:19:35 | 000,000,860 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003Core.job
[2012/08/04 18:00:33 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts
[2012/08/04 13:19:55 | 000,002,030 | -H-- | M] () -- C:\Users\Garett Raines\Documents\Default.rdp
[2012/08/04 12:25:19 | 004,724,408 | R--- | M] (Swearware) -- C:\Users\Garett Raines\Desktop\ComboFix.exe
[2012/08/04 12:14:17 | 000,881,494 | ---- | M] () -- C:\Users\Garett Raines\Desktop\SecurityCheck.exe
[2012/08/03 19:18:56 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerApp.exe
[2012/08/03 19:18:56 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/08/02 20:38:18 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Garett Raines\Desktop\dds.com
[2012/08/02 20:36:45 | 000,000,000 | ---- | M] () -- C:\Users\Garett Raines\defogger_reenable
[2012/08/02 20:35:23 | 000,050,477 | ---- | M] () -- C:\Users\Garett Raines\Desktop\Defogger.exe
[2012/08/02 18:47:27 | 000,000,464 | -H-- | M] () -- C:\windows\tasks\Norton Security Scan for Garett Raines.job
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.dat
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.005
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.004
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.003
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.002
[2012/08/01 22:59:40 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.001
[2012/08/01 22:59:40 | 219,116,032 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.006
[2012/08/01 22:59:40 | 002,347,179 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_D.xml
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.dat
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.212
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.211
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.210
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.209
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.208
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.207
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.206
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.205
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.204
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.203
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.202
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.201
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.200
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.199
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.198
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.197
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.196
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.195
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.194
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.193
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.192
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.191
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.190
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.189
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.188
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.187
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.186
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.185
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.184
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.183
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.182
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.181
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.180
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.179
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.178
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.177
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.176
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.175
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.174
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.173
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.172
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.171
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.170
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.169
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.168
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.167
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.166
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.165
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.164
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.163
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.162
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.161
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.160
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.159
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.158
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.157
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.156
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.155
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.154
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.153
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.152
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.151
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.150
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.149
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.148
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.147
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.146
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.145
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.144
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.143
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.142
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.141
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.140
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.139
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.138
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.137
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.136
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.135
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.134
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.133
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.132
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.131
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.130
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.129
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.128
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.127
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.126
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.125
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.124
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.123
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.122
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.121
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.120
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.119
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.118
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.117
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.116
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.115
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.114
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.113
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.112
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.111
