Advertisement
Advertisement
 Search | |
| |
15-Jul-2012, 12:15 PM
#1 | ||||||
| google redirect virus Last edited by vampirehunter; 15-Jul-2012 at 02:44 PM.. |
15-Jul-2012, 11:05 PM
#2 | |||||||
| Hello vampirehunter and Welcome to Tech Support Guy!  My name is Gizzy and I'll be glad to help you with your malware problems. Please note the following while we work:
Because of this, I advise you to backup any personal files and folders before you start. Backup your data - windows 7 I am going through your logs and will reply with instructions soon.
__________________ Graduate of Malware Removal University | Member of ASAP and UNITE Help Add Content At The Official Tech Support Guy Library Of Knowledge! |
16-Jul-2012, 07:45 PM
#3 | ||||||
| |
17-Jul-2012, 12:01 PM
#4 | |||||||
| Hi vampirehunter, UAC Advice
Uninstall Programs
Upload File(s) for Scanning Please go to VirusTotal or Jotti to upload a file for scanning.
TDSSKiller Scan
Please reply with:
__________________ Graduate of Malware Removal University | Member of ASAP and UNITE Help Add Content At The Official Tech Support Guy Library Of Knowledge! |
17-Jul-2012, 07:18 PM
#5 | ||||||
| |
18-Jul-2012, 12:07 PM
#6 | |||||||
|
__________________ Graduate of Malware Removal University | Member of ASAP and UNITE Help Add Content At The Official Tech Support Guy Library Of Knowledge! |
18-Jul-2012, 11:09 PM
#7 | ||||||
| OTL logfile created on: 7/18/2012 8:16:49 PM - Run 1 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Users\Rob and Amy\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 5.96 Gb Total Physical Memory | 4.13 Gb Available Physical Memory | 69.26% Memory free 11.92 Gb Paging File | 9.62 Gb Available in Paging File | 80.72% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 916.82 Gb Total Space | 777.61 Gb Free Space | 84.82% Space Free | Partition Type: NTFS Drive D: | 627.46 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: FAMILYPC | User Name: Rob and Amy | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/07/18 20:15:34 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Rob and Amy\Desktop\OTL.exe PRC - [2012/06/29 05:40:10 | 000,646,800 | ---- | M] (McAfee, Inc.) -- c:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe PRC - [2012/02/23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe PRC - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011/08/23 16:34:46 | 006,132,576 | ---- | M] (LeapFrog Enterprises, Inc.) -- C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe PRC - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe PRC - [2009/09/18 17:10:26 | 000,335,600 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe PRC - [2009/09/17 14:05:00 | 000,656,624 | ---- | M] (SoftThinks) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe PRC - [2009/07/20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe PRC - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe PRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe PRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe PRC - [2008/07/04 12:38:14 | 000,065,536 | ---- | M] () -- C:\Brother\BPRSP\resources\BrSupSsp.exe ========== Modules (No Company Name) ========== MOD - [2012/06/14 06:33:41 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a23 0496832656b05b515eb9f3bc5\PresentationFramework.ni.dll MOD - [2012/06/14 06:33:30 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe6 51c6e72f12099a298654c9594\System.Windows.Forms.ni.dll MOD - [2012/06/14 06:33:25 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f8773 6d3248ae27d43e2c0d6\System.Drawing.ni.dll MOD - [2012/06/14 06:33:13 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea4 9639f38097e278b98a3da\PresentationCore.ni.dll MOD - [2012/05/10 06:31:21 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489 276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll MOD - [2012/05/10 06:30:29 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a58 6d3eeb7c373e3c1c\WindowsBase.ni.dll MOD - [2012/05/10 06:30:24 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d4 9b407b93663bfed\System.Xml.ni.dll MOD - [2012/05/10 06:30:21 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673 d948179195c\System.ni.dll MOD - [2012/05/10 06:30:21 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c50 6bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll MOD - [2012/05/10 06:30:13 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a35 9778ea57d914c\mscorlib.ni.dll MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010/04/08 09:52:20 | 000,271,024 | ---- | M] () -- C:\Program Files (x86)\Search Toolbar\SearchToolbar.dll MOD - [2009/09/17 14:05:00 | 000,234,736 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll MOD - [2009/09/17 14:05:00 | 000,128,240 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll MOD - [2009/09/17 14:05:00 | 000,121,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll MOD - [2009/09/17 14:05:00 | 000,111,856 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll