Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer keeps shutting down, pop up ads, redirects


  • This topic is locked This topic is locked
48 replies to this topic

#1 computerunderattack

computerunderattack

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 12 February 2014 - 11:54 PM

My computer keeps shutting down. I have scanned it for viruses & malware. It comes up negative. Everytime I get on interrnet...it redircts to another site, also I keep getting these little pop up ads. Also within a web page it underlines words and when you click on them it takes you to another site. My CPU useage is up to 50%. I am  running windows professional, using Malware bytes, windows security essentials. Please help! As soon as I posted this, it underlined words in my post!


Edited by computerunderattack, 12 February 2014 - 11:55 PM.


BC AdBot (Login to Remove)

 


m

#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:24 AM

Posted 13 February 2014 - 12:33 AM





Hello computerunderattack

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 13 February 2014 - 12:56 AM

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Retia Bell (administrator) on RETIABELL-PC on 12-02-2014 23:49:59
Running from C:\Users\Retia Bell\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Microsoft Corporation) C:\Windows\system32\locator.exe
(Memeo) C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_44.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2952845082-3999916913-1929034053-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2952845082-3999916913-1929034053-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7E37BE333126CF01
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {F74CE2D8-F6FD-4CBF-86C5-0DA6EF444D4B} URL = https://www.google.com/search?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
Handler: AutorunsDisabled\linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: AutorunsDisabled\ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: AutorunsDisabled\skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

FireFox:
========
FF ProfilePath: C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default
FF DefaultSearchEngine: Yahoo
FF SearchEngineOrder.1: Yahoo
FF SearchEngineOrder.2: Ask Search
FF SelectedSearchEngine: Yahoo
FF Homepage: https://www.google.com/
FF Keyword.URL: hxxp://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,157,0_0,Search,20140104,20030,0,85,0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 - C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF Plugin: @Motive.com/npMotiveRequest,version=1.0 - C:\Program Files\Common Files\Motive\npMotiveRequest.dll (Alcatel-Lucent)
FF Plugin: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll (OGPlanet)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @rim.com/npappworld - C:\Program Files\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Retia Bell\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Retia Bell\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Retia Bell\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Retia Bell\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Retia Bell\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Retia Bell\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Retia Bell\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Retia Bell\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Retia Bell\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\aol-search.xml
FF SearchPlugin: C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\inbox-search.xml
FF SearchPlugin: C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: ArcadeParlor - C:\Users\Retia Bell\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404} [2014-01-24]
FF Extension: ArcadeParlor - C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\Extensions\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404} [2014-01-24]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-11-16]
FF Extension: Motive Extension - C:\Program Files\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2013-11-16]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-11-16]
FF HKLM\...\Firefox\Extensions: [fbdownloader@KMcore] - C:\Program Files\SDIV 2.0\Lib\xpi

Chrome:
=======
CHR Extension: (No Name) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\abpgpfeejjkdgbegcmbbiimbefakonej [2014-01-24]
CHR Extension: (Motive Extension) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2013-12-23]
CHR Extension: (Yahoo! Toolbar for Chrome) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihhgekonheiliaidomffpplfhecmkag [2014-02-05]
CHR Extension: (No Name) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi [2013-12-23]
CHR Extension: (Skype Click to Call) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-12-23]
CHR Extension: (No Name) - C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-23]
CHR HKLM\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files\Common Files\Motive\extensions\MotiveRequest.crx [2013-10-11]
CHR HKLM\...\Chrome\Extension: [gclijllifhfpomppedeljakfegbcpojn] - C:\Users\Retia Bell\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx [2013-10-11]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
CHR HKCU\...\Chrome\Extension: [gclijllifhfpomppedeljakfegbcpojn] - C:\Users\Retia Bell\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx [2013-10-09]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S4 avgfws; C:\Program Files\AVG\AVG2014\avgfws.exe [1358944 2013-09-25] (AVG Technologies CZ, s.r.o.)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [250200 2013-09-19] (Garmin Ltd or its subsidiaries)
S4 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 MemeoBackgroundService; C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe [26496 2012-10-11] (Memeo)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 SeagateDashboardService; C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [14752 2012-10-15] (Memeo)
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3275136 2013-10-09] (Skype Technologies S.A.)
S2 AVGIDSAgent; "C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe" [X]
S2 avgwd; "C:\Program Files\AVG\AVG10\avgwdsvc.exe" [X]
S2 vToolbarUpdater17.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [120632 2013-09-25] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [47928 2013-09-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [145720 2013-09-02] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [176952 2013-09-02] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [223032 2013-09-02] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [102200 2013-08-20] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27448 2013-09-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [193848 2013-08-01] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-12] (AVG Technologies)
R3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41752 2008-07-26] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2012-12-10] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2012-12-10] (Printing Communications Assoc., Inc. (PCAUSA))
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
R3 OmniTV; C:\Windows\System32\DRIVERS\OmniTV.sys [401280 2008-04-29] (YUAN High-Tech Development Co. Ltd.)
S3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [13848 2008-07-26] (Logitech Inc.)
S3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [2570520 2008-07-26] (Logitech Inc.)
S3 AVGIDSDriver; system32\DRIVERS\AVGIDSDriver.Sys [X]
S3 AVGIDSShim; system32\DRIVERS\AVGIDSShim.Sys [X]
S3 catchme; \??\C:\Users\RETIAB~1\AppData\Local\Temp\catchme.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 LVPr2Mon; system32\DRIVERS\LVPr2Mon.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-12 23:49 - 2014-02-12 23:51 - 00017691 _____ () C:\Users\Retia Bell\Desktop\FRST.txt
2014-02-12 23:49 - 2014-02-12 23:49 - 00000000 ____D () C:\FRST
2014-02-12 23:48 - 2014-02-12 23:48 - 01141248 _____ (Farbar) C:\Users\Retia Bell\Desktop\FRST.exe
2014-02-12 23:02 - 2014-02-12 23:22 - 00000000 ____D () C:\AdwCleaner
2014-02-12 23:01 - 2014-02-12 23:02 - 01166132 _____ () C:\Users\Retia Bell\Desktop\AdwCleaner.exe
2014-02-12 22:14 - 2014-02-12 22:14 - 00051216 _____ () C:\Users\Retia Bell\Desktop\RETIA F BELL - 603871 - Unitrin Services Company.htm
2014-02-12 20:00 - 2014-02-12 22:13 - 00002476 _____ () C:\Users\Retia Bell\Desktop\Rkill.txt
2014-02-12 20:00 - 2014-02-12 20:00 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Retia Bell\Desktop\rkill.com
2014-02-11 09:54 - 2014-02-11 09:54 - 00071810 _____ () C:\Users\Retia Bell\Desktop\Kemper Home Services.htm
2014-02-11 08:20 - 2014-02-11 08:20 - 00000000 ____D () C:\Users\Retia Bell\Documents\2014_02_11
2014-02-10 21:42 - 2014-02-10 21:43 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Google
2014-02-10 21:40 - 2014-02-10 21:40 - 00000000 ____D () C:\ProgramData\Google
2014-02-08 17:40 - 2014-02-08 17:40 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-02-08 17:39 - 2014-02-08 17:39 - 31894664 _____ (Microsoft Corporation) C:\Users\Retia Bell\Desktop\EIE11_EN-US_MSE_WIN7.EXE
2014-02-08 17:21 - 2014-02-08 17:22 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-08 17:10 - 2014-02-08 17:10 - 00000000 __RSH () C:\MSDOS.SYS
2014-02-08 17:10 - 2014-02-08 17:10 - 00000000 __RSH () C:\IO.SYS
2014-02-08 12:27 - 2014-02-08 16:26 - 00000000 ____D () C:\Program Files\WinPcap
2014-02-05 16:39 - 2014-02-05 16:39 - 00000048 _____ () C:\Users\Retia Bell\AppData\Roaming\mbam.context.scan
2014-02-05 00:54 - 2014-02-05 00:54 - 00075753 _____ () C:\Users\Retia Bell\Desktop\payment hx.htm
2014-02-05 00:05 - 2014-02-05 00:12 - 00000028 _____ () C:\Users\Retia Bell\AppData\Roaming\WB.CFG
2014-02-05 00:03 - 2014-02-12 23:10 - 00000308 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-05 00:03 - 2014-02-08 17:19 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\DigitalSites
2014-02-05 00:03 - 2014-02-05 00:03 - 00001228 _____ () C:\Users\Public\Desktop\Image Converter.lnk
2014-02-05 00:03 - 2014-02-05 00:03 - 00000000 ____D () C:\Program Files\Image Converter
2014-01-31 08:05 - 2014-01-31 08:05 - 00000014 _____ () C:\Users\Retia Bell\Desktop\yahoo.password.txt
2014-01-31 06:56 - 2014-01-31 06:56 - 00010499 _____ () C:\Users\Retia Bell\Documents\Book2.xlsx
2014-01-30 23:48 - 2014-01-30 23:48 - 00011985 _____ () C:\Users\Retia Bell\Documents\turn2014.xlsx
2014-01-30 09:37 - 2014-01-30 09:37 - 00064888 _____ () C:\Users\Retia Bell\Documents\T-Mobile.htm
2014-01-28 17:31 - 2014-01-28 17:31 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\MAGIX
2014-01-28 17:28 - 2014-01-28 17:28 - 00001129 _____ () C:\Users\Public\Desktop\MAGIX Photo Manager 9.lnk
2014-01-28 17:28 - 2014-01-28 17:28 - 00000000 ____D () C:\Users\Retia Bell\Documents\MAGIX_Screenshare
2014-01-28 17:28 - 2009-04-02 18:28 - 00720896 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLAV32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00274432 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLRES32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00212992 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLDRV32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00212992 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLDEV32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00147456 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLCPY32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00094208 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLIO32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00090112 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLPRF32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00077824 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\DLLPNT32.dll
2014-01-28 17:28 - 2009-04-02 18:28 - 00065536 _____ (PoINT Software & Systems GmbH) C:\Windows\system32\STRING32.dll
2014-01-28 17:28 - 2005-04-09 22:05 - 00027807 _____ () C:\Windows\system32\mgxcdr.txt
2014-01-28 17:27 - 2014-01-28 17:47 - 00000000 ____D () C:\ProgramData\MAGIX
2014-01-28 17:27 - 2014-01-28 17:28 - 00000000 ____D () C:\Program Files\MAGIX
2014-01-28 17:27 - 2014-01-28 17:27 - 00000000 ____D () C:\Users\Retia Bell\Documents\MAGIX_Photo_Manager_9
2014-01-28 17:27 - 2007-04-27 10:43 - 00120200 _____ () C:\Windows\system32\DLLDEV32i.dll
2014-01-28 17:24 - 2014-01-28 17:29 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Services
2014-01-28 17:21 - 2014-01-28 17:37 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\MAGIX
2014-01-28 17:19 - 2014-01-28 17:19 - 03581480 _____ (MAGIX AG) C:\Users\Retia Bell\Desktop\photo_manager_9_int.exe
2014-01-28 16:43 - 2014-01-28 16:43 - 00039333 _____ () C:\Users\Retia Bell\Desktop\Instagram.htm
2014-01-28 14:56 - 2014-01-28 14:56 - 00188332 _____ () C:\Users\Retia Bell\Desktop\1_21_14.htm
2014-01-28 14:54 - 2014-01-28 14:54 - 03640400 _____ (MAGIX AG) C:\Users\Retia Bell\Desktop\video_easy_se_int.exe
2014-01-28 11:59 - 2014-01-28 11:59 - 01069512 _____ (Solid State Networks) C:\Users\Retia Bell\Documents\install_flashplayer12x32au_mssa_aaa_aih.exe
2014-01-27 22:02 - 2014-01-27 22:02 - 00009053 _____ () C:\Users\Retia Bell\Desktop\MyStudentData.txt
2014-01-24 21:04 - 2014-01-28 17:47 - 00000000 ____D () C:\ProgramData\Websteroids
2014-01-24 19:23 - 2014-01-28 17:48 - 00000000 ____D () C:\ProgramData\Winferno
2014-01-24 19:19 - 2014-01-28 17:47 - 00000000 ____D () C:\ProgramData\Fighters
2014-01-24 19:18 - 2014-01-28 17:48 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-01-24 19:18 - 2014-01-24 19:18 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArcadeParlor
2014-01-24 19:18 - 2014-01-24 19:18 - 00000000 ____D () C:\Program Files\SaveDailyDeals Updater
2014-01-21 18:16 - 2014-01-21 18:16 - 00017628 _____ () C:\Users\Retia Bell\Desktop\2ndexport_20140121061551.xls
2014-01-21 17:49 - 2014-01-21 17:49 - 00017628 _____ () C:\Users\Retia Bell\Desktop\export_20140121054906.xls
2014-01-21 17:17 - 2014-01-22 13:05 - 00002764 _____ () C:\Users\Retia Bell\Desktop\phone numbers.txt
2014-01-20 12:20 - 2014-01-20 12:20 - 00000000 ____D () C:\Users\Retia Bell\Desktop\taye leah
2014-01-20 12:17 - 2014-01-20 12:17 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\com.comcast.callerid
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D () C:\Program Files\iTunes
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D () C:\Program Files\iPod
2014-01-19 13:05 - 2014-01-19 13:07 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-01-18 20:30 - 2014-01-18 20:30 - 00000729 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer3.htm
2014-01-18 20:30 - 2014-01-18 20:30 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer3_files
2014-01-18 20:22 - 2014-01-18 20:22 - 00000729 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer1.htm
2014-01-18 20:22 - 2014-01-18 20:22 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer1_files
2014-01-18 20:21 - 2014-01-18 20:21 - 00000727 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer.htm
2014-01-18 20:21 - 2014-01-18 20:21 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer_files
2014-01-15 09:50 - 2013-11-26 19:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 09:50 - 2013-11-26 19:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 09:50 - 2013-11-26 05:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 09:50 - 2013-11-26 04:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-14 19:10 - 2014-01-14 19:10 - 01859304 _____ (Coupons.com Incorporated) C:\Users\Retia Bell\Desktop\CouponPrinter.exe
2014-01-14 19:10 - 2014-01-14 19:10 - 00000000 ____D () C:\Program Files\Coupons
2014-01-13 20:25 - 2014-01-13 20:25 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Oracle

