Ransom Virus and many others

[fujymo]

OCD,

Malwarebytes came up clean, but ESET showed a few threats. All listed below. The computer in runnung great.

Fujymo

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.05.23.12

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Matt :: MATT-DESKTOP [administrator]

5/23/2013 7:50:54 PM
mbam-log-2013-05-23 (19-50-54).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 238833
Time elapsed: 4 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


C:\Qoobox\Quarantine\C\Users\Matt\acrobatreader53868.exe.vir a variant of Win32/Kryptik.BBLX trojan
C:\Qoobox\Quarantine\C\Users\Matt\alg.exe.vir a variant of Win32/Kryptik.BBRA trojan
C:\Qoobox\Quarantine\C\Users\Matt\alg48478.exe.vir Win32/TrojanProxy.Agent.NMP trojan
C:\Qoobox\Quarantine\C\Users\Matt\chrome125524.exe.vir a variant of Win32/Medfos.PO trojan
C:\Qoobox\Quarantine\C\Users\Matt\icq442766.exe.vir a variant of Win32/Kryptik.BBRA trojan
C:\Qoobox\Quarantine\C\Users\Matt\java647518.exe.vir a variant of Win32/Kryptik.BBLX trojan
C:\Qoobox\Quarantine\C\Users\Matt\notepad582814.exe.vir a variant of Win32/TrojanProxy.Agent.NMP trojan
C:\Qoobox\Quarantine\C\Users\Matt\teamviewer.exe.vir a variant of Win32/Kryptik.BBLX trojan
C:\Qoobox\Quarantine\C\Users\Matt\windowsupdate.exe.vir a variant of Win32/Kryptik.BBRA trojan
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Local\miurtew.dll.vir a variant of Win32/TrojanProxy.Agent.NMV trojan
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\amsecure.exe.vir a variant of Win32/Kryptik.BBSL trojan
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\ashlp.dll.vir a variant of Win32/Medfos.PN trojan
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\msocpc.dll.vir a variant of Win32/Medfos.PN trojan
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart.exe.vir Win32/Toolbar.DefaultTab.A application
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabStart64.exe.vir Win64/Toolbar.DefaultTab.A application
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe.vir Win32/Toolbar.DefaultTab.A application
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\DefaultTab\DefaultTab\update.exe.vir multiple threats
C:\Qoobox\Quarantine\C\Users\Matt\AppData\Roaming\Fiiwso\qyrygyy.exe.vir Win32/Spy.Zbot.ABA trojan
C:\Qoobox\Quarantine\C\Windows\spoolsvc.exe.vir a variant of Win32/Spy.Wagiclas.AB trojan
C:\Users\Public\Downloads\5thGrader_AOL-dm.exe a variant of Win32/Adware.Trymedia.A application

[OCD]

Hi fujymo,

Most of those are in a quarantine folder that we will take care of shortly. But we still have one to address now.

=========================

1. ComboFix Script

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the code-box below into it:

File::
C:\Users\Public\Downloads\5thGrader_AOL-dm.exe

Save this as CFScript.txt, in the same location as ComboFix.exe




Referring to the picture above, drag CFScript into ComboFix.exe

When finished, please post the C:\ComboFix.txt for further review.

=========================

In your next post please provide the following:

• ComboFix.txt

[fujymo]

Requested file posted.