MOD - [2009/09/17 14:05:00 | 000,079,088 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll MOD - [2009/09/17 14:05:00 | 000,074,992 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll MOD - [2009/09/17 14:05:00 | 000,025,840 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STBRCCServCLR.dll MOD - [2009/09/17 14:05:00 | 000,025,840 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftBRCCPiped.dll MOD - [2009/09/17 14:05:00 | 000,025,840 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftBRCC.dll MOD - [2009/09/17 14:04:00 | 001,123,568 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll MOD - [2009/07/20 05:00:00 | 000,077,824 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe MOD - [2008/07/04 12:38:14 | 000,065,536 | ---- | M] () -- C:\Brother\BPRSP\resources\BrSupSsp.exe ========== Win32 Services (SafeList) ========== SRV:64bit: - [2012/04/05 21:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2012/03/26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV:64bit: - [2012/03/26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV:64bit: - [2011/08/05 12:53:12 | 000,467,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc) SRV:64bit: - [2011/08/05 12:53:12 | 000,306,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm) SRV:64bit: - [2011/08/05 12:53:06 | 008,277,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc) SRV:64bit: - [2010/12/13 14:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc) SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009/07/20 13:36:14 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService) SRV:64bit: - [2009/03/31 17:01:34 | 000,092,160 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters) SRV - [2012/07/12 12:10:25 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/06/18 07:29:55 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/06/15 12:26:32 | 000,103,472 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe -- (McAfee SiteAdvisor Service) SRV - [2012/06/14 12:40:08 | 000,828,032 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Windows\Temp\0173151342482347mcinst.exe -- (0173151342482347mcinstcleanup) McAfee Application Installer Cleanup (0173151342482347) SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011/08/23 16:34:46 | 006,132,576 | ---- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] -- C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe -- (LeapFrog Connect Device Service) SRV - [2011/06/08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2011/04/01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2010/01/25 09:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc) SRV - [2009/12/17 02:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc) SRV - [2009/09/17 14:05:00 | 000,656,624 | ---- | M] (SoftThinks) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService) SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012/04/06 00:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2012/04/06 00:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012/04/05 20:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012/03/20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012/03/08 18:40:52 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012/02/15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011/05/18 10:14:22 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt) DRV:64bit: - [2011/05/18 10:14:20 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev) DRV:64bit: - [2011/05/18 10:14:16 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc) DRV:64bit: - [2011/05/18 10:14:12 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd) DRV:64bit: - [2011/05/18 10:09:48 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64) DRV:64bit: - [2011/05/18 10:09:48 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64) DRV:64bit: - [2011/05/13 04:21:02 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/12/13 14:37:18 | 000,036,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nx6000.sys -- (MSHUSBVideo) DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010/11/20 05:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser) DRV:64bit: - [2009/10/16 06:32:24 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM) DRV:64bit: - [2009/10/01 01:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009/09/26 10:42:58 | 000,233,984 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R) DRV:64bit: - [2009/09/17 15:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009/08/13 23:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21) DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/07/13 20:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) Brother MFC Serial Interface Driver(WDM) DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009/07/09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64) DRV:64bit: - [2009/06/17 11:54:46 | 000,040,976 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LUsbFilt.sys -- (LUsbFilt) DRV:64bit: - [2009/06/17 11:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2009/06/17 11:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2009/06/10 15:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) Brother MFC Serial USB Driver(WDM) DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus) DRV:64bit: - [2008/08/28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV:64bit: - [2008/04/01 14:33:16 | 000,024,576 | ---- | M] (LeapFrog) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\FlyUsb.sys -- (FlyUsb) DRV:64bit: - [2006/11/01 13:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr) DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus) DRV - [2005/01/03 19:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9E833260-7906-4A4E-9C68-7B37924BE6D8} IE:64bit: - HKLM\..\SearchScopes\{9E833260-7906-4A4E-9C68-7B37924BE6D8}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {617BBC5C-CC71-44C8-AD7C-22FF2D6E1959} IE - HKLM\..\SearchScopes\{617BBC5C-CC71-44C8-AD7C-22FF2D6E1959}: "URL" = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {617BBC5C-CC71-44C8-AD7C-22FF2D6E1959} IE - HKU\.DEFAULT\..\SearchScopes\{C540EA72-5CE6-4ABB-9E9F-D54B07AD84D1}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {617BBC5C-CC71-44C8-AD7C-22FF2D6E1959} IE - HKU\S-1-5-18\..\SearchScopes\{C540EA72-5CE6-4ABB-9E9F-D54B07AD84D1}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1 IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://toolbar.inbox.com/search/disp...b_id&%language IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?l=dis&o=102810&gct=hp IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No CLSID value found IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes,DefaultScope = {117F631B-1401-43CF-B02D-4CC0CAD4BF5A} IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes\{117F631B-1401-43CF-B02D-4CC0CAD4BF5A}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer: source}&ie={inputEncoding?}&oe={outputEncoding?} IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes\{42377191-38C0-44C0-A819-0B8E214D6294}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms} IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes\{B6C668CE-023C-4278-94AC-763D3714E1F0}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ARCD&o=102810&src=kw&q={searchTerms}&locale=en_US&apn _ptnrs=8W&apn_dtid=YYYYYYYYUS&apn_uid=5de774d5-ab32-4d9c-9405-1b1c8e38acea&apn_sauid=A09C508C-8A80-46E1-8CFA-B877B9E7A126 IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80115&lng=en IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\SearchScopes\{EE871180-2F93-F8D2-D9F0-D4FC20ED2A5F}: "URL" = http://www.bing.com/search?q={searchTerms}&pc=ZUGO&form=ZGAIDF IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-945082049-3120335163-541019017-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultEngine: "Yahoo" FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-" FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?l=dis&o=102810&gct=hp" FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: toolbar@shopathome.com:5.1.1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p=" FF - prefs.js..network.proxy.type: 4 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Rob and Amy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( ) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Rob and Amy\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Rob and Amy\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Rob and Amy\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010/03/04 15:16:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012/07/16 18:45:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/17 17:59:44 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/07/17 17:59:44 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011/08/21 17:58:40 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/17 17:59:44 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/07/17 17:59:44 | 000,000,000 | ---D | M] [2010/03/02 18:33:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob and Amy\AppData\Roaming\Mozilla\Extensions [2012/07/14 19:14:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rob and Amy\AppData\Roaming\Mozilla\Firefox\Profiles\22bbgjmf.default\extensions [2012/04/09 17:39:58 | 000,002,333 | ---- | M] () -- C:\Users\Rob and Amy\AppData\Roaming\Mozilla\Firefox\Profiles\22bbgjmf.default\searchplugins \askcom.xml [2011/05/05 20:35:34 | 000,001,919 | ---- | M] () -- C:\Users\Rob and Amy\AppData\Roaming\Mozilla\Firefox\Profiles\22bbgjmf.default\searchplugins \bing-zugo.xml [2010/04/27 17:10:42 | 000,004,772 | ---- | M] () -- C:\Users\Rob and Amy\AppData\Roaming\Mozilla\Firefox\Profiles\22bbgjmf.default\searchplugins \web-search.xml [2012/06/18 07:29:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012/03/29 15:28:22 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012/07/16 18:45:45 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES (X86)\MCAFEE\SITEADVISOR [2012/02/23 00:09:13 | 000,164,722 | ---- | M] () (No