==================== One Month Modified Files and Folders =======

2014-02-12 23:51 - 2014-02-12 23:49 - 00017691 _____ () C:\Users\Retia Bell\Desktop\FRST.txt
2014-02-12 23:50 - 2009-07-13 22:34 - 00016176 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:50 - 2009-07-13 22:34 - 00016176 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-12 23:49 - 2014-02-12 23:49 - 00000000 ____D () C:\FRST
2014-02-12 23:48 - 2014-02-12 23:48 - 01141248 _____ (Farbar) C:\Users\Retia Bell\Desktop\FRST.exe
2014-02-12 23:48 - 2011-06-05 19:39 - 00783310 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-12 23:46 - 2011-06-05 21:32 - 01604333 _____ () C:\Windows\WindowsUpdate.log
2014-02-12 23:43 - 2013-12-02 21:52 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-12 23:41 - 2013-06-28 18:10 - 00016594 _____ () C:\Windows\setupact.log
2014-02-12 23:41 - 2009-07-13 22:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-12 23:22 - 2014-02-12 23:02 - 00000000 ____D () C:\AdwCleaner
2014-02-12 23:14 - 2012-09-04 18:33 - 00000928 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job
2014-02-12 23:14 - 2011-08-25 07:43 - 01656832 ___SH () C:\Users\Retia Bell\Downloads\Thumbs.db
2014-02-12 23:10 - 2014-02-05 00:03 - 00000308 _____ () C:\Windows\Tasks\Digital Sites.job
2014-02-12 23:04 - 2013-11-16 16:02 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-12 23:03 - 2013-12-02 21:52 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-12 23:02 - 2014-02-12 23:01 - 01166132 _____ () C:\Users\Retia Bell\Desktop\AdwCleaner.exe
2014-02-12 23:00 - 2012-04-13 15:33 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-12 22:54 - 2012-10-12 18:49 - 00000948 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job
2014-02-12 22:23 - 2011-06-09 17:09 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\Deployment
2014-02-12 22:22 - 2011-09-10 09:08 - 00000000 ____D () C:\Users\Retia Bell\Documents\Outlook Files
2014-02-12 22:14 - 2014-02-12 22:14 - 00051216 _____ () C:\Users\Retia Bell\Desktop\RETIA F BELL - 603871 - Unitrin Services Company.htm
2014-02-12 22:13 - 2014-02-12 20:00 - 00002476 _____ () C:\Users\Retia Bell\Desktop\Rkill.txt
2014-02-12 22:13 - 2009-07-13 22:53 - 00032624 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-12 20:40 - 2011-12-04 16:45 - 00413862 _____ () C:\Windows\PFRO.log
2014-02-12 20:00 - 2014-02-12 20:00 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Retia Bell\Desktop\rkill.com
2014-02-12 19:54 - 2012-10-12 18:49 - 00000926 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job
2014-02-12 19:20 - 2012-03-20 22:33 - 00000000 ____D () C:\Program Files\Java
2014-02-12 19:18 - 2011-12-17 10:17 - 00000000 ____D () C:\Windows\pss
2014-02-12 19:18 - 2011-09-04 12:43 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-12 19:18 - 2011-09-04 12:43 - 00000000 ____D () C:\ProgramData\Norton
2014-02-12 02:14 - 2012-09-04 18:32 - 00000876 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job
2014-02-11 21:07 - 2012-07-13 22:08 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\KeeperData
2014-02-11 16:32 - 2011-06-09 17:09 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\Google
2014-02-11 09:54 - 2014-02-11 09:54 - 00071810 _____ () C:\Users\Retia Bell\Desktop\Kemper Home Services.htm
2014-02-11 08:20 - 2014-02-11 08:20 - 00000000 ____D () C:\Users\Retia Bell\Documents\2014_02_11
2014-02-10 21:43 - 2014-02-10 21:42 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Google
2014-02-10 21:42 - 2011-06-06 07:24 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\Adobe
2014-02-10 21:40 - 2014-02-10 21:40 - 00000000 ____D () C:\ProgramData\Google
2014-02-10 21:40 - 2012-12-07 23:50 - 00000000 ____D () C:\Program Files\Google
2014-02-10 21:39 - 2012-04-13 15:33 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-10 21:39 - 2011-06-06 07:21 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-10 20:31 - 2011-06-09 17:17 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\SolSuite
2014-02-10 18:24 - 2011-10-18 22:32 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-02-10 15:52 - 2011-09-06 23:29 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-09 16:29 - 2011-08-20 15:39 - 12001792 ___SH () C:\Users\Retia Bell\Desktop\Thumbs.db
2014-02-08 17:40 - 2014-02-08 17:40 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-02-08 17:40 - 2013-11-20 06:01 - 00031034 _____ () C:\Windows\IE11_main.log
2014-02-08 17:39 - 2014-02-08 17:39 - 31894664 _____ (Microsoft Corporation) C:\Users\Retia Bell\Desktop\EIE11_EN-US_MSE_WIN7.EXE
2014-02-08 17:26 - 2011-06-05 21:31 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-08 17:22 - 2014-02-08 17:21 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-08 17:19 - 2014-02-05 00:03 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\DigitalSites
2014-02-08 17:10 - 2014-02-08 17:10 - 00000000 __RSH () C:\MSDOS.SYS
2014-02-08 17:10 - 2014-02-08 17:10 - 00000000 __RSH () C:\IO.SYS
2014-02-08 16:54 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-02-08 16:53 - 2011-06-12 20:19 - 00062371 _____ () C:\Windows\system32\lvcoinst.log
2014-02-08 16:34 - 2011-06-05 19:35 - 00000000 ____D () C:\Users\Retia Bell
2014-02-08 16:33 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\AppCompat
2014-02-08 16:32 - 2009-07-13 20:37 - 00000000 ____D () C:\Windows\registration
2014-02-08 16:31 - 2011-06-05 20:15 - 00000000 __RHD () C:\MSOCache
2014-02-08 16:26 - 2014-02-08 12:27 - 00000000 ____D () C:\Program Files\WinPcap
2014-02-05 16:39 - 2014-02-05 16:39 - 00000048 _____ () C:\Users\Retia Bell\AppData\Roaming\mbam.context.scan
2014-02-05 00:54 - 2014-02-05 00:54 - 00075753 _____ () C:\Users\Retia Bell\Desktop\payment hx.htm
2014-02-05 00:12 - 2014-02-05 00:05 - 00000028 _____ () C:\Users\Retia Bell\AppData\Roaming\WB.CFG
2014-02-05 00:03 - 2014-02-05 00:03 - 00001228 _____ () C:\Users\Public\Desktop\Image Converter.lnk
2014-02-05 00:03 - 2014-02-05 00:03 - 00000000 ____D () C:\Program Files\Image Converter
2014-02-04 07:15 - 2013-09-09 17:34 - 00000000 ____D () C:\Program Files\AVG SafeGuard toolbar
2014-01-31 08:05 - 2014-01-31 08:05 - 00000014 _____ () C:\Users\Retia Bell\Desktop\yahoo.password.txt
2014-01-31 06:56 - 2014-01-31 06:56 - 00010499 _____ () C:\Users\Retia Bell\Documents\Book2.xlsx
2014-01-30 23:48 - 2014-01-30 23:48 - 00011985 _____ () C:\Users\Retia Bell\Documents\turn2014.xlsx
2014-01-30 09:37 - 2014-01-30 09:37 - 00064888 _____ () C:\Users\Retia Bell\Documents\T-Mobile.htm
2014-01-29 00:37 - 2011-06-09 18:05 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Skype
2014-01-28 17:48 - 2014-01-24 19:23 - 00000000 ____D () C:\ProgramData\Winferno
2014-01-28 17:48 - 2014-01-24 19:18 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-01-28 17:48 - 2013-04-18 08:16 - 00000000 __HDC () C:\ProgramData\{37EC31B8-ED4C-4A55-8784-278FE3A64349}
2014-01-28 17:48 - 2013-04-18 08:16 - 00000000 __HDC () C:\ProgramData\{2BF6C479-CE8D-4B51-889B-3B996C6320FC}
2014-01-28 17:48 - 2013-03-26 13:05 - 00000000 ____D () C:\ProgramData\ZeoBIT
2014-01-28 17:48 - 2011-06-12 20:24 - 00000000 ____D () C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2014-01-28 17:47 - 2014-01-28 17:27 - 00000000 ____D () C:\ProgramData\MAGIX
2014-01-28 17:47 - 2014-01-24 21:04 - 00000000 ____D () C:\ProgramData\Websteroids
2014-01-28 17:47 - 2014-01-24 19:19 - 00000000 ____D () C:\ProgramData\Fighters
2014-01-28 17:47 - 2013-12-22 07:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-28 17:47 - 2013-10-11 19:27 - 00000000 ____D () C:\ProgramData\Motive
2014-01-28 17:47 - 2013-10-06 17:50 - 00000000 ____D () C:\ProgramData\AVG2014
2014-01-28 17:47 - 2013-09-09 17:34 - 00000000 ____D () C:\ProgramData\AVG SafeGuard toolbar
2014-01-28 17:47 - 2013-07-04 11:19 - 00000000 ____D () C:\ProgramData\3EF3461FDD7BCB4A00003EF30734D347
2014-01-28 17:47 - 2013-04-18 08:17 - 00000000 __HDC () C:\ProgramData\{EBC2CB8D-EC3E-4E7D-9B44-89FF140D15B6}