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.110
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.109
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.108
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.107
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.106
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.105
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.104
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.103
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.102
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.101
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.100
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.099
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.098
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.097
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.096
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.095
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.094
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.093
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.092
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.091
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.090
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.089
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.088
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.087
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.086
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.085
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.084
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.083
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.082
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.081
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.080
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.079
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.078
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.077
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.076
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.075
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.074
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.073
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.072
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.071
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.070
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.069
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.068
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.067
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.066
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.065
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.064
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.063
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.062
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.061
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.060
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.059
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.058
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.057
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.056
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.055
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.054
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.053
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.052
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.051
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.050
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.049
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.048
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.047
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.046
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.045
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.044
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.043
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.042
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.041
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.040
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.039
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.038
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.037
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.036
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.035
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.034
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.033
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.032
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.031
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.030
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.029
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.028
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.027
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.026
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.025
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.024
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.023
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.022
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.021
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.020
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.019
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.018
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.017
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.016
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.015
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.014
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.013
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.012
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.011
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.010
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.009
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.008
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.007
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.006
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.005
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.004
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.003
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.002
[2012/08/01 22:55:06 | 688,128,000 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.001
[2012/08/01 22:55:06 | 346,886,656 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.213
[2012/08/01 22:55:06 | 062,211,326 | ---- | M] () -- C:\Users\Garett Raines\Documents\Drive_C.xml
[2012/08/01 20:14:03 | 000,001,131 | ---- | M] () -- C:\Users\Garett Raines\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/08/01 20:14:03 | 000,001,107 | ---- | M] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/08/01 18:32:16 | 002,117,108 | ---- | M] () -- C:\Users\Garett Raines\Desktop\tdsskiller.zip
[2012/08/01 18:31:28 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Garett Raines\Desktop\GooredFix.exe
[2012/08/01 18:03:44 | 004,273,464 | ---- | M] (PC Cleaners) -- C:\windows\uninst.exe
[2012/08/01 17:35:12 | 004,722,680 | R--- | M] (Swearware) -- C:\Users\Garett Raines\Desktop\svchost.exe.exe
[2012/07/31 22:30:00 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Garett Raines\Desktop\OTL.exe
[2012/07/31 22:26:36 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/31 06:09:41 | 000,000,009 | ---- | M] () -- C:\END
[2012/07/27 17:35:44 | 002,818,048 | ---- | M] () -- C:\Users\Garett Raines\Desktop\bankerlopez.accdb