name found) -- C:\USERS\ROB AND AMY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\22BBGJMF.DEFAULT\EXTENSIONS\CO MPATIBILITY@ADDONS.MOZILLA.ORG.XPI [2012/06/18 07:29:56 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2011/04/08 11:37:15 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll [2011/04/08 11:37:15 | 000,466,944 | ---- | M] (Catalina Marketing Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\NPcol500.dll [2012/06/18 07:29:54 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011/04/22 17:18:10 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml.old [2011/05/09 16:35:23 | 000,002,049 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2012/07/14 19:14:23 | 000,002,024 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml [2012/06/18 07:29:54 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml ========== Chrome ========== CHR - homepage: CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google  rigi nalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie= {inputEncoding}&q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chro me&hl={language}&q={searchTerms} CHR - homepage: CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPlugin Chrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll CHR - plugin: CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol500.dll CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll CHR - plugin: Java(TM) Platform SE 6 U32 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 6.0.320.5 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = C:\Users\Rob and Amy\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Rob and Amy\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll CHR - Extension: YouTube = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google Search = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: SiteAdvisor = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.1_0\ CHR - Extension: Gmail = C:\Users\Rob and Amy\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL File not found O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files (x86)\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found O2 - BHO: (AppGraffiti) - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\Program Files (x86)\AppGraffiti\AppGraffiti.dll (Omega Partners Ltd) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found. O2 - BHO: (Gaming support for ArcadeWeb) - {9F531FB1-7C1F-4e1a-8C0C-E8D6177130E2} - C:\Users\Rob and Amy\AppData\Local\ArcadeWeb\arcadeweb32.dll (Arcade Web LLC) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3:64bit: - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation) O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-945082049-3120335163-541019017-1001..\Run: [] File not found O4 - HKU\S-1-5-21-945082049-3120335163-541019017-1001..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKU\S-1-5-21-945082049-3120335163-541019017-1001..\Run: [ScanSoft] C:\Users\Rob and Amy\AppData\Local\ScanSoft\hdfearpo.dll (flashget) O4 - HKLM..\RunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\ToasterLauncher.exe () O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKLM..\RunOnceEx: [] File not found O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found O4 - Startup: C:\Users\Rob and Amy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: internet ([]about in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: magicjack.com ([data] https in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: magicjack.com ([my] https in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: mcafee.com ([]http in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: mcafee.com ([]https in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: real.com ([rhapreg] https in Trusted sites) O15 - HKU\S-1-5-21-945082049-3120335163-541019017-1001\..Trusted Domains: talk4free.com ([reg] https in Trusted sites) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_32) O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_32) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_32) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C106019A-733B-479D-A838-578228C4CB55}: DhcpNameServer = 8.8.8.8 O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/10/20 00:14:28 | 000,000,043 | R--- | M] () - D:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{d22ca95e-20e2-11df-9ac3-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{d22ca95e-20e2-11df-9ac3-806e6f6e6963}\Shell\AutoRun\command - "" = D:\start.exe -- [2010/04/01 03:40:27 | 002,052,921 | R--- | M] (Macromedia, Inc.) O33 - MountPoints2\{dfa2327a-9582-11df-bfe6-002564ec7592}\Shell - "" = AutoRun O33 - MountPoints2\{dfa2327a-9582-11df-bfe6-002564ec7592}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\autorun.exe O33 - MountPoints2\I\Shell\phone\command - "" = I:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012/07/18 20:15:37 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Rob and Amy\Desktop\OTL.exe [2012/07/16 