2014-01-28 17:47 - 2013-04-18 08:16 - 00000000 ____D () C:\ProgramData\ExamForce
2014-01-28 17:47 - 2013-04-14 20:44 - 00000000 __SHD () C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2014-01-28 17:47 - 2013-04-14 20:44 - 00000000 ____D () C:\ProgramData\AVG
2014-01-28 17:47 - 2013-04-12 22:32 - 00000000 ____D () C:\ProgramData\Mozilla
2014-01-28 17:47 - 2013-03-18 18:50 - 00000000 ____D () C:\ProgramData\SecTaskMan
2014-01-28 17:47 - 2012-10-27 06:27 - 00000000 ____D () C:\ProgramData\Research In Motion
2014-01-28 17:47 - 2012-09-10 18:54 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX
2014-01-28 17:47 - 2012-08-30 22:16 - 00000000 ____D () C:\ProgramData\Microsoft SkyDrive
2014-01-28 17:47 - 2012-07-17 17:03 - 00000000 ____D () C:\ProgramData\NCH Software
2014-01-28 17:47 - 2012-07-12 20:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-01-28 17:47 - 2012-06-16 18:41 - 00000000 ____D () C:\ProgramData\Logitech
2014-01-28 17:47 - 2012-03-08 17:54 - 00000000 ____D () C:\ProgramData\InstallMate
2014-01-28 17:47 - 2012-01-21 18:21 - 00000000 ____D () C:\ProgramData\MemeoCommon
2014-01-28 17:47 - 2012-01-17 00:50 - 00000000 ____D () C:\ProgramData\Garmin
2014-01-28 17:47 - 2012-01-16 23:12 - 00000000 ____D () C:\ProgramData\TomTom
2014-01-28 17:47 - 2011-12-30 21:21 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-01-28 17:47 - 2011-11-11 14:31 - 00000000 ____D () C:\ProgramData\CanonIJ
2014-01-28 17:47 - 2011-11-11 14:29 - 00000000 ___HD () C:\ProgramData\CanonIJScan
2014-01-28 17:47 - 2011-10-30 17:37 - 00000000 ____D () C:\ProgramData\Real
2014-01-28 17:47 - 2011-10-18 23:07 - 00000000 ___HD () C:\ProgramData\CanonIJSolutionMenuEX
2014-01-28 17:47 - 2011-10-18 23:07 - 00000000 ___HD () C:\ProgramData\CanonIJMyPrinter
2014-01-28 17:47 - 2011-10-18 23:07 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-01-28 17:47 - 2011-10-18 23:07 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-01-28 17:47 - 2011-10-18 22:31 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool
2014-01-28 17:47 - 2011-10-18 21:57 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-01-28 17:47 - 2011-10-18 21:54 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-01-28 17:47 - 2011-09-26 20:13 - 00000000 ____D () C:\ProgramData\Intuit
2014-01-28 17:47 - 2011-09-17 10:09 - 00000000 ____D () C:\ProgramData\Nexon
2014-01-28 17:47 - 2011-09-17 09:58 - 00000000 ____D () C:\ProgramData\NexonUS
2014-01-28 17:47 - 2011-08-20 21:06 - 00000000 ____D () C:\ProgramData\WebEx
2014-01-28 17:47 - 2011-08-20 15:12 - 00000000 ____D () C:\ProgramData\Walgreens PictureMover
2014-01-28 17:47 - 2011-08-20 15:12 - 00000000 ____D () C:\ProgramData\PictureMover
2014-01-28 17:47 - 2011-08-18 22:42 - 00000000 ____D () C:\ProgramData\McAfee
2014-01-28 17:47 - 2011-07-22 21:38 - 00000000 ____D () C:\ProgramData\MFAData
2014-01-28 17:47 - 2011-06-12 21:00 - 00000000 ____D () C:\ProgramData\LogiShrd
2014-01-28 17:47 - 2011-06-12 20:22 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-01-28 17:47 - 2011-06-12 20:21 - 00000000 ____D () C:\ProgramData\Apple
2014-01-28 17:47 - 2011-06-11 18:07 - 00000000 ____D () C:\ProgramData\Vuesoft
2014-01-28 17:47 - 2011-06-09 18:05 - 00000000 ____D () C:\ProgramData\Skype
2014-01-28 17:47 - 2011-06-09 17:17 - 00000000 ____D () C:\ProgramData\TreeCardGames
2014-01-28 17:47 - 2011-06-06 07:22 - 00000000 ____D () C:\ProgramData\Adobe
2014-01-28 17:47 - 2011-06-06 07:19 - 00000000 ____D () C:\ProgramData\Sun
2014-01-28 17:37 - 2014-01-28 17:21 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\MAGIX
2014-01-28 17:31 - 2014-01-28 17:31 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\MAGIX
2014-01-28 17:29 - 2014-01-28 17:24 - 00000000 ____D () C:\Program Files\Common Files\MAGIX Services
2014-01-28 17:28 - 2014-01-28 17:28 - 00001129 _____ () C:\Users\Public\Desktop\MAGIX Photo Manager 9.lnk
2014-01-28 17:28 - 2014-01-28 17:28 - 00000000 ____D () C:\Users\Retia Bell\Documents\MAGIX_Screenshare
2014-01-28 17:28 - 2014-01-28 17:27 - 00000000 ____D () C:\Program Files\MAGIX
2014-01-28 17:27 - 2014-01-28 17:27 - 00000000 ____D () C:\Users\Retia Bell\Documents\MAGIX_Photo_Manager_9
2014-01-28 17:19 - 2014-01-28 17:19 - 03581480 _____ (MAGIX AG) C:\Users\Retia Bell\Desktop\photo_manager_9_int.exe
2014-01-28 16:43 - 2014-01-28 16:43 - 00039333 _____ () C:\Users\Retia Bell\Desktop\Instagram.htm
2014-01-28 14:56 - 2014-01-28 14:56 - 00188332 _____ () C:\Users\Retia Bell\Desktop\1_21_14.htm
2014-01-28 14:54 - 2014-01-28 14:54 - 03640400 _____ (MAGIX AG) C:\Users\Retia Bell\Desktop\video_easy_se_int.exe
2014-01-28 11:59 - 2014-01-28 11:59 - 01069512 _____ (Solid State Networks) C:\Users\Retia Bell\Documents\install_flashplayer12x32au_mssa_aaa_aih.exe
2014-01-27 22:02 - 2014-01-27 22:02 - 00009053 _____ () C:\Users\Retia Bell\Desktop\MyStudentData.txt
2014-01-24 19:43 - 2011-09-23 21:40 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-01-24 19:19 - 2011-07-23 14:32 - 00000000 ____D () C:\Users\Retia Bell\AppData\Local\Downloaded Installations
2014-01-24 19:18 - 2014-01-24 19:18 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArcadeParlor
2014-01-24 19:18 - 2014-01-24 19:18 - 00000000 ____D () C:\Program Files\SaveDailyDeals Updater
2014-01-22 13:05 - 2014-01-21 17:17 - 00002764 _____ () C:\Users\Retia Bell\Desktop\phone numbers.txt
2014-01-21 18:16 - 2014-01-21 18:16 - 00017628 _____ () C:\Users\Retia Bell\Desktop\2ndexport_20140121061551.xls
2014-01-21 17:49 - 2014-01-21 17:49 - 00017628 _____ () C:\Users\Retia Bell\Desktop\export_20140121054906.xls
2014-01-20 12:21 - 2013-04-18 08:39 - 00000000 ____D () C:\Users\taye leah
2014-01-20 12:20 - 2014-01-20 12:20 - 00000000 ____D () C:\Users\Retia Bell\Desktop\taye leah
2014-01-20 12:17 - 2014-01-20 12:17 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\com.comcast.callerid
2014-01-20 12:17 - 2011-06-06 07:24 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D () C:\Program Files\iTunes
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D () C:\Program Files\iPod
2014-01-19 13:07 - 2014-01-19 13:05 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-01-19 13:07 - 2011-06-12 20:21 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-01-19 03:05 - 2011-10-29 15:23 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Mozilla
2014-01-19 01:32 - 2011-06-05 19:52 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-18 20:30 - 2014-01-18 20:30 - 00000729 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer3.htm
2014-01-18 20:30 - 2014-01-18 20:30 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer3_files
2014-01-18 20:22 - 2014-01-18 20:22 - 00000729 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer1.htm
2014-01-18 20:22 - 2014-01-18 20:22 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer1_files
2014-01-18 20:21 - 2014-01-18 20:21 - 00000727 _____ () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer.htm
2014-01-18 20:21 - 2014-01-18 20:21 - 00000000 ____D () C:\Users\Retia Bell\Desktop\Blue Access for Members - EOB Viewer_files
2014-01-16 07:20 - 2009-07-13 22:33 - 00445712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-16 06:04 - 2013-07-11 05:04 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-16 06:01 - 2011-06-05 21:35 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 03:08 - 2013-12-23 21:49 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-14 19:10 - 2014-01-14 19:10 - 01859304 _____ (Coupons.com Incorporated) C:\Users\Retia Bell\Desktop\CouponPrinter.exe
2014-01-14 19:10 - 2014-01-14 19:10 - 00000000 ____D () C:\Program Files\Coupons
2014-01-13 20:25 - 2014-01-13 20:25 - 00000000 ____D () C:\Users\Retia Bell\AppData\Roaming\Oracle

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-2952845082-3999916913-1929034053-1005\$310facd60adf5f5a5731a6a15007c916

Files to move or delete:
====================
C:\Users\Retia Bell\cnmss Canon MP495 series Printer (Local).dll