[2012/07/12 18:10:29 | 000,497,664 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/05 17:36:57 | 000,002,411 | ---- | C] () -- C:\Users\Garett Raines\Desktop\Google Chrome.lnk
[2012/08/05 17:35:25 | 000,000,940 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001UA.job
[2012/08/05 17:35:24 | 000,000,888 | ---- | C] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001Core.job
[2012/08/04 12:14:17 | 000,881,494 | ---- | C] () -- C:\Users\Garett Raines\Desktop\SecurityCheck.exe
[2012/08/02 20:36:45 | 000,000,000 | ---- | C] () -- C:\Users\Garett Raines\defogger_reenable
[2012/08/02 20:35:23 | 000,050,477 | ---- | C] () -- C:\Users\Garett Raines\Desktop\Defogger.exe
[2012/08/01 22:59:09 | 219,116,032 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.006
[2012/08/01 22:58:58 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.005
[2012/08/01 22:58:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.004
[2012/08/01 22:58:08 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.003
[2012/08/01 22:57:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.002
[2012/08/01 22:56:54 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.001
[2012/08/01 22:56:21 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.dat
[2012/08/01 22:56:21 | 002,347,179 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_D.xml
[2012/08/01 22:22:09 | 346,886,656 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.213
[2012/08/01 22:21:57 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.212
[2012/08/01 22:21:42 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.211
[2012/08/01 22:21:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.210
[2012/08/01 22:21:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.209
[2012/08/01 22:20:46 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.208
[2012/08/01 22:20:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.207
[2012/08/01 22:20:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.206
[2012/08/01 22:19:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.205
[2012/08/01 22:19:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.204
[2012/08/01 22:18:50 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.203
[2012/08/01 22:18:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.202
[2012/08/01 22:17:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.201
[2012/08/01 22:17:09 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.200
[2012/08/01 22:16:47 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.199
[2012/08/01 22:16:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.198
[2012/08/01 22:15:51 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.197
[2012/08/01 22:15:12 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.196
[2012/08/01 22:14:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.195
[2012/08/01 22:14:09 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.194
[2012/08/01 22:14:00 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.193
[2012/08/01 22:13:38 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.192
[2012/08/01 22:13:24 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.191
[2012/08/01 22:12:42 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.190
[2012/08/01 22:11:56 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.189
[2012/08/01 22:11:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.188
[2012/08/01 22:09:52 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.187
[2012/08/01 22:09:06 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.186
[2012/08/01 22:08:24 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.185
[2012/08/01 22:07:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.184
[2012/08/01 22:07:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.183
[2012/08/01 22:06:22 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.182
[2012/08/01 22:05:25 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.181
[2012/08/01 22:04:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.180
[2012/08/01 22:04:09 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.179
[2012/08/01 22:03:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.178
[2012/08/01 22:02:58 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.177
[2012/08/01 22:02:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.176
[2012/08/01 22:01:03 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.175
[2012/08/01 22:00:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.174
[2012/08/01 21:59:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.173
[2012/08/01 21:59:17 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.172
[2012/08/01 21:58:43 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.171
[2012/08/01 21:58:05 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.170
[2012/08/01 21:57:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.169
[2012/08/01 21:57:05 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.168
[2012/08/01 21:56:30 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.167
[2012/08/01 21:55:55 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.166
[2012/08/01 21:55:19 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.165
[2012/08/01 21:54:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.164
[2012/08/01 21:54:05 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.163
[2012/08/01 21:53:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.162
[2012/08/01 21:52:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.161
[2012/08/01 21:52:17 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.160
[2012/08/01 21:51:40 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.159
[2012/08/01 21:51:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.158
[2012/08/01 21:50:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.157
[2012/08/01 21:49:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.156
[2012/08/01 21:49:16 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.155
[2012/08/01 21:48:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.154
[2012/08/01 21:48:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.153
[2012/08/01 21:47:31 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.152
[2012/08/01 21:46:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.151
[2012/08/01 21:46:22 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.150
[2012/08/01 21:45:48 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.149
[2012/08/01 21:45:13 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.148
[2012/08/01 21:44:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.147
[2012/08/01 21:44:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.146
[2012/08/01 21:43:31 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.145
[2012/08/01 21:42:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.144
[2012/08/01 21:42:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.143
[2012/08/01 21:41:38 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.142
[2012/08/01 21:40:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.141
[2012/08/01 21:40:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.140
[2012/08/01 21:39:47 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.139
[2012/08/01 21:39:08 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.138
[2012/08/01 21:38:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.137
[2012/08/01 21:37:51 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.136
[2012/08/01 21:37:17 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.135