22:11:26 | 002,136,664 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Rob and Amy\Desktop\TDSSKiller.exe [2012/07/15 11:06:25 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Rob and Amy\Desktop\dds.com [2012/07/15 11:04:05 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Rob and Amy\Desktop\HijackThis.exe [2012/07/14 19:16:16 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome [2012/07/14 11:58:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother Personal Utilities [2012/07/14 08:33:15 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{5D8A9934-4F54-404B-B082-8B981091FC3B} [2012/07/14 08:33:02 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{8A7F3093-3BB1-42E5-BA26-EF97A26FF38D} [2012/07/14 07:01:42 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{A28F399B-28F2-42FE-BE6C-D1423EFE7B70} [2012/07/14 06:57:30 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{39898E74-6880-4559-AAEC-4F59EED850B7} [2012/07/13 07:03:41 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{CE17FFF4-3CF2-480D-B7BD-0F28E0F156B3} [2012/07/12 23:11:31 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{DD91969F-3DB0-481E-9872-A699167F4EE6} [2012/07/12 06:48:10 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{B491DEEA-6F18-4FC5-8BD2-FE1AEB82B19F} [2012/07/12 06:47:57 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{675FC71A-FD2C-4FBA-810E-F361047620BF} [2012/07/11 23:32:46 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012/07/11 23:32:46 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012/07/11 23:32:45 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012/07/11 23:32:45 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012/07/11 23:32:44 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012/07/11 23:32:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012/07/11 23:32:44 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012/07/11 23:32:44 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012/07/11 23:32:43 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012/07/11 23:32:42 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012/07/11 23:32:42 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012/07/11 23:32:42 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012/07/11 23:32:42 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012/07/11 06:44:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012/07/11 06:44:53 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012/07/11 06:44:51 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012/07/11 06:44:45 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012/07/11 06:44:45 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012/07/11 06:39:45 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{FEDD4B7E-9079-4865-8BAA-024E223B2897} [2012/07/11 06:39:33 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{26C2020B-754E-4ABE-9CF5-C32C287E4BEC} [2012/07/10 06:50:39 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{9FEC1250-AC7A-4A2D-8527-7CEED62097C2} [2012/07/10 06:50:28 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{0AACD59D-4503-4662-92F6-C9A4F822B55F} [2012/07/08 16:38:53 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\Documents\PICTURES [2012/07/08 06:42:10 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{53CAB3B6-D1EE-4484-97D3-717E466465DE} [2012/07/08 06:41:56 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{C62D9088-12A4-4F27-8993-346082BC673D} [2012/07/07 06:58:31 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{05D96F4F-1E37-4686-87B6-717008866D49} [2012/07/07 06:58:21 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{FE6E92CB-DCB1-45D2-ABEA-143E3AFDBCCF} [2012/07/06 06:30:36 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{DAF492BB-73F9-4EF8-932A-904FAF272FAE} [2012/07/06 06:30:12 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{43D8C86C-B55A-427E-9472-808F39E63EDE} [2012/07/05 01:17:17 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{882BF0BC-42BE-4EBB-96A4-DAAE52ECBC33} [2012/07/05 01:17:03 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{CE0F9943-BFCA-4D0C-8A21-60A4F6FEB842} [2012/07/04 07:06:19 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{42AF3974-BEF6-4DFB-808F-EC0F6840FD4F} [2012/07/03 18:42:33 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{74F86EB0-326B-47B7-A0B8-CCD87341CB31} [2012/07/03 06:40:59 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{23BD8FCC-D2CA-4DEB-ABAB-B8E9AE0A2B1D} [2012/07/03 06:40:46 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{1BB8B8FA-F0CE-4C05-A0FF-7234B9B76816} [2012/07/02 06:29:39 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{192DF93F-A070-4177-8FA9-2ED93AC111FB} [2012/07/02 06:29:28 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{877D2944-F14A-42F5-86ED-21D1FCC68630} [2012/07/01 02:40:06 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{BDA2F858-D051-4ED4-AD54-EF86CF594D0D} [2012/07/01 02:39:56 