Some content of TEMP:
====================
C:\Users\Retia Bell\AppData\Local\temp\200939.exe
C:\Users\Retia Bell\AppData\Local\temp\783.4258770431928_Update.exe
C:\Users\Retia Bell\AppData\Local\temp\APNSetup.exe
C:\Users\Retia Bell\AppData\Local\temp\IntResource.dll
C:\Users\Retia Bell\AppData\Local\temp\Looksafe_WRP.exe
C:\Users\Retia Bell\AppData\Local\temp\pcDesktopAlertNotifierX.dll
C:\Users\Retia Bell\AppData\Local\temp\Quarantine.exe
C:\Users\Retia Bell\AppData\Local\temp\resetDns.exe
C:\Users\Retia Bell\AppData\Local\temp\singleSaveDailyDealsUpdater.exe
C:\Users\Retia Bell\AppData\Local\temp\SkypeSetup.exe
C:\Users\Retia Bell\AppData\Local\temp\sqlite-3.7.2-sqlitejdbc.dll
C:\Users\Retia Bell\AppData\Local\temp\tmp3183.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-08 00:55

==================== End Of Log ============================Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by Retia Bell at 2014-02-12 23:52:07
Running from C:\Users\Retia Bell\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG Internet Security 2014 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2014 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
FW: AVG Internet Security 2014 (Disabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

Adobe AIR (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (Version: 11.6.1.629 - Adobe Systems, Inc.)
Apple Application Support (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
AVG 2014 (Version: 14.0.3629 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4158 - AVG Technologies) Hidden
AVG 2014 (Version: 2014.0.4158 - AVG Technologies)
AVG SafeGuard toolbar (Version: 17.2.0.38 - AVG Technologies)
BlackBerry App World Browser Plugin (Version: 3.0.0.17 - Research In Motion Limited)
BlackBerry Backup Extractor (Version: 0.78.0.0 - Reincubate Ltd)
BlackBerry Desktop Software 6.1 (Version: 6.1.0.35 - Research In Motion Ltd.)
BlackBerry Desktop Software 6.1 (Version: 6.1.0.35 - Research In Motion Ltd.) Hidden
BlackBerry Device Software Updater (Version: 6.0.1.37 - Research In Motion Ltd)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
CameraHelperMsi (Version: 13.31.1038.0 - Logitech) Hidden
Canon Easy-PhotoPrint EX (Version:  - )
Canon Easy-WebPrint EX (Version:  - )
Canon IJ Network Tool (Version:  - )
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (Version:  - )
Canon MP Navigator EX 4.0 (Version:  - )
Canon MP495 series MP Drivers (Version:  - )
Canon MP495 series User Registration (Version:  - )
Canon My Printer (Version:  - )
Canon Solution Menu EX (Version:  - )
CompTIA A+ 220-801 Essentials SE (Version: 1.0.0 - LearnForce Partners LLC)
CompTIA A+ 220-801 Essentials SE (Version: 1.0.0 - LearnForce Partners LLC) Hidden
CompTIA A+ 220-802 Practical Application SE (Version: 1.0.0 - LearnForce Partners LLC)
CompTIA A+ 220-802 Practical Application SE (Version: 1.0.0 - LearnForce Partners LLC) Hidden
Coupon Printer for Windows (Version: 5.0.0.4 - Coupons.com Incorporated) <==== ATTENTION
CramMaster 10 (Version: 1.0 - ALS)
CramMaster 10 (Version: 1.0 - ALS) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (Version:  - Microsoft)
Dynex Gigabit PCI Adapter Driver (Version: 1.00.0011 - Dynex)
EasySolve (Version:  - )
Elevated Installer (Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Facebook Video Calling 2.0.0.447 (Version: 2.0.447 - Skype Limited)
Firebird SQL Server - MAGIX Edition (Version: 2.1.27.0 - MAGIX AG)
Garmin City Navigator North America NT 2014.30 Update (Version: 17.30.0.0 - Garmin Ltd or its subsidiaries)
Garmin Communicator Plugin (Version: 4.0.1 - Garmin Ltd or its subsidiaries)
Garmin Express (Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (Version: 2.3.14.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin USB Drivers (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Chrome (Version: 32.0.1700.76 - Google Inc.)
Google Earth (Version: 7.1.2.2041 - Google)
Google Talk Plugin (Version: 5.1.2.17113 - Google)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (Version: 7.5.4601.54 - Google Inc.)
Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden
iCloud (Version: 3.1.0.40 - Apple Inc.)
Image Converter (Version: 1.0.0 - Image Converter)
Image Editor Packages (HKCU Version:  - ) <==== ATTENTION
Internet TV for Windows Media Center (Version: 4.2.2.0 - Microsoft Corporation)
iTunes (Version: 11.1.1.11 - Apple Inc.)
Junk Mail filter update (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Keeper Password & Data Vault (Version: 5.0.5 - Keeper Security, Inc.)
Logitech Vid HD (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (Version: 2.31 - Logitech Inc.)
LWS Facebook (Version: 13.31.1038.0 - Logitech) Hidden
LWS Gallery (Version: 13.31.1038.0 - Logitech) Hidden
LWS Help_main (Version: 13.31.1044.0 - Logitech) Hidden
LWS Launcher (Version: 13.31.1038.0 - Logitech) Hidden
LWS Motion Detection (Version: 13.30.1395.0 - Logitech) Hidden
LWS Pictures And Video (Version: 13.31.1038.0 - Logitech) Hidden
LWS Twitter (Version: 13.30.1346.0 - Logitech) Hidden
LWS Video Mask Maker (Version: 13.30.1379.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
LWS Webcam Software (Version: 13.31.1038.0 - Logitech) Hidden
LWS WLM Plugin (Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (Version: 13.31.1038.0 - Logitech) Hidden
MAGIX Photo Manager 9 (Version: 7.0.3.119 - MAGIX AG)
MAGIX Screenshare (Version: 4.3.6.1987 - MAGIX AG)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Memeo AutoSync (Version:  - Memeo Inc.)
Memeo Instant Backup (Version: 4.60.0.7955 - Memeo Inc.)
Memeo Share (Version: 3.0.0.3265 - Memeo Inc.)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook Connector (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook Social Connector Provider for Facebook 32-bit (Version: 14.0.6114.5003 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40820 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40825 - Microsoft Corporation) Hidden
Movie Maker (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 en-US) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
MTRS 2.0 1.0 (Version: 1.0 - )
NOOK for PC (Version: 2.5.6.9575 - Barnesandnoble.com)
OpenOffice 4.0.0 (Version: 4.00.9702 - Apache Software Foundation)
Password Recovery Tools 2012 (Version: 2.0.0.1 - Spowersoft)
Password Recovery Tools 2012 Trial (Version: 2.0.0.1 - Spowersoft)
Photo Gallery (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
QuickTime (Version: 7.74.80.86 - Apple Inc.)
Seagate Dashboard (Version: 1.1.0.1554 - Memeo Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden
Skype Click to Call (Version: 6.13.13771 - Skype Technologies S.A.)
Skype4COM Event Handler Example (HKCU Version: 1.0.31.12 - TheUberOverLord Creations)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
SolSuite 2012 v12.9 (Version: 12.9 - TreeCardGames)
Sony RAW Driver (Version: 2.0.00.08130 - Sony Corporation)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TurboTax 2009 (Version:  - Intuit, Inc)
TurboTax 2009 WinPerFedFormset (Version: 009.000.2881 - Intuit Inc.) Hidden
TurboTax 2009 WinPerReleaseEngine (Version: 009.000.0328 - Intuit Inc.) Hidden
TurboTax 2009 WinPerTaxSupport (Version: 009.000.0245 - Intuit Inc.) Hidden
TurboTax 2009 wrapper (Version: 009.000.0145 - Intuit Inc.) Hidden
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (Version:  - Microsoft)
Visual Studio 2012 x86 Redistributables (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 0.9.9 (Version: 0.9.9 - VideoLAN Team)
Walgreens PictureMover (Version: 3.5.0.27 - Hewlett-Packard Company)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Live Communications Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Media Center Add-in for Flash (Version: 4.1.2.0 - Microsoft Corporation)
XFINITY Caller ID (Version: 3.1.38 - Comcast Cable Communications Management LLC)
XFINITY Caller ID (Version: 3.1.38 - Comcast Cable Communications Management LLC) Hidden
XFINITY Connect for Outlook (HKCU Version: 1.1.1.1 - National Security Operations)
Zip Extractor Packages (HKCU Version:  - ) <==== ATTENTION

==================== Restore Points  =========================

24-01-2014 06:00:05 Scheduled Checkpoint
28-01-2014 23:29:11 Installed Firebird SQL Server - MAGIX Edition
05-02-2014 07:48:47 Scheduled Checkpoint
08-02-2014 18:25:56 Installed PowerLine Utility
08-02-2014 23:24:29 Windows Update
12-02-2014 03:58:01 Windows Update
13-02-2014 01:19:01 Removed Java 7 Update 45

==================== Hosts content: ==========================

2009-07-13 20:04 - 2012-08-29 04:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {60B94C57-731C-4D53-8708-E3EB1AD7A1AD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)
Task: {6A2A6A6C-407B-43CF-8D03-212A629E6081} - System32\Tasks\{FA19E3C3-C4C7-4DC2-8368-1B9BD611C6FA} => Iexplore.exe http://ui.skype.com/ui/0/6.0.0.126/en/abandoninstall?page=tsProgressBar
Task: {779CC83D-38DA-48CA-AAB7-3E23364E0463} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core => C:\Users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-12] (Facebook Inc.)
Task: {78822BD5-9E0B-4D78-AC60-E58A2FE02925} - System32\Tasks\Digital Sites => C:\Users\RETIAB~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7E1F19ED-7929-4F7E-8154-C2CAC58C4E55} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-10] (Adobe Systems Incorporated)
Task: {86DB22AE-5EEB-4483-8C1E-7F18E066312A} - System32\Tasks\{190E47E1-57BB-4FBF-9CD8-AA58172DFD89} => Iexplore.exe http://ui.skype.com/ui/0/6.0.0.126/en/abandoninstall?page=tsProgressBar
Task: {9DDC0C0F-6466-49F9-A8E8-0E09CED6E5AE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core => C:\Users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-04] (Google Inc.)
Task: {AB87D24B-9722-4B19-9DDE-B502FF5567C9} - System32\Tasks\IHUninstallTrackingTASK => CMD
Task: {BE5148A8-E31D-48CA-8D0F-9F45C1C7CF1A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA => C:\Users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-04] (Google Inc.)
Task: {BFF57F60-7E4D-4846-B804-B909063198B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CC73834D-D505-4CD5-8C65-86D402413B9F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA => C:\Users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-12] (Facebook Inc.)
Task: {CD2971F3-ED09-4EAB-B7CC-06DD8CEACBD9} - System32\Tasks\{8D457020-C3A0-46B3-B2A0-91ABF00EA7C4} => Iexplore.exe http://ui.skype.com/ui/0/6.0.0.126/en/abandoninstall?page=tsProgressBar
Task: {CEB4A5E3-7386-43AB-806B-6E9FDDC5DD9E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\RETIAB~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job => C:\Users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job => C:\Users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job => C:\Users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job => C:\Users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-11-16 16:02 - 2013-12-22 07:23 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-02-05 00:00 - 2014-02-05 00:00 - 16287624 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:0B4227B4
AlternateDataStreams: C:\Users\Retia Bell\Desktop\attachment.eml:OECustomProperty
AlternateDataStreams: C:\Users\Retia Bell\Documents\attachment.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\57041051.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\72147163.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\57041051.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\72147163.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: APNMCP => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: avgfws => 2
MSCONFIG\Services: AVGIDSAgent => 2
MSCONFIG\Services: avgwd => 2
MSCONFIG\Services: AxInstSV => 3
MSCONFIG\Services: BDESVC => 3
MSCONFIG\Services: BFE => 2
MSCONFIG\Services: BITS => 2
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: Browser => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: defragsvc => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: FTSvc => 2
MSCONFIG\Services: IJPLMSVC => 3
MSCONFIG\Services: IntuitUpdateService => 2
MSCONFIG\Services: MpsSvc => 2
MSCONFIG\Services: RasMan => 3
MSCONFIG\Services: Wecsvc => 3
MSCONFIG\Services: WerSvc => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Walgreens PictureMover.lnk => C:\Windows\pss\Walgreens PictureMover.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Caller ID.lnk => C:\Windows\pss\Caller ID.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon MP495 series Printer.lnk => C:\Windows\pss\Canon IJ Status Monitor Canon MP495 series Printer.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CNET TechTracker.lnk => C:\Windows\pss\CNET TechTracker.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk => C:\Windows\pss\Logitech . Product Registration.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^NexGen Media Player.lnk => C:\Windows\pss\NexGen Media Player.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: AVG-Secure-Search-Update_0913a => C:\Users\Retia Bell\AppData\Roaming\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid 529348efeae447d19d6cf18676b2cdf2-7160306b406bff5e0d200f36e48670b031b59525 --CMPID 0913a
MSCONFIG\startupreg: AVG_UI => "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: Comcast_McciTrayApp => "C:\Program Files\Comcast\pcTrayApp.exe"
MSCONFIG\startupreg: Evaer => "C:\Program Files\Evaer\evaer.exe"
MSCONFIG\startupreg: Facebook Update => "C:\Users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: Garmin Lifetime Updater => C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized
MSCONFIG\startupreg: GarminExpressTrayApp => "C:\Program Files\Garmin\Express Tray\ExpressTray.exe"
MSCONFIG\startupreg: Google Update => "C:\Users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Logitech Vid => "C:\Program Files\Logitech\Vid HD\Vid.exe" -bootmode
MSCONFIG\startupreg: LWS => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: Memeo AutoSync => C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent
MSCONFIG\startupreg: Memeo Instant Backup => C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Rim.DesktopHelper.exe => C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.DesktopHelper.exe
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: Seagate Dashboard => C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: vProt => "C:\Program Files\AVG SafeGuard toolbar\vprot.exe"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/12/2014 09:28:16 PM) (Source: Wininit) (User: )
Description: A critical system process, C:\Windows\system32\lsm.exe, failed with status code 1.  The machine must now be restarted.