[2012/08/01 21:36:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.134
[2012/08/01 21:36:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.133
[2012/08/01 21:35:33 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.132
[2012/08/01 21:34:55 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.131
[2012/08/01 21:34:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.130
[2012/08/01 21:33:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.129
[2012/08/01 21:33:09 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.128
[2012/08/01 21:32:33 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.127
[2012/08/01 21:31:57 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.126
[2012/08/01 21:31:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.125
[2012/08/01 21:30:50 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.124
[2012/08/01 21:30:17 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.123
[2012/08/01 21:29:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.122
[2012/08/01 21:28:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.121
[2012/08/01 21:28:26 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.120
[2012/08/01 21:27:51 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.119
[2012/08/01 21:27:18 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.118
[2012/08/01 21:26:45 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.117
[2012/08/01 21:26:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.116
[2012/08/01 21:25:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.115
[2012/08/01 21:24:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.114
[2012/08/01 21:24:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.113
[2012/08/01 21:23:45 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.112
[2012/08/01 21:23:05 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.111
[2012/08/01 21:22:31 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.110
[2012/08/01 21:21:59 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.109
[2012/08/01 21:21:25 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.108
[2012/08/01 21:20:49 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.107
[2012/08/01 21:20:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.106
[2012/08/01 21:19:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.105
[2012/08/01 21:19:10 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.104
[2012/08/01 21:18:31 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.103
[2012/08/01 21:17:57 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.102
[2012/08/01 21:17:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.101
[2012/08/01 21:16:49 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.100
[2012/08/01 21:16:13 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.099
[2012/08/01 21:15:39 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.098
[2012/08/01 21:15:01 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.097
[2012/08/01 21:14:27 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.096
[2012/08/01 21:13:52 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.095
[2012/08/01 21:13:17 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.094
[2012/08/01 21:12:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.093
[2012/08/01 21:12:11 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.092
[2012/08/01 21:11:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.091
[2012/08/01 21:10:49 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.090
[2012/08/01 21:10:16 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.089
[2012/08/01 21:09:43 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.088
[2012/08/01 21:09:11 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.087
[2012/08/01 21:08:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.086
[2012/08/01 21:08:03 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.085
[2012/08/01 21:07:29 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.084
[2012/08/01 21:06:55 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.083
[2012/08/01 21:06:19 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.082
[2012/08/01 21:05:44 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.081
[2012/08/01 21:05:07 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.080
[2012/08/01 21:04:34 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.079
[2012/08/01 21:03:57 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.078
[2012/08/01 21:03:25 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.077
[2012/08/01 21:02:49 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.076
[2012/08/01 21:02:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.075
[2012/08/01 20:59:08 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.074
[2012/08/01 20:58:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.073
[2012/08/01 20:57:58 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.072
[2012/08/01 20:57:24 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.071
[2012/08/01 20:56:49 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.070
[2012/08/01 20:56:14 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.069
[2012/08/01 20:55:39 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.068
[2012/08/01 20:55:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.067
[2012/08/01 20:54:30 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.066
[2012/08/01 20:53:56 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.065
[2012/08/01 20:53:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.064
[2012/08/01 20:52:47 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.063
[2012/08/01 20:52:14 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.062
[2012/08/01 20:51:40 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.061
[2012/08/01 20:51:06 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.060
[2012/08/01 20:50:34 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.059
[2012/08/01 20:50:00 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.058
[2012/08/01 20:49:28 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.057
[2012/08/01 20:48:55 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.056
[2012/08/01 20:48:22 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.055
[2012/08/01 20:47:48 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.054
[2012/08/01 20:47:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.053
[2012/08/01 20:46:42 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.052
[2012/08/01 20:46:09 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.051
[2012/08/01 20:45:36 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.050
[2012/08/01 20:45:04 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.049
[2012/08/01 20:44:31 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.048
[2012/08/01 20:43:56 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.047
[2012/08/01 20:43:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.046
[2012/08/01 20:42:46 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.045
[2012/08/01 20:42:06 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.044
[2012/08/01 20:41:24 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.043
[2012/08/01 20:40:46 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.042
[2012/08/01 20:40:06 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.041
[2012/08/01 20:39:28 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.040
[2012/08/01 20:38:51 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.039
[2012/08/01 20:38:15 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.038