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{456B9ED4-6510-4338-8DE5-5EC4EBC9D1B3} [2012/06/30 07:19:18 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{83D4416C-0548-4A44-B9A5-1C60050D4DDF} [2012/06/30 07:19:07 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{487E57D7-6FA0-4847-9AC0-31CC56E2B652} [2012/06/29 06:31:43 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{02EB1F74-7F53-43B6-BD16-19DAA1182428} [2012/06/29 06:31:22 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{43EA8E64-17F5-41E5-8F2B-3942DE4EAA6F} [2012/06/28 18:30:53 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{5C404E56-75A9-4C6D-939A-FA01047A1F50} [2012/06/28 18:30:40 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{40620214-136F-4B47-A6EE-C5E11DD030C4} [2012/06/28 06:30:07 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{A3FFF3A0-B774-4DEF-A354-ACDD8B855138} [2012/06/28 06:29:56 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{6E93B2CD-9337-4850-B158-2303950F1501} [2012/06/27 06:34:38 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{1CD81F85-4F7C-4695-A57B-518338D3D909} [2012/06/27 06:34:27 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{8FCFFED0-FC37-49B0-A230-22CF46D1F0C0} [2012/06/26 23:45:58 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{CBE1B353-C7C2-490E-BDF8-94CA8F81EE76} [2012/06/25 07:13:02 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{AD7A34CD-89B6-4577-9518-30A3E3699937} [2012/06/25 07:12:43 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{B004B879-75F5-446A-A77A-5B135324E3D3} [2012/06/24 06:53:37 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{AC9E5B34-855D-41D0-B2A4-C0D31126756C} [2012/06/24 06:53:25 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{91580D28-3919-4F74-9D09-D8035A1B0090} [2012/06/23 15:55:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\gPotato [2012/06/23 15:50:30 | 000,000,000 | ---D | C] -- C:\gPotato [2012/06/23 14:04:52 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\Deployment [2012/06/23 07:57:36 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{6DC0080C-8F75-4B7B-A023-FFC09E4950F0} [2012/06/23 07:57:22 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{87CF7DAA-431A-4087-AD05-E7A65D14F68A} [2012/06/22 17:46:16 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{B117AC22-57BB-4A43-B8F5-4AC0B1CDCD21} [2012/06/22 17:46:06 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{F4FB8A67-479C-4BC6-85BB-69FD5D308F8D} [2012/06/22 05:52:14 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{43351FBB-CD1A-4607-BE38-2F0CC92BA8EA} [2012/06/22 05:52:02 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{A220C7F0-B99C-4E38-B751-2E361EDF0F32} [2012/06/21 06:30:31 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2012/06/21 06:30:31 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2012/06/21 06:30:31 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2012/06/21 06:30:16 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2012/06/21 06:30:16 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2012/06/21 06:30:16 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2012/06/21 06:30:02 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2012/06/21 06:30:02 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [2012/06/21 06:26:54 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{841CF895-56A8-46B0-BB3B-C4D8FADDC848} [2012/06/21 06:26:36 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{77D6D850-AB40-4665-9AF9-5C3E9CF0F4F0} [2012/06/20 06:19:05 | 000,000,000 | ---D | C] -- C:\Users\Rob and Amy\AppData\Local\{5F9827B0-DECE-4B8F-BCFA-50960D38ACFC} [2010/03/02 18:03:23 | 008,656,832 | ---- | C] (Dell, Inc. ) -- C:\Users\Rob and Amy\AppData\Roaming\DataSafeDotNet.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/07/18 20:15:34 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Rob and Amy\Desktop\OTL.exe [2012/07/18 20:14:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/07/18 20:10:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012/07/18 19:25:00 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-945082049-3120335163-541019017-1001UA.job [2012/07/18 11:25:00 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-945082049-3120335163-541019017-1001Core.job [2012/07/17 21:14:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/07/17 18:14:30 | 002,136,664 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Rob and Amy\Desktop\TDSSKiller.exe [2012/07/17 18:13:58 | 002,117,152 | ---- | M] () -- C:\Users\Rob and Amy\Desktop\tdsskiller.zip [2012/07/16 18:44:19 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/07/16 18:44:19 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/07/15 12:27:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/07/15 12:27:03 | 504,717,311 | -HS- | M] () -- C:\hiberfil.sys [2012/07/15 11:06:19 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Rob and Amy\Desktop\dds.com [2012/07/15 11:03:57 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Rob and Amy\Desktop\HijackThis.exe [2012/07/14 