Error: (02/12/2014 00:57:22 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/11/2014 00:34:33 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/11/2014 00:30:13 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/10/2014 11:20:17 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/10/2014 11:17:09 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/09/2014 03:08:59 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/09/2014 03:00:07 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Dependent Assembly Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/08/2014 04:54:09 PM) (Source: Google Update) (User: RetiaBell-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (02/08/2014 00:03:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 18050


System errors:
=============
Error: (02/12/2014 11:42:53 PM) (Source: Service Control Manager) (User: )
Description: The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error:
%%1075

Error: (02/12/2014 11:42:53 PM) (Source: Service Control Manager) (User: )
Description: The vToolbarUpdater17.2.0 service failed to start due to the following error:
%%2

Error: (02/12/2014 11:42:52 PM) (Source: Service Control Manager) (User: )
Description: The MemeoBackgroundService service failed to start due to the following error:
%%1053

Error: (02/12/2014 11:42:52 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MemeoBackgroundService service to connect.

Error: (02/12/2014 11:42:21 PM) (Source: Service Control Manager) (User: )
Description: The Garmin Core Update Service service failed to start due to the following error:
%%1053

Error: (02/12/2014 11:42:21 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Garmin Core Update Service service to connect.

Error: (02/12/2014 11:41:51 PM) (Source: Service Control Manager) (User: )
Description: The AVG WatchDog service failed to start due to the following error:
%%2

Error: (02/12/2014 11:41:51 PM) (Source: Service Control Manager) (User: )
Description: The AVGIDSDriver service depends the following service: AVGIDSFilter. This service might not be installed.

Error: (02/12/2014 11:41:33 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 11:39:39 PM on ‎2/‎12/‎2014 was unexpected.

Error: (02/12/2014 11:24:53 PM) (Source: Service Control Manager) (User: )
Description: The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error:
%%1075


Microsoft Office Sessions:
=========================
Error: (02/12/2014 09:28:16 PM) (Source: Wininit)(User: )
Description: C:\Windows\system32\lsm.exe1

Error: (02/12/2014 00:57:22 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Common Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe

Error: (02/11/2014 00:34:33 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (02/11/2014 00:30:13 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Common Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe

Error: (02/10/2014 11:20:17 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (02/10/2014 11:17:09 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Common Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe

Error: (02/09/2014 03:08:59 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (02/09/2014 03:00:07 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Common Files\Research In Motion\AppLoader\MailServerMAPIProxy64.exe

Error: (02/08/2014 04:54:09 PM) (Source: Google Update)(User: RetiaBell-PC)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Url=https://www.facebook.com/omaha/update.php
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=FireFox, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=auto, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned

Error: (02/08/2014 00:03:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 18050


CodeIntegrity Errors:
===================================
  Date: 2012-08-29 05:37:55.670
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-29 05:32:25.299
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-29 05:27:26.467
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-29 04:31:12.970
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-29 04:22:24.921
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-28 22:02:29.756
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-28 21:59:18.431
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-28 21:42:24.724
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-28 21:28:02.816
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2012-08-28 21:23:29.188
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Percentage of memory in use: 53%
Total physical RAM: 1791.18 MB
Available physical RAM: 839.27 MB
Total Pagefile: 3582.35 MB
Available Pagefile: 2039.08 MB
Total Virtual: 2047.88 MB
Available Virtual: 1892.61 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:148.91 GB) (Free:53.31 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: D0F4738C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================



#4 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 13 February 2014 - 01:06 AM

Gringo..my computer shut down as soon as I posted the log and before I could mention that i had already tried some removal tools. sorry. My harddrive is processing (running) all the time then it just shuts down. UGH!



#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:24 AM

Posted 13 February 2014 - 01:10 AM



Hello computerunderattack

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#6 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 13 February 2014 - 01:51 AM

My computer keeps  shutting down...harddrive is still running (processing) you can hear it...then it shuts  down. CPU useage is still high between 33 & 50%.

The AdwCleaner is the tool i ran before I received your instructions.

 

 

# AdwCleaner v3.018 - Report created 12/02/2014 at 23:04:24
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Retia Bell - RETIABELL-PC
# Running from : C:\Users\Retia Bell\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Crawler Toolbar
Folder Deleted : C:\Program Files\DomaIQ Uninstaller
Folder Deleted : C:\Program Files\FirstRowSportApp.com
Folder Deleted : C:\Program Files\iMesh Applications
Folder Deleted : C:\Program Files\optimizer pro
Folder Deleted : C:\Program Files\SDIV 2.0
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Retia Bell\AppData\Local\OpenCandy
Folder Deleted : C:\Users\Retia Bell\AppData\Local\PackageAware
Folder Deleted : C:\Users\Retia Bell\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\RETIAB~1\AppData\Local\Temp\apn
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\searchquband
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\eType
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\strongvault
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstRowSportApp.com
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\invalidprefs.js
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\ask-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Babylon.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\my-web-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\user.js
File Deleted : C:\Program Files\Mozilla Firefox\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [lesstabs@lesstabs.com]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\58538b88e76ee810
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3294791
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67C71B35-A416-4A54-BD1D-15965A4FE41C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6F43FA77-C18F-4D0C-9C7E-958876FE2061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DF948646-8BF4-450E-A059-CF8A4E0FE2BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E96B49B0-E11F-48FC-984A-EEC29A4F57E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKCU\Software\BabSolution
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\DynConIE
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\AppDataLow\Software\smartbar
Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\Funmoods
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Uniblue\DriverScanner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\prefs.js ]

Line Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1367643732128,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CT3294791_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1369605492359,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=13");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&SearchSource=2&CUI=UN36538794191603119&UM=2&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3294791");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Line Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Line Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&ind=2013052617&p2=^XP^xdm588^YY^us&si=[...]
Line Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&p2=^XP^xdm588^YY^us&si=9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.lastGuardTime", -454898570);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.numGuards", 1);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2013052617");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm588^YY^us");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "1E760E30-4C92-401D-989E-40C2777DD2BE");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1369629606475");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "nba playoffs schedule||basketball heat vs pacers");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "77001");
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("show.CT3294791", false);
Line Deleted : user_pref("smartbar.machineId", "JNRUKHFGSQU0NJ5HGGKPIKHIXPBQO/O2KCXBHJVR2RHXBCAJD/EHVSY8E2MCSCVV0OTUGDCFWFUGOHNX8KVTHG");

-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20583 octets] - [12/02/2014 23:02:28]
AdwCleaner[S0].txt - [21049 octets] - [12/02/2014 23:04:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21110 octets] ##########
# AdwCleaner v3.018 - Report created 12/02/2014 at 23:04:24
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Retia Bell - RETIABELL-PC
# Running from : C:\Users\Retia Bell\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Crawler Toolbar
Folder Deleted : C:\Program Files\DomaIQ Uninstaller
Folder Deleted : C:\Program Files\FirstRowSportApp.com
Folder Deleted : C:\Program Files\iMesh Applications
Folder Deleted : C:\Program Files\optimizer pro
Folder Deleted : C:\Program Files\SDIV 2.0
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Retia Bell\AppData\Local\OpenCandy
Folder Deleted : C:\Users\Retia Bell\AppData\Local\PackageAware
Folder Deleted : C:\Users\Retia Bell\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\RETIAB~1\AppData\Local\Temp\apn
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\searchquband
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\eType
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\strongvault
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstRowSportApp.com
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\invalidprefs.js
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\ask-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Babylon.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\my-web-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\user.js
File Deleted : C:\Program Files\Mozilla Firefox\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [lesstabs@lesstabs.com]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\58538b88e76ee810
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3294791
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67C71B35-A416-4A54-BD1D-15965A4FE41C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6F43FA77-C18F-4D0C-9C7E-958876FE2061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DF948646-8BF4-450E-A059-CF8A4E0FE2BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E96B49B0-E11F-48FC-984A-EEC29A4F57E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKCU\Software\BabSolution
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\DynConIE
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\AppDataLow\Software\smartbar
Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\Funmoods
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Uniblue\DriverScanner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\prefs.js ]

Line Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1367643732128,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CT3294791_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1369605492359,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=13");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&SearchSource=2&CUI=UN36538794191603119&UM=2&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3294791");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Line Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Line Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&ind=2013052617&p2=^XP^xdm588^YY^us&si=[...]
Line Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&p2=^XP^xdm588^YY^us&si=9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.lastGuardTime", -454898570);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.numGuards", 1);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2013052617");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm588^YY^us");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "1E760E30-4C92-401D-989E-40C2777DD2BE");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1369629606475");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "nba playoffs schedule||basketball heat vs pacers");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "77001");
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("show.CT3294791", false);
Line Deleted : user_pref("smartbar.machineId", "JNRUKHFGSQU0NJ5HGGKPIKHIXPBQO/O2KCXBHJVR2RHXBCAJD/EHVSY8E2MCSCVV0OTUGDCFWFUGOHNX8KVTHG");