[2012/08/01 20:37:40 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.037
[2012/08/01 20:37:06 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.036
[2012/08/01 20:36:23 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.035
[2012/08/01 20:35:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.034
[2012/08/01 20:34:58 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.033
[2012/08/01 20:34:20 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.032
[2012/08/01 20:34:08 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.031
[2012/08/01 20:33:55 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.030
[2012/08/01 20:33:42 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.029
[2012/08/01 20:33:30 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.028
[2012/08/01 20:33:18 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.027
[2012/08/01 20:33:05 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.026
[2012/08/01 20:32:53 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.025
[2012/08/01 20:32:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.024
[2012/08/01 20:32:28 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.023
[2012/08/01 20:32:16 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.022
[2012/08/01 20:32:03 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.021
[2012/08/01 20:31:51 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.020
[2012/08/01 20:31:37 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.019
[2012/08/01 20:31:25 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.018
[2012/08/01 20:31:16 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.017
[2012/08/01 20:30:54 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.016
[2012/08/01 20:30:13 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.015
[2012/08/01 20:29:32 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.014
[2012/08/01 20:28:54 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.013
[2012/08/01 20:28:11 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.012
[2012/08/01 20:27:22 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.011
[2012/08/01 20:26:39 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.010
[2012/08/01 20:25:58 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.009
[2012/08/01 20:25:18 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.008
[2012/08/01 20:24:26 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.007
[2012/08/01 20:23:40 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.006
[2012/08/01 20:22:54 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.005
[2012/08/01 20:21:54 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.004
[2012/08/01 20:20:47 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.003
[2012/08/01 20:19:41 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.002
[2012/08/01 20:18:00 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.001
[2012/08/01 20:16:03 | 688,128,000 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.dat
[2012/08/01 20:16:03 | 062,211,326 | ---- | C] () -- C:\Users\Garett Raines\Documents\Drive_C.xml
[2012/08/01 20:14:03 | 000,001,131 | ---- | C] () -- C:\Users\Garett Raines\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/08/01 20:14:03 | 000,001,107 | ---- | C] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/08/01 18:32:09 | 002,117,108 | ---- | C] () -- C:\Users\Garett Raines\Desktop\tdsskiller.zip
[2012/08/01 17:39:52 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012/08/01 17:39:52 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012/08/01 17:39:52 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012/08/01 17:39:52 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012/08/01 17:39:52 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012/07/31 22:26:36 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/31 06:09:41 | 000,000,009 | ---- | C] () -- C:\END
[2012/07/27 17:36:04 | 002,818,048 | ---- | C] () -- C:\Users\Garett Raines\Desktop\bankerlopez.accdb
[2012/05/24 12:54:56 | 000,430,080 | ---- | C] ( ) -- C:\windows\SysWow64\lexlog.dll
[2012/05/01 16:38:51 | 001,044,480 | ---- | C] ( ) -- C:\windows\SysWow64\lmabserv.dll
[2012/05/01 16:38:51 | 000,802,816 | ---- | C] ( ) -- C:\windows\SysWow64\lmabcomc.dll
[2012/05/01 16:38:51 | 000,593,920 | ---- | C] ( ) -- C:\windows\SysWow64\lmabcoms.exe
[2012/05/01 16:38:51 | 000,372,736 | ---- | C] ( ) -- C:\windows\SysWow64\lmabcomm.dll
[2012/05/01 16:38:51 | 000,356,352 | ---- | C] ( ) -- C:\windows\SysWow64\lmabhcp.dll
[2012/02/09 08:33:17 | 000,000,017 | ---- | C] () -- C:\Users\Garett Raines\AppData\Local\resmon.resmoncfg
[2012/02/08 11:47:12 | 000,301,848 | ---- | C] () -- C:\windows\SysWow64\vipre.dll
[2012/02/08 11:47:12 | 000,167,704 | ---- | C] () -- C:\windows\SysWow64\unrar.dll
[2011/09/23 08:09:58 | 000,009,216 | ---- | C] () -- C:\Users\Garett Raines\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/05 03:49:39 | 000,149,371 | ---- | C] () -- C:\Users\Garett Raines\Scan Files.pdf
[2011/07/05 03:17:07 | 000,028,672 | ---- | C] () -- C:\windows\hookdllX.dll
[2011/07/05 03:17:07 | 000,011,776 | ---- | C] () -- C:\windows\SysWow64\pmsbfn32.dll
[2011/07/03 22:59:05 | 000,000,632 | RHS- | C] () -- C:\Users\Garett Raines\ntuser.pol
[2011/06/07 11:13:38 | 000,974,848 | ---- | C] () -- C:\windows\SysWow64\cis-2.4.dll
[2011/06/07 11:13:38 | 000,081,920 | ---- | C] () -- C:\windows\SysWow64\issacapi_bs-2.3.dll
[2011/06/07 11:13:38 | 000,065,536 | ---- | C] () -- C:\windows\SysWow64\issacapi_pe-2.3.dll
[2011/06/07 11:13:38 | 000,057,344 | ---- | C] () -- C:\windows\SysWow64\issacapi_se-2.3.dll
[2011/05/18 09:21:54 | 000,003,443 | ---- | C] () -- C:\windows\UTILITYDRV.SYS
[2011/05/18 09:21:53 | 000,300,328 | ---- | C] () -- C:\windows\it50.dll
[2011/05/18 09:21:53 | 000,259,368 | ---- | C] () -- C:\windows\FastBR.dll
[2011/05/18 09:21:53 | 000,259,368 | ---- | C] () -- C:\windows\CopyFile.dll
[2011/05/18 09:21:53 | 000,218,408 | ---- | C] () -- C:\windows\Image.dll
[2011/05/18 09:21:53 | 000,202,024 | ---- | C] () -- C:\windows\HardDisk.dll
[2011/05/18 09:21:53 | 000,177,448 | ---- | C] () -- C:\windows\disk.dll
[2011/05/18 09:21:53 | 000,110,592 | ---- | C] () -- C:\windows\BootseqwWmi.exe
[2011/05/18 09:21:53 | 000,081,920 | ---- | C] () -- C:\windows\Bootseqw32.exe
[2011/05/18 09:21:53 | 000,049,152 | ---- | C] () -- C:\windows\CHGBOOTW.EXE
[2011/05/18 09:21:53 | 000,008,704 | ---- | C] () -- C:\windows\Access32.sys
[2011/05/18 00:40:00 | 001,500,512 | ---- | C] () -- C:\windows\SysWow64\Apblend.dll
[2011/05/18 00:40:00 | 001,171,456 | ---- | C] () -- C:\windows\SysWow64\PicNotify.dll
[2011/05/18 00:39:53 | 001,044,480 | ---- | C] () -- C:\windows\SysWow64\3DImageRenderer.dll
[2011/05/18 00:25:47 | 000,089,328 | ---- | C] () -- C:\windows\un_dext.exe
[2011/05/18 00:25:47 | 000,087,928 | ---- | C] () -- C:\windows\SPRemove_x64.exe
[2011/05/18 00:25:47 | 000,003,566 | ---- | C] () -- C:\windows\Dext_09.ini
[2011/05/18 00:25:47 | 000,002,998 | ---- | C] () -- C:\windows\Dext_04.ini
[2011/05/18 00:25:47 | 000,002,790 | ---- | C] () -- C:\windows\Dext_2052.ini
[2011/05/18 00:25:47 | 000,002,573 | ---- | C] () -- C:\windows\Remove.ini
[2011/04/15 01:29:01 | 000,066,856 | ---- | C] () -- C:\windows\SysWow64\SynTPEnhPS.dll
[2011/04/15 01:28:23 | 000,963,116 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2011/04/15 01:28:18 | 000,216,876 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2011/04/15 01:28:13 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin

< End of report >

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 05 August 2012 - 09:34 PM

greetings



This report takes time to go thru so I will be posting in the morning


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 06 August 2012 - 06:28 AM

Hello

Run this custom script and when it is complete I need to know how the computer is doing

Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Posted Image textbox. Do not include the word Code
    :OTL
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Program Files (x86)\TVUPlayer\npTVUAx.dll File not found
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O18:64bit: - Protocol\Handler\livecall - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\msnim - No CLSID value found
    O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
    O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
    O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{6F0F1389-A505-4606-A1AB-35A687BEE703}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=92917EBF-62D3-4A50-91A3-F14969B10EEC&apn_sauid=DD33886F-65D4-4506-A2D0-BB14476FDBEA
    IE - HKU\S-1-5-21-332865389-3069509686-3046347489-1001\..\SearchScopes\{A7587C91-36E6-4EF8-ADC3-232D8EB72EF4}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3198785
    O4 - HKLM..\Run: [PC Antivirus] C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe (PC Antivirus Inc.)
    :Files
    C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl
    ipconfig /flushdns /c
    :Commands
    [PURITY]
    [emptyjava]
    [EMPTYFLASH]
    
  • Then click the Run Fix button at the top.
  • Click Posted Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know How things are doing

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 06 August 2012 - 06:11 PM

Gringo:

The log is attached. Still no sign of Whitesmoke, and no sign of any problems.



========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
File Protocol\Handler\livecall - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
File Protocol\Handler\msnim - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry key HKEY_USERS\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6F0F1389-A505-4606-A1AB-35A687BEE703}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F0F1389-A505-4606-A1AB-35A687BEE703}\ not found.
Registry key HKEY_USERS\S-1-5-21-332865389-3069509686-3046347489-1001\Software\Microsoft\Internet Explorer\SearchScopes\{A7587C91-36E6-4EF8-ADC3-232D8EB72EF4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7587C91-36E6-4EF8-ADC3-232D8EB72EF4}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PC Antivirus deleted successfully.
C:\Program Files (x86)\PC Antivirus\PCAntivirus.exe moved successfully.
========== FILES ==========
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\plugins folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Options folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\rssItem folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\popup folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\icons\useful_components folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\icons\urlGadget folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\icons folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64\searchBox folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64\rssItem folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64\ifarme folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64\icons folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64\dyamincMenu folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media\base64 folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Media folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\utils\interface folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\utils folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\usage folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\translation folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\toolbarsManager folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\toolbarInfo folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\settings folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\serviceMap folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\login folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\jsonData folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\feed folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\cookieMonster folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\ContextMenuService folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\aliasReplace folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\alerts folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services\404 folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\services folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\popup\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\popup\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\popup folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\lib folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\xmlMenu\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\xmlMenu\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\xmlMenu\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\xmlMenu folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\urlGadget\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\urlGadget\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\urlGadget\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\urlGadget folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\multiRssItem\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\multiRssItem\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\multiRssItem\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\multiRssItem folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\menuPanel\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\menuPanel\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\menuPanel\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\menuPanel folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\gadgets\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\gadgets\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\gadgets folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\factories\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\factories\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\factories folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\dynamicMenu\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\dynamicMenu\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\dynamicMenu\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\dynamicMenu\consts folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\dynamicMenu folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\contextMenu\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\contextMenu\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\contextMenu\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\contextMenu folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\container folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\components\view\InjectScript folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\components\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\components\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\components\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\components folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items\about folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\items folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\css folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\compatibility folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API\Toolbar folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API\Component\view folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API\Component\model folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API\Component\controller folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API\Component folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js\API folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\js folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0\Css folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl\2.3.15.10_0 folder moved successfully.
C:\Users\Garett Raines\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdhffggcfjnkigeciffmipblemhphbjl folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Garett Raines\Desktop\cmd.bat deleted successfully.
C:\Users\Garett Raines\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Garett Raines
->Java cache emptied: 7071346 bytes

User: Public

User: Yajamj
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 7.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 56475 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Garett Raines
->Flash cache emptied: 6065 bytes

User: Public

User: Yajamj
->Flash cache emptied: 16449 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.55.0 log created on 08062012_190800

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 06 August 2012 - 09:42 PM

Greetings

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 GTRaines

GTRaines
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:12 AM

Posted 07 August 2012 - 05:51 PM

I ran ComboFix with no problems. The log is pasted below. Still no sign of Whitesmoke or of any other problems.