12:53:53 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk [2012/07/12 12:10:25 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012/07/12 12:10:25 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012/07/12 09:09:20 | 000,001,135 | ---- | M] () -- C:\Users\Rob and Amy\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk [2012/07/12 06:46:53 | 000,309,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/07/11 16:01:15 | 000,004,096 | -H-- | M] () -- C:\Users\Rob and Amy\AppData\Local\keyfile3.drm [2012/07/05 14:54:00 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\EasyShare Registration Task.job [2012/07/03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012/06/23 15:55:18 | 000,000,721 | ---- | M] () -- C:\Users\Public\Desktop\Rappelz.lnk [2012/06/23 14:15:54 | 000,733,968 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/06/23 14:15:54 | 000,629,232 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/06/23 14:15:54 | 000,108,448 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/06/19 16:04:02 | 000,000,000 | ---- | M] () -- C:\Users\Rob and Amy\Documents\Nuance Image Printer Writer Port [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/07/17 18:14:00 | 002,117,152 | ---- | C] () -- C:\Users\Rob and Amy\Desktop\tdsskiller.zip [2012/07/14 19:15:45 | 000,000,932 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-945082049-3120335163-541019017-1001UA.job [2012/07/14 19:15:44 | 000,000,880 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-945082049-3120335163-541019017-1001Core.job [2012/07/11 16:01:15 | 000,004,096 | -H-- | C] () -- C:\Users\Rob and Amy\AppData\Local\keyfile3.drm [2012/06/23 15:55:18 | 000,000,721 | ---- | C] () -- C:\Users\Public\Desktop\Rappelz.lnk [2012/06/19 16:04:02 | 000,000,000 | ---- | C] () -- C:\Users\Rob and Amy\Documents\Nuance Image Printer Writer Port [2012/03/09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2012/02/23 15:47:36 | 000,747,626 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012/02/23 15:47:33 | 000,000,401 | ---- | C] () -- C:\Windows\Mail2Contact.ini [2012/02/14 21:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012/02/14 21:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2012/01/27 15:30:13 | 000,455,237 | ---- | C] () -- C:\Users\Rob and Amy\green documents.pdf [2011/10/25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011/09/12 17:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011/06/28 23:12:22 | 000,000,281 | ---- | C] () -- C:\Users\Rob and Amy\AppData\Roaming\Network Meter_Settings.ini [2011/06/28 07:37:56 | 000,103,784 | ---- | C] () -- C:\Users\Rob and Amy\GoToAssistDownloadHelper.exe [2011/06/24 11:43:08 | 000,000,412 | ---- | C] () -- C:\Users\Rob and Amy\AppData\Roaming\All CPU Meter_Settings.ini [2011/05/09 16:35:36 | 000,098,304 | ---- | C] () -- C:\Windows\SysWow64\redmonnt.dll [2011/04/25 19:22:02 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD5240.DAT [2011/04/25 19:21:22 | 000,000,151 | ---- | C] () -- C:\Windows\BRVIDEO.INI [2011/04/25 19:21:22 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini [2011/04/25 19:21:21 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\brlmw03a.ini [2011/04/25 19:21:20 | 000,014,496 | ---- | C] () -- C:\Windows\HL-5240.INI [2011/04/25 19:19:27 | 000,000,091 | ---- | C] () -- C:\Windows\Brownie.ini [2010/06/22 23:50:02 | 000,007,618 | ---- | C] () -- C:\Users\Rob and Amy\AppData\Local\resmon.resmoncfg [2010/05/12 12:30:18 | 000,060,304 | ---- | C] () -- C:\Users\Rob and Amy\g2mdlhlpx.exe [2010/03/03 12:53:32 | 000,042,263 | ---- | C] () -- C:\Users\Rob and Amy\ordercomplete.aspx.htm [2008/07/09 19:21:56 | 000,000,000 | ---- | C] () -- C:\Users\Rob and Amy\ź9ź9 [2008/06/20 12:26:13 | 000,000,118 | ---- | C] () -- C:\Users\Rob and Amy\default.pls [2008/06/12 16:47:48 | 000,001,080 | ---- | C] () -- C:\Users\Rob and Amy\NORInfo.ini [2008/06/12 16:47:48 | 000,000,084 | ---- | C] () -- C:\Users\Rob and Amy\USBInfo.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 860 bytes -> C:\Users\Rob and Amy\Documents\Court Orders for Guardianship.eml:OECustomProperty < End of report > |
18-Jul-2012, 11:11 PM
#8 | ||||||
| |
18-Jul-2012, 11:16 PM
#9 | ||||||
| |
19-Jul-2012, 09:35 PM
#10 | |||||||
|
__________________ Graduate of Malware Removal University | Member of ASAP and UNITE Help Add Content At The Official Tech Support Guy Library Of Knowledge! |
19-Jul-2012, 11:51 PM
#11 | ||||||
| |
20-Jul-2012, 07:35 PM
#12 | ||||||
| |
21-Jul-2012, 09:43 AM
#13 | ||||||
| |
21-Jul-2012, 04:18 PM
#14 | |||||||
| Hi vampirehunter, Do the redirects happen in all browsers? Or one specifically? Do you have a USB flash drive? if so please run the following scan. ListParts
Boot your computer into Recovery Environment
Please reply with:
__________________ Graduate of Malware Removal University | Member of ASAP and UNITE Help Add Content At The Official Tech Support Guy Library Of Knowledge! |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