-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20583 octets] - [12/02/2014 23:02:28]
AdwCleaner[S0].txt - [21049 octets] - [12/02/2014 23:04:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21110 octets] ##########

# AdwCleaner v3.018 - Report created 12/02/2014 at 23:04:24
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Retia Bell - RETIABELL-PC
# Running from : C:\Users\Retia Bell\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Crawler Toolbar
Folder Deleted : C:\Program Files\DomaIQ Uninstaller
Folder Deleted : C:\Program Files\FirstRowSportApp.com
Folder Deleted : C:\Program Files\iMesh Applications
Folder Deleted : C:\Program Files\optimizer pro
Folder Deleted : C:\Program Files\SDIV 2.0
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Retia Bell\AppData\Local\OpenCandy
Folder Deleted : C:\Users\Retia Bell\AppData\Local\PackageAware
Folder Deleted : C:\Users\Retia Bell\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\RETIAB~1\AppData\Local\Temp\apn
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\searchquband
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\eType
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\strongvault
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstRowSportApp.com
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\invalidprefs.js
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\ask-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Babylon.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\my-web-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\user.js
File Deleted : C:\Program Files\Mozilla Firefox\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [lesstabs@lesstabs.com]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\58538b88e76ee810
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3294791
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67C71B35-A416-4A54-BD1D-15965A4FE41C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6F43FA77-C18F-4D0C-9C7E-958876FE2061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DF948646-8BF4-450E-A059-CF8A4E0FE2BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E96B49B0-E11F-48FC-984A-EEC29A4F57E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKCU\Software\BabSolution
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\DynConIE
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\AppDataLow\Software\smartbar
Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\Funmoods
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Uniblue\DriverScanner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\prefs.js ]

Line Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1367643732128,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CT3294791_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1369605492359,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=13");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&SearchSource=2&CUI=UN36538794191603119&UM=2&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3294791");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Line Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Line Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&ind=2013052617&p2=^XP^xdm588^YY^us&si=[...]
Line Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&p2=^XP^xdm588^YY^us&si=9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.lastGuardTime", -454898570);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.numGuards", 1);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2013052617");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm588^YY^us");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "1E760E30-4C92-401D-989E-40C2777DD2BE");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1369629606475");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "nba playoffs schedule||basketball heat vs pacers");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "77001");
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("show.CT3294791", false);
Line Deleted : user_pref("smartbar.machineId", "JNRUKHFGSQU0NJ5HGGKPIKHIXPBQO/O2KCXBHJVR2RHXBCAJD/EHVSY8E2MCSCVV0OTUGDCFWFUGOHNX8KVTHG");

-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20583 octets] - [12/02/2014 23:02:28]
AdwCleaner[S0].txt - [21049 octets] - [12/02/2014 23:04:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21110 octets] ##########
# AdwCleaner v3.018 - Report created 12/02/2014 at 23:04:24
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Retia Bell - RETIABELL-PC
# Running from : C:\Users\Retia Bell\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\WeCareReminder
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Crawler Toolbar
Folder Deleted : C:\Program Files\DomaIQ Uninstaller
Folder Deleted : C:\Program Files\FirstRowSportApp.com
Folder Deleted : C:\Program Files\iMesh Applications
Folder Deleted : C:\Program Files\optimizer pro
Folder Deleted : C:\Program Files\SDIV 2.0
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Retia Bell\AppData\Local\OpenCandy
Folder Deleted : C:\Users\Retia Bell\AppData\Local\PackageAware
Folder Deleted : C:\Users\Retia Bell\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\RETIAB~1\AppData\Local\Temp\apn
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Retia Bell\AppData\LocalLow\searchquband
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Bandoo
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\eType
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\strongvault
Folder Deleted : C:\Users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FirstRowSportApp.com
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Folder Deleted : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\invalidprefs.js
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\ask-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Babylon.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\searchplugins\my-web-search.xml
File Deleted : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\user.js
File Deleted : C:\Program Files\Mozilla Firefox\user.js

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [lesstabs@lesstabs.com]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kkfggacklibaabdomphfdpcodjgihgon
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pollkeobaahnbmpcgombjfibedabcddd
Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\58538b88e76ee810
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3294791
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67C71B35-A416-4A54-BD1D-15965A4FE41C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6F43FA77-C18F-4D0C-9C7E-958876FE2061}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DF948646-8BF4-450E-A059-CF8A4E0FE2BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E96B49B0-E11F-48FC-984A-EEC29A4F57E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : HKCU\Software\BabSolution
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\dsiteproducts
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\DynConIE
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Deleted : HKCU\Software\AppDataLow\Software\smartbar
Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Bandoo
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\Funmoods
Key Deleted : HKLM\Software\InfoAtoms
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Uniblue\DriverScanner

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\prefs.js ]

Line Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1367643732128,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("CT3294791_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1369605492359,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=13");
Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&SearchSource=2&CUI=UN36538794191603119&UM=2&q=");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3294791");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "Vafmusic2 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3294791&CUI=UN36538794191603119&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Line Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Line Deleted : user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&ind=2013052617&p2=^XP^xdm588^YY^us&si=[...]
Line Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=1E760E30-4C92-401D-989E-40C2777DD2BE&n=77fcbec9&p2=^XP^xdm588^YY^us&si=9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.lastGuardTime", -454898570);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.hp.numGuards", 1);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.initialized", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.contextKey", "");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.installDate", "2013052617");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerId", "^XP^xdm588^YY^us");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.partnerSubId", "9153");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.success", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.installation.toolbarId", "1E760E30-4C92-401D-989E-40C2777DD2BE");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.lastActivePing", "1369629606475");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.defaultSearch", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.homePageEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.keywordEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.options.tabEnabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.searchHistory", "nba playoffs schedule||basketball heat vs pacers");
Line Deleted : user_pref("extensions.toolbar.mindspark._64Members_.weather.location", "77001");
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
Line Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "televisionfanatic@mindspark.com");
Line Deleted : user_pref("show.CT3294791", false);
Line Deleted : user_pref("smartbar.machineId", "JNRUKHFGSQU0NJ5HGGKPIKHIXPBQO/O2KCXBHJVR2RHXBCAJD/EHVSY8E2MCSCVV0OTUGDCFWFUGOHNX8KVTHG");

-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\Retia Bell\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20583 octets] - [12/02/2014 23:02:28]
AdwCleaner[S0].txt - [21049 octets] - [12/02/2014 23:04:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21110 octets] ##########


 



#7 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 13 February 2014 - 02:01 AM

My computer shutdown before I could post the JRT log....UGH!!

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Professional x86
Ran by Retia Bell on Thu 02/13/2014 at  0:21:43.49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\etypesetup_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\etypesetup_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\domaiq uninstaller
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211621176}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deal Spy_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Deal Spy_RASMANCS