LOG:

ComboFix 12-08-04.02 - Garett Raines 08/07/2012 18:28:41.5.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6058.4370 [GMT -4:00]
Running from: c:\users\Garett Raines\Desktop\ComboFix.exe
Command switches used :: c:\users\Garett Raines\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-07 to 2012-08-07 )))))))))))))))))))))))))))))))
.
.
2012-08-07 22:36 . 2012-08-07 22:36 -------- d-----w- c:\users\Yajamj\AppData\Local\temp
2012-08-07 22:36 . 2012-08-07 22:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-07 15:11 . 2012-06-29 10:04 9133488 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{23E7A0B7-3659-468B-9D30-C4C3D2F7DAA8}\mpengine.dll
2012-08-06 23:08 . 2012-08-06 23:08 -------- d-----w- C:\_OTL
2012-08-03 00:59 . 2012-08-03 00:59 -------- d-----w- c:\users\Garett Raines\AppData\Local\Adobe
2012-08-02 00:14 . 2012-08-02 00:14 -------- d-----w- c:\program files (x86)\Runtime Software
2012-08-01 03:01 . 2012-08-01 03:01 -------- d-----w- c:\users\Yajamj\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\programdata\Malwarebytes
2012-08-01 02:26 . 2012-08-01 02:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-01 02:26 . 2012-07-03 17:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Local\CRE
2012-07-31 10:09 . 2012-07-31 10:09 -------- d-----w- c:\users\Garett Raines\AppData\Roaming\.minecraft
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\Yahoo!
2012-07-21 20:26 . 2012-07-21 20:26 -------- d-----w- c:\users\Garett Raines\AppData\Local\NanoService
2012-07-14 19:15 . 2012-07-14 19:15 -------- d--h--w- c:\users\Garett Raines\AppData\Roaming\RPPrivate
2012-07-12 01:52 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-11 15:12 . 2012-06-02 05:50 458704 ----a-w- c:\windows\system32\drivers\cng.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-03 23:18 . 2012-04-12 16:54 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-03 23:18 . 2011-07-25 21:24 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-01 22:03 . 2012-02-08 15:30 4273464 ----a-w- c:\windows\uninst.exe
2012-07-12 01:49 . 2011-07-19 12:24 59701280 ----a-w- c:\windows\system32\MRT.exe
2012-06-22 19:44 . 2012-06-22 19:44 476936 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-06-22 19:44 . 2011-07-05 07:45 472840 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-07 23:42 . 2011-12-07 01:19 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-06-07 23:42 . 2011-12-07 01:19 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-06-02 22:19 . 2012-06-22 19:51 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 19:51 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-22 19:51 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 19:51 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 19:51 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-22 19:51 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-22 19:51 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 19:19 . 2012-06-22 19:51 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 19:15 . 2012-06-22 19:51 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-05-31 16:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-01_21.51.14 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-07-28 16:36 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-03 23:18 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-21 03:09 . 2012-08-06 15:07 56348 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-08-07 20:39 39882 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-07-04 02:45 . 2012-08-07 20:39 17866 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-332865389-3069509686-3046347489-1001_UserData.bin
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-05-18 04:08 . 2012-08-07 20:37 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-05-18 04:08 . 2012-08-01 21:51 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-05-18 04:08 . 2012-08-07 20:37 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-08-01 21:51 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-08-07 20:37 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-05-18 04:59 . 2012-08-03 23:21 2984 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-08-04 16:16 . 2012-08-04 16:16 9560 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_48.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 4280 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_32.bin
+ 2012-08-04 16:16 . 2012-08-04 16:16 2456 c:\windows\system32\NetworkList\Icons\{676827B8-BE26-4CA7-A644-0584BB617AFD}_24.bin
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-08-07 20:37 . 2012-08-07 20:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-08-07 20:37 . 2012-08-07 20:37 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-08-01 21:50 . 2012-08-01 21:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 686792 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 466632 c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_270_ActiveX.dll
- 2012-04-12 16:54 . 2012-07-28 16:36 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-04-12 16:54 . 2012-08-03 23:18 250056 c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2011-07-05 00:20 . 2012-08-07 18:44 297346 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2011-07-03 13:26 . 2012-08-07 17:22 325490 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2012-08-07 20:41 624412 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-08-01 15:10 624412 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-08-07 20:41 106756 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-08-01 15:10 106756 c:\windows\system32\perfc009.dat
+ 2012-08-03 23:18 . 2012-08-03 23:18 417992 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.exe
+ 2012-08-03 23:18 . 2012-08-03 23:18 513224 c:\windows\system32\Macromed\Flash\FlashUtil64_11_3_300_270_ActiveX.dll
- 2009-07-14 05:01 . 2012-08-01 21:50 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-08-07 19:05 436548 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-07-21 03:22 . 2012-08-07 19:05 4901048 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1003-8192.dat
- 2011-07-21 03:22 . 2012-08-01 03:15 4901048 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1003-8192.dat
- 2011-07-23 03:30 . 2012-08-01 21:50 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