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\fighters"
Successfully deleted: [Folder] "C:\Users\Retia Bell\appdata\local\cre"
Successfully deleted: [Folder] "C:\Users\Retia Bell\appdata\locallow\datamngr"
Successfully deleted: [Folder] "C:\Users\Retia Bell\appdata\locallow\nch_en"
Successfully deleted: [Folder] "C:\Program Files\coupons"
Successfully deleted: [Folder] "C:\Program Files\wi3c8a~1"
Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"
Successfully deleted: [Folder] "C:\ai_recyclebin"



~~~ FireFox

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\fbdownloader@kmcore
Emptied folder: C:\Users\Retia Bell\AppData\Roaming\mozilla\firefox\profiles\ctbufvca.default\minidumps [164 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 02/13/2014 at  0:25:27.08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#8 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 14 February 2014 - 12:33 AM

Gringo...thank you I think you made some progress. I have been home since 6pm and my computer has not shut down at all! I am still getting those little pop up ads. and underlined words.



#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:24 AM

Posted 14 February 2014 - 10:41 AM


Hello computerunderattack

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 14 February 2014 - 08:50 PM

Gringo I spoke to soon, computer shutdown last night and right after log was generated also still getting pop up ads...this is very frustrating.

 

 

ComboFix 14-02-14.01 - Retia Bell 02/14/2014  18:18:09.2.3 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.1791.740 [GMT -6:00]
Running from: c:\users\Retia Bell\Desktop\ComboFix.exe
AV: AVG Internet Security 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
FW: AVG Internet Security 2014 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
SP: AVG Internet Security 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\WinPCap
c:\program files\WinPCap\install.log
c:\programdata\ZeoBIT
c:\programdata\ZeoBIT\PCKeeper\installer0.exe0.llog
c:\programdata\ZeoBIT\PCKeeper\PCKeeper Installer.exe0.llog
c:\users\Retia Bell\AppData\Local\assembly\tmp
c:\users\Retia Bell\AppData\Roaming\Evaer
c:\users\Retia Bell\AppData\Roaming\Evaer\record.xml
c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Recent\Thumbs.db
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_pcCMService
.
.
(((((((((((((((((((((((((   Files Created from 2014-01-15 to 2014-02-15  )))))))))))))))))))))))))))))))
.
.
2014-02-15 00:30 . 2014-02-15 00:30    --------    d-----w-    c:\users\Public\AppData\Local\temp
2014-02-15 00:30 . 2014-02-15 00:30    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-02-14 06:24 . 2014-02-14 23:44    62576    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{082C2AFD-9A29-4DB1-B4FB-232C751DB1F3}\offreg.dll
2014-02-14 05:55 . 2013-12-04 00:57    7760024    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{082C2AFD-9A29-4DB1-B4FB-232C751DB1F3}\mpengine.dll
2014-02-14 00:44 . 2013-12-04 00:57    7760024    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-13 12:49 . 2013-12-21 08:56    454656    ----a-w-    c:\windows\system32\vbscript.dll
2014-02-13 06:13 . 2014-02-13 06:13    --------    d-----w-    c:\windows\ERUNT
2014-02-13 05:49 . 2014-02-13 05:52    --------    d-----w-    C:\FRST
2014-02-13 05:02 . 2014-02-13 05:22    --------    d-----w-    C:\AdwCleaner
2014-02-13 04:58 . 2013-12-06 02:02    1237504    ----a-w-    c:\windows\system32\msxml3.dll
2014-02-13 04:58 . 2013-12-06 02:02    2048    ----a-w-    c:\windows\system32\msxml3r.dll
2014-02-13 04:57 . 2013-12-24 23:09    1987584    ----a-w-    c:\windows\system32\d3d10warp.dll
2014-02-13 04:57 . 2013-11-26 08:16    3419136    ----a-w-    c:\windows\system32\d2d1.dll
2014-02-13 04:57 . 2013-12-04 01:54    594944    ----a-w-    c:\windows\system32\RMActivate_isv.exe
2014-02-13 04:57 . 2013-12-04 01:54    572416    ----a-w-    c:\windows\system32\RMActivate.exe
2014-02-13 04:57 . 2013-12-04 02:03    423936    ----a-w-    c:\windows\system32\secproc_isv.dll
2014-02-13 04:57 . 2013-12-04 02:03    428032    ----a-w-    c:\windows\system32\secproc.dll
2014-02-13 04:57 . 2013-12-04 01:54    510976    ----a-w-    c:\windows\system32\RMActivate_ssp.exe
2014-02-13 04:57 . 2013-12-04 01:54    508928    ----a-w-    c:\windows\system32\RMActivate_ssp_isv.exe
2014-02-13 04:57 . 2013-12-04 02:03    87040    ----a-w-    c:\windows\system32\secproc_ssp_isv.dll
2014-02-13 04:57 . 2013-12-04 02:03    87040    ----a-w-    c:\windows\system32\secproc_ssp.dll
2014-02-13 04:57 . 2013-12-04 02:02    390144    ----a-w-    c:\windows\system32\msdrm.dll
2014-02-11 16:05 . 2013-10-28 05:41    719224    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-02-11 16:05 . 2013-10-28 05:41    719224    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DBB17E5F-EDB3-44F6-A8FD-CCA1B83E92B2}\gapaengine.dll
2014-02-08 23:40 . 2014-02-08 23:40    --------    d--h--w-    c:\windows\msdownld.tmp
2014-02-08 23:21 . 2014-02-08 23:22    --------    d-----w-    c:\program files\Microsoft Security Client
2014-02-05 06:03 . 2014-02-08 23:19    --------    d-----w-    c:\users\Retia Bell\AppData\Roaming\DigitalSites
2014-02-05 06:03 . 2014-02-05 06:03    --------    d-----w-    c:\program files\Image Converter
2014-01-28 23:31 . 2014-01-28 23:31    --------    d-----w-    c:\users\Retia Bell\AppData\Local\MAGIX
2014-01-28 23:28 . 2009-04-03 00:28    65536    ----a-w-    c:\windows\system32\STRING32.dll
2014-01-28 23:28 . 2009-04-03 00:28    720896    ----a-w-    c:\windows\system32\DLLAV32.dll
2014-01-28 23:28 . 2009-04-03 00:28    212992    ----a-w-    c:\windows\system32\DLLDEV32.dll
2014-01-28 23:28 . 2009-04-03 00:28    90112    ----a-w-    c:\windows\system32\DLLPRF32.dll
2014-01-28 23:28 . 2009-04-03 00:28    147456    ----a-w-    c:\windows\system32\DLLCPY32.dll
2014-01-28 23:28 . 2009-04-03 00:28    77824    ----a-w-    c:\windows\system32\DLLPNT32.dll
2014-01-28 23:28 . 2009-04-03 00:28    212992    ----a-w-    c:\windows\system32\DLLDRV32.dll
2014-01-28 23:28 . 2009-04-03 00:28    94208    ----a-w-    c:\windows\system32\DLLIO32.dll
2014-01-28 23:28 . 2009-04-03 00:28    274432    ----a-w-    c:\windows\system32\DLLRES32.dll
2014-01-28 23:27 . 2014-01-28 23:47    --------    d-----w-    c:\programdata\MAGIX
2014-01-28 23:27 . 2014-01-28 23:28    --------    d-----w-    c:\program files\MAGIX
2014-01-28 23:27 . 2007-04-27 16:43    120200    ----a-w-    c:\windows\system32\DLLDEV32i.dll
2014-01-28 23:24 . 2014-01-28 23:29    --------    d-----w-    c:\program files\Common Files\MAGIX Services
2014-01-28 23:21 . 2014-01-28 23:37    --------    d-----w-    c:\users\Retia Bell\AppData\Roaming\MAGIX
2014-01-25 03:04 . 2014-01-28 23:47    --------    d-----w-    c:\programdata\Websteroids
2014-01-25 01:23 . 2014-01-28 23:48    --------    d-----w-    c:\programdata\Winferno
2014-01-25 01:18 . 2014-01-28 23:48    --------    d-----w-    c:\programdata\Yahoo!
2014-01-25 01:18 . 2014-01-25 01:18    --------    d-----w-    c:\program files\SaveDailyDeals Updater
2014-01-20 18:17 . 2014-01-20 18:17    --------    d-----w-    c:\users\Retia Bell\AppData\Roaming\com.comcast.callerid
2014-01-19 19:07 . 2014-01-19 19:07    --------    d-----w-    c:\program files\iTunes
2014-01-19 19:07 . 2014-01-19 19:07    --------    d-----w-    c:\program files\iPod
2014-01-19 19:05 . 2014-01-19 19:07    --------    d-----w-    c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-11 03:39 . 2012-04-13 21:33    692616    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2014-02-11 03:39 . 2011-06-06 13:21    71048    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-19 07:32 . 2011-06-06 01:52    231584    ------w-    c:\windows\system32\MpSigStub.exe
2014-01-16 00:12 . 2011-08-22 00:25    736952    ----a-w-    c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2014-01-16 00:12 . 2011-08-22 00:25    2876528    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2014-01-16 00:11 . 2011-08-22 00:25    42168    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2014-01-16 00:11 . 2011-09-24 12:22    539984    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2013-12-14 12:21 . 2011-08-20 20:47    2876528    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2013-12-14 12:21 . 2011-08-20 20:46    42168    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2013-12-09 12:02 . 2013-12-09 12:02    71680    ----a-w-    c:\windows\system32\RegisterIEPKEYs.exe
2013-12-09 12:02 . 2013-12-09 12:02    646144    ----a-w-    c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-09 12:02 . 2013-12-09 12:02    645120    ----a-w-    c:\windows\system32\jsIntl.dll
2013-12-09 12:02 . 2013-12-09 12:02    62464    ----a-w-    c:\windows\system32\tdc.ocx
2013-12-09 12:02 . 2013-12-09 12:02    34816    ----a-w-    c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-09 12:02 . 2013-12-09 12:02    337408    ----a-w-    c:\windows\system32\html.iec
2013-12-09 12:02 . 2013-12-09 12:02    24576    ----a-w-    c:\windows\system32\licmgr10.dll
2013-12-09 12:02 . 2013-12-09 12:02    194048    ----a-w-    c:\windows\system32\elshyph.dll
2013-12-09 12:02 . 2013-12-09 12:02    182272    ----a-w-    c:\windows\system32\msls31.dll
2013-12-09 12:02 . 2013-12-09 12:02    151552    ----a-w-    c:\windows\system32\iexpress.exe
2013-12-09 12:02 . 2013-12-09 12:02    139264    ----a-w-    c:\windows\system32\wextract.exe
2013-12-09 12:02 . 2013-12-09 12:02    13312    ----a-w-    c:\windows\system32\mshta.exe
2013-12-09 12:02 . 2013-12-09 12:02    1051136    ----a-w-    c:\windows\system32\mshtmlmedia.dll
2013-12-09 12:02 . 2013-12-09 12:02    86016    ----a-w-    c:\windows\system32\iesysprep.dll
2013-12-09 12:02 . 2013-12-09 12:02    74240    ----a-w-    c:\windows\system32\SetIEInstalledDate.exe
2013-12-09 12:02 . 2013-12-09 12:02    61952    ----a-w-    c:\windows\system32\MshtmlDac.dll
2013-12-09 12:02 . 2013-12-09 12:02    48640    ----a-w-    c:\windows\system32\mshtmler.dll
2013-12-09 12:02 . 2013-12-09 12:02    36352    ----a-w-    c:\windows\system32\imgutil.dll
2013-12-09 12:02 . 2013-12-09 12:02    111616    ----a-w-    c:\windows\system32\IEAdvpack.dll
2013-11-27 01:14 . 2014-01-15 15:50    258560    ----a-w-    c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:13 . 2014-01-15 15:50    284672    ----a-w-    c:\windows\system32\drivers\usbport.sys
2013-11-27 01:13 . 2014-01-15 15:50    76288    ----a-w-    c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:13 . 2014-01-15 15:50    43520    ----a-w-    c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:13 . 2014-01-15 15:50    20480    ----a-w-    c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:13 . 2014-01-15 15:50    24064    ----a-w-    c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:13 . 2014-01-15 15:50    6016    ----a-w-    c:\windows\system32\drivers\usbd.sys
2013-11-26 11:11 . 2014-01-15 15:50    240576    ----a-w-    c:\windows\system32\drivers\netio.sys
2013-11-26 10:10 . 2014-01-15 15:50    2349056    ----a-w-    c:\windows\system32\win32k.sys
2013-11-23 18:26 . 2013-12-11 09:37    417792    ----a-w-    c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute    REG_MULTI_SZ       autocheck autochk *\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Walgreens PictureMover.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Walgreens PictureMover.lnk
backup=c:\windows\pss\Walgreens PictureMover.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Caller ID.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Caller ID.lnk
backup=c:\windows\pss\Caller ID.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon MP495 series Printer.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Canon IJ Status Monitor Canon MP495 series Printer.lnk
backup=c:\windows\pss\Canon IJ Status Monitor Canon MP495 series Printer.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CNET TechTracker.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CNET TechTracker.lnk
backup=c:\windows\pss\CNET TechTracker.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^NexGen Media Player.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NexGen Media Player.lnk
backup=c:\windows\pss\NexGen Media Player.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Retia Bell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]
path=c:\users\Retia Bell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-11-21 16:57    959904    ----a-w-    c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-22 02:43    59720    ----a-w-    c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_UI]
2013-10-08 00:54    4908592    ----a-w-    c:\program files\AVG\AVG2014\avgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2012-11-05 20:27    89184    ----a-w-    c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 01:50    2516296    ----a-w-    c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 15:18    1185112    ----a-w-    c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comcast_McciTrayApp]
2012-12-10 22:14    1982464    ----a-w-    c:\program files\Comcast\pcTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-10-13 00:49    138096    ----atw-    c:\users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarminExpressTrayApp]
2013-09-19 14:47    1093976    ----a-w-    c:\program files\Garmin\Express Tray\ExpressTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-09-05 00:32    116648    ----atw-    c:\users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-10-01 07:23    152392    ----a-w-    c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]
2011-06-02 00:15    6123032    ----a-w-    c:\program files\Logitech\Vid HD\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 19:08    205336    ----a-w-    c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo AutoSync]
2011-05-13 00:21    144608    ----a-w-    c:\program files\Memeo\AutoSync\MemeoLauncher2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Instant Backup]
2012-10-11 23:10    137088    ----a-w-    c:\program files\Memeo\AutoBackup\MemeoLauncher2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2013-10-23 20:55    948440    ----a-w-    c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2013-05-01 08:59    421888    ----a-w-    c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rim.DesktopHelper.exe]
2011-06-07 13:06    744280    ----a-w-    c:\program files\Research In Motion\BlackBerry Desktop\Rim.DesktopHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-11-02 07:00    90448    ----a-w-    c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Seagate Dashboard]
2012-10-15 06:03    79776    ----a-w-    c:\program files\Seagate\Seagate Dashboard\MemeoLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-11-14 22:42    20584608    ----a-r-    c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]
2014-02-04 13:15    2552856    ----a-w-    c:\program files\AVG SafeGuard toolbar\vprot.exe
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R2 vToolbarUpdater17.2.0;vToolbarUpdater17.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\17.2.0\ToolbarUpdater.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 30312]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-02-06 108032]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-10-23 280288]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-06 1343400]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 avgfws;AVG Firewall;c:\program files\AVG\AVG2014\avgfws.exe [2013-09-26 1358944]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-09-02 145720]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-09-02 223032]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-09-09 27448]
S1 Avgdiskx;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiskx.sys [2013-09-26 120632]
S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2013-09-26 47928]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-09-02 176952]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-08-01 193848]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-11-12 37664]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-04-20 176128]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-09-19 250200]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\Memeo\AutoBackup\MemeoBackgroundService.exe [2012-10-11 26496]
S2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2012-10-15 14752]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-09 3275136]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 OmniTV;Cx2388x AvStream Video Capture;c:\windows\system32\DRIVERS\OmniTV.sys [2008-04-29 401280]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-15 09:02    1211672    ----a-w-    c:\program files\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 03:39]
.
2014-02-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job
- c:\users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-13 00:49]
.
2014-02-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job
- c:\users\Retia Bell\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-10-13 00:49]
.
2014-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-12-03 03:52]
.
2014-02-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-12-03 03:52]
.
2014-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000Core.job
- c:\users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-05 00:32]
.
2014-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2952845082-3999916913-1929034053-1000UA.job
- c:\users\Retia Bell\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-05 00:32]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.1.0.0/GarminAxControl_32.CAB
FF - ProfilePath - c:\users\Retia Bell\AppData\Roaming\Mozilla\Firefox\Profiles\ctbufvca.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,157,0_0,Search,20140104,20030,0,85,0
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
SafeBoot-57041051.sys
SafeBoot-72147163.sys
MSConfigStartUp-ApnTBMon - c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
MSConfigStartUp-AVG-Secure-Search-Update_0913a - c:\users\Retia Bell\AppData\Roaming\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe
MSConfigStartUp-Evaer - c:\program files\Evaer\evaer.exe
MSConfigStartUp-Garmin Lifetime Updater - c:\program files\Garmin\Lifetime Updater\GarminLifetime.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Common Files\Java\Java Update\jusched.exe
AddRemove-Coupon Printer for Windows5.0.0.4 - c:\program files\Coupons\uninstall.exe
AddRemove-MTRS 2.0 - c:\program files\SDIV 2.0\Lib\uninst.exe
AddRemove-Image Editor Packages - c:\users\Retia Bell\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z\Image Editor Packages\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{3785D0AD-BFFF-47F6-BF5B-A587C162FED9}"=hex:51,66,7a,6c,4c,1d,38,12,c3,d3,96,
   33,cd,f1,98,02,c0,4d,e6,c7,c4,3c,ba,cd
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{21347690-EC41-4F9A-8887-1F4AEE672439}"=hex:51,66,7a,6c,4c,1d,38,12,fe,75,27,
   25,73,a2,f4,0a,f7,91,5c,0a,eb,39,60,2d
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:33,9c,42,ca,90,85,cd,01
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.HTM"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.MHT"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.partial\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.PARTIAL"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.SVG"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.URL"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.website\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.WEBSITE"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="IE.AssocFile.XHT"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}]
@DACL=(02 0000)
@="Update3COMClass"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}]
@DACL=(02 0000)
@="ContentHost Control"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{08FB66B9-2D2D-4B35-A747-D5D9E9F472E2}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{0C1EB979-8EC7-46E8-8097-246957D6B94C}]
@DACL=(02 0000)
@="BbClientManager Class"
"AppID"="{4848DD90-EDA2-461F-8FE9-B47A067A5225}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{1434DD3D-0AF6-41E0-BB71-8C86010D9AF5}]
@DACL=(02 0000)
@="DeviceManager Class"
"AppID"="{3943117E-57A9-4ED1-9EAA-2566BA544BFB}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{1793FE32-120E-4D33-8BE9-19EF4AD165F6}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}]
@DACL=(02 0000)
@="FacebookUpdate.OnDemandCOMClass"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{21902B91-1E80-4282-AFDE-AB014CB4ED5A}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{220DFF67-87CE-4D26-8020-27E0B554A880}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}]
@DACL=(02 0000)
@="GoogleUpdate Update3Web"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}]
@DACL=(02 0000)
@="Google Update Legacy On Demand"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{326787D9-37B9-47A6-B539-EE13E7B04B8B}]
@DACL=(02 0000)
@="PropertiesRIMDeviceManagerStatistics Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}]
@DACL=(02 0000)
@="Google Talk ActiveX Plugin"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{3A6EE5C3-7A28-452B-832D-08FE74C7EEAD}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}]
@DACL=(02 0000)
@="WindowGroup Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{47F64EC4-1AD6-4168-9D4C-00F3842F7CFB}]
@DACL=(02 0000)
@="PropertiesDialogs Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{4A26DF46-A5AF-4D46-A60D-14AD89E57A63}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{4B66DD3F-2E6E-4F7C-B38C-E32608820825}]
@DACL=(02 0000)
@="VSPMgr Class"
"AppID"="{4848DD90-EDA2-461F-8FE9-B47A067A5225}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{515C93ED-88BD-4CCB-AE7F-9F2A1E9695A3}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}]
@DACL=(02 0000)
@="Google.OneClickProcessLauncher"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{53DBCD97-3FDF-4B60-975B-2596B57482EF}]
@DACL=(02 0000)
@="WebSLLauncher Class"
"AppID"="{6326880C-E92B-4AE2-BC06-78DF910A7F7B}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{546958A5-5C48-48BE-9396-599811623E60}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{73D320C0-FACA-4553-9D5F-070F9E4DC5C8}]
@DACL=(02 0000)
@="PropertiesRIMDeviceManagerOptions Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}]
@DACL=(02 0000)
@="SkyDriveClient Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{82D1C283-A637-4A07-B1EC-8C7AE661EAF1}]
@DACL=(02 0000)
@="PropertiesRIMDeviceManagerBBRConfig Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}]
@DACL=(02 0000)
@="RPCProxyObj Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{9793fbbf-e9db-3b01-b322-3430cbcf3cd5}]
@DACL=(02 0000)
@="O3DHostControl Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
@DACL=(02 0000)
@="SyncingOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{A1436E43-F58F-4D3B-B908-B6DA44563B00}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{A480C024-04D0-4F28-8CF0-ADACE2BD839C}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}]
@DACL=(02 0000)
@="SyncEngineCOMServer Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}]
@DACL=(02 0000)
@="Google Talk Video Renderer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{AD046C04-9CC6-4424-A8E2-1F8BB9D0B29D}]
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{B41AD4BE-25BA-4A51-A0BB-FC1584E316F1}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{BA3D0120-E617-4F66-ADCA-585CC2FB86DB}]
@DACL=(02 0000)
@="BlackBerry Device Manager"
"AppID"="{4848DD90-EDA2-461F-8FE9-B47A067A5225}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
@DACL=(02 0000)
@="ErrorOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
@DACL=(02 0000)
@="Google Update Plugin"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
@DACL=(02 0000)
@="Google Update Plugin"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{C8992C14-DF59-4518-808F-CCFBB5850282}]
@DACL=(02 0000)
@="PropertiesRIMDeviceManager Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}]
@DACL=(02 0000)
@="Facebook Video Calling Plugin"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{CD221623-4F9A-4FA5-A9EE-A77EC8F0E7BD}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}]
@DACL=(02 0000)
@="DRMClient Helper version 2"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{D41C1E5B-0566-4BB1-BE72-1A5407349CA6}]
@DACL=(02 0000)
@="VSPConnection Class"
"AppID"="{4848DD90-EDA2-461F-8FE9-B47A067A5225}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{DB40EAF2-2025-4F74-B9EF-7C0782F26C84}]
@DACL=(02 0000)
"inti"=hex:73,0e,e3,52,00,00,00,00
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{DBFA3C03-20D5-4EE5-8C06-B8C4C2B71783}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}]
@DACL=(02 0000)
@="GoogleUpdate CredentialDialog"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{EB59852D-B38E-4A4C-94BA-6731836E5538}]
@DACL=(02 0000)
@="PropertiesRIMDeviceManagerAbout Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{EE7F6B66-AC97-41CF-BD88-372DDB786DB6}]
@DACL=(02 0000)
@="EmulatorManager Class"
"AppID"="{4848DD90-EDA2-461F-8FE9-B47A067A5225}"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
@DACL=(02 0000)
@="UpToDateOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{F6CF0104-4F4A-4EBE-999D-A12D838E65B5}]
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}]
@DACL=(02 0000)
@="SyncFileInformationProvider Class"
.
[HKEY_USERS\S-1-5-21-2952845082-3999916913-1929034053-1000_Classes\CLSID\{FD10EA6A-0D14-4AA2-A376-0C8D51CA8779}]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG2014\avgrsx.exe
c:\program files\AVG\AVG2014\avgcsrvx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\1.3.22.5\GoogleCrashHandler.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\system32\locator.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Microsoft Security Client\MpCmdRun.exe
.
**************************************************************************
.
Completion time: 2014-02-14  18:43:06 - machine was rebooted
ComboFix-quarantined-files.txt  2014-02-15 00:43
.
Pre-Run: 57,097,818,112 bytes free
Post-Run: 57,964,929,024 bytes free
.
- - End Of File - - 3625C36E510FDCC3EACE70B852ACB17A
A36C5E4F47E84449FF07ED3517B43A31
 



#11 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 14 February 2014 - 08:53 PM

Should I have turned off system restore?



#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:24 AM

Posted 15 February 2014 - 09:38 AM





Hello computerunderattack

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit
2.Unzip the contents to a folder in a convenient location.
3.Open the folder where the contents were unzipped and run mbar.exe
4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.
6.Wait while the system shuts down and the cleanup process is performed.
7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • •Internet access
    •Windows Update
    •Windows Firewall
9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
10.Verify that your system is now functioning normally.


--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
  • Exit/Close RogueKiller+
send me the reports made from MBAR and Roguekiller and also let me know how the computer is doing at this time.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 15 February 2014 - 12:35 PM

The computer shutdown just as I was getting ready to send these reports. The CPU usage is still high 33% to 50%. I didn't get the pop up ads this time or underlined text. But I am only taying on the internet long enough to send this...because it shuts down so fast. There was only one report for the Rogue Killer

 

 

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.15.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16518
Retia Bell :: RETIABELL-PC [administrator]

2/15/2014 8:59:16 AM
mbar-log-2014-02-15 (08-59-16).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 245791
Time elapsed: 16 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

 

RogueKiller V8.8.7 [Feb 11 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Retia Bell [Admin rights]
Mode : Remove -- Date : 02/15/2014 11:13:29
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] IHUninstallTrackingTASK : CMD - /C DEL C:\Users\RETIAB~1\AppData\Local\Temp\IHU20B9.tmp.exe [x][-][x] -> DELETED

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1       localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3160023AS ATA Device +++++
--- User ---
[MBR] 5072263920b69bf931bbf5f02a24a876
[BSP] b7f733ae6209a3ca65ff9d10514949a0 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 152485 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_02152014_111329.txt >>
RKreport[0]_S_02152014_105853.txt;RKreport[0]_S_02152014_111256.txt


 



#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:24 AM

Posted 15 February 2014 - 03:24 PM


Hello computerunderattack

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 computerunderattack

computerunderattack
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:10:24 PM

Posted 15 February 2014 - 04:00 PM

I am not clear about these  instructions. Do I type CF Script in the RUN command box?  Is the ClearJavaCache  a separate instruction after I run the CF script?






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users