+ 2011-07-23 03:30 . 2012-08-07 01:39 3859796 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-12288.dat
+ 2012-08-01 18:39 . 2012-08-01 18:39 7930368 c:\windows\Installer\c9be0a.msi
+ 2011-07-10 20:20 . 2012-08-07 19:05 21323590 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-332865389-3069509686-3046347489-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"LMab1err"="c:\program files\Lexmark\ErrorApp\LMab1err.exe" [2010-03-26 582312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-11-05 407920]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-11-05 202096]
"VitaKeyTSR"="c:\program files (x86)\EgisTec BioExcess\EgisTSR.exe" [2010-12-13 383344]
"PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400]
"YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2010-12-24 136488]
"YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2010-12-24 224352]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504]
"UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-03-17 728120]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-06-07 296056]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Garett Raines\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-2-17 113664]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2011-2-25 15776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-03 250056]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-12-21 36328]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 136176]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-11-02 340240]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 177640]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-05-10 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-05 1255736]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys [2011-05-18 57952]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys [2011-05-18 39008]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [2009-12-09 23648]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys [2011-05-18 13408]
S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys [2011-05-18 55880]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2011-05-18 22912]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2011-05-18 20328]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2011-05-18 62584]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Agile1Password;1Password;c:\program files (x86)\1Password\Agile1pService.exe [2011-08-17 767240]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2011-02-27 499200]
S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [2010-10-22 327024]
S2 EgisTec Service;EgisTec Service;c:\program files (x86)\EgisTec BioExcess\EgisService.exe [2010-12-13 703856]
S2 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2010-12-13 650096]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2010-10-31 35952]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-03-17 476728]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2011-02-27 885248]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2011-05-18 29792]
S3 bpenum;Intel® Centrino® WiMAX Enumerator;c:\windows\system32\DRIVERS\bpenum.sys [2011-02-17 75264]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;c:\windows\system32\DRIVERS\bpmp.sys [2011-02-17 174080]
S3 bpusb;Intel® Centrino® WiMAX 6050 Series Function Driver;c:\windows\system32\Drivers\bpusb.sys [2011-02-17 81920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-12-24 31088]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2010-11-09 8500736]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2010-11-30 307304]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-05-31 333928]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\usbvideo.sys [2010-11-21 184960]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 23:18]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-18 04:50]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001Core.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-05 21:35]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1001UA.job
- c:\users\Garett Raines\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-05 21:35]
.
2012-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003Core.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-332865389-3069509686-3046347489-1003UA.job
- c:\users\Yajamj\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-21 04:50]
.
2012-08-02 c:\windows\Tasks\Norton Security Scan for Garett Raines.job
- c:\progra~2\NORTON~2\Engine\372~1.5\Nss.exe [2012-06-09 09:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Garett Raines\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-29 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-29 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-29 418840]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-11-02 1933584]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2011-03-01 1617920]
"TpShocks"="c:\windows\System32\TpShocks.exe" [2010-03-15 231328]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2011-05-18 9769888]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2011-05-18 5908928]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2011-05-18 114688]
"WrtMon.exe"="c:\windows\system32\spool\drivers\x64\3\WrtMon.exe" [2007-07-18 20480]
"LMPSSDMON"="c:\program files\Lexmark\Monitor\ACJ\LMabMON.exe" [2010-03-26 753664]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_270_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_270.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-08-07 18:49:00
ComboFix-quarantined-files.txt 2012-08-07 22:48
ComboFix2.txt 2012-08-04 22:11
ComboFix3.txt 2012-08-04 16:49
ComboFix4.txt 2012-08-01 23:05
ComboFix5.txt 2012-08-07 22:27
.
Pre-Run: 295,428,169,728 bytes free
Post-Run: 295,439,372,288 bytes free
.
- - End Of File - - CED45982FF1DB400FE35CCE91870C730

#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:02:12 AM

Posted 07 August 2012 - 07:27 PM

Hello

I would like to see a report that combofix makes.

extra combofix report

  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box
C:\Qoobox\Add-Remove Programs.txt
  • click ok

copy and paste the report into this topic for me to review

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users