ComboFix 13-05-22.01 - Matt 05/24/2013 16:52:45.3.4 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3070.2235 [GMT -4:00]
Running from: c:\users\Matt\Desktop\ComboFix.exe
Command switches used :: c:\users\Matt\Desktop\cfscript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\users\Public\Downloads\5thGrader_AOL-dm.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\Downloads\5thGrader_AOL-dm.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-04-24 to 2013-05-24 )))))))))))))))))))))))))))))))
.
.
2013-05-24 21:01 . 2013-05-24 21:02 -------- d-----w- c:\users\Matt\AppData\Local\temp
2013-05-24 21:01 . 2013-05-24 21:01 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2013-05-24 21:01 . 2013-05-24 21:01 -------- d-----w- c:\users\Mcx1-MATT-DESKTOP\AppData\Local\temp
2013-05-24 21:01 . 2013-05-24 21:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-24 20:49 . 2013-05-24 20:49 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{70CFCD90-BC56-4D3C-B3A7-16DE8727FA94}\MpKsle7e40471.sys
2013-05-24 01:22 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{70CFCD90-BC56-4D3C-B3A7-16DE8727FA94}\mpengine.dll
2013-05-23 23:57 . 2013-05-23 23:57 -------- d-----w- c:\program files\ESET
2013-05-23 19:37 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-22 20:20 . 2013-05-22 20:19 724464 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74858603-C52E-42A1-9794-CAE5797B6404}\gapaengine.dll
2013-05-15 07:03 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2013-05-15 00:23 . 2013-05-15 00:23 388096 ----a-r- c:\users\Matt\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-15 00:23 . 2013-05-15 00:23 -------- d-----w- c:\program files\Trend Micro
2013-05-15 00:08 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-15 00:08 . 2013-03-19 04:53 186368 ----a-w- c:\windows\system32\wwansvc.dll
2013-05-15 00:08 . 2013-03-19 03:33 40960 ----a-w- c:\windows\system32\wwanprotdim.dll
2013-05-15 00:08 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 00:08 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 00:08 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-15 00:08 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll
2013-05-15 00:08 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll
2013-05-15 00:04 . 2013-05-15 00:04 -------- d-----w- c:\users\Matt\AppData\Local\Diagnostics
2013-05-14 22:12 . 2009-01-25 16:14 15224 ----a-w- c:\windows\system32\sdnclean.exe
2013-05-14 22:12 . 2013-05-14 22:13 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2013-05-08 18:15 . 2013-05-08 18:16 -------- d-----w- c:\programdata\MFAData
2013-05-08 18:15 . 2013-05-08 18:15 -------- d--h--w- c:\programdata\Common Files
2013-05-08 18:15 . 2013-05-08 18:15 -------- d-----w- c:\users\Matt\AppData\Local\MFAData
2013-05-08 18:15 . 2013-05-08 18:15 -------- d-----w- c:\users\Matt\AppData\Local\Avg2013
2013-05-08 17:48 . 2013-05-22 23:33 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-05-08 11:48 . 2013-05-08 11:48 -------- d-----w- c:\program files\CCleaner
2013-05-08 10:39 . 2013-05-23 22:36 -------- d-----w- c:\users\Matt\AppData\Local\ElevatedDiagnostics
2013-05-07 10:57 . 2013-05-07 10:57 -------- d-----w- c:\users\Matt\AppData\Roaming\Malwarebytes
2013-05-07 10:56 . 2013-05-07 10:56 -------- d-----w- c:\programdata\Malwarebytes
2013-05-07 10:56 . 2013-05-07 10:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-05-07 10:56 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-05-07 10:56 . 2013-05-07 10:56 -------- d-----w- c:\users\Matt\AppData\Local\Programs
2013-05-01 11:18 . 2013-04-12 13:45 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 15:28 . 2012-08-17 03:03 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-05-01 11:29 . 2012-10-03 11:45 706640 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-04-13 04:45 . 2013-05-15 00:08 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 00:08 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-03-21 07:20 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2013-03-19 05:04 . 2013-04-10 09:29 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 09:29 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48 . 2013-04-10 09:29 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49 . 2013-04-10 09:29 69632 ----a-w- c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spybot-S&D Cleaning"="c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe" [2012-11-13 3713032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"dldomon.exe"="c:\program files\Dell 968 AIO Printer\dldomon.exe" [2007-10-05 455920]
"MemoryCardManager"="c:\program files\Dell 968 AIO Printer\memcard.exe" [2007-10-05 410864]
"Dell 968 AIO Printer Fax Server"="c:\program files\Dell 968 AIO Printer\fm3032.exe" [2007-10-05 312560]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-03-21 478800]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2012-11-13 3825176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-03-21 280576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Camera Monitor SD.lnk - c:\program files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe [2012-8-17 541976]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 dldoCATSCustConnectService;dldoCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\dldoserv.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 MpKsle7e40471;MpKsle7e40471;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{70CFCD90-BC56-4D3C-B3A7-16DE8727FA94}\MpKsle7e40471.sys [x]
S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 dldo_device;dldo_device;c:\windows\system32\dldocoms.exe [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MPKSLE7E40471
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-17 13:37]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-24 17:06:28
ComboFix-quarantined-files.txt 2013-05-24 21:06
ComboFix2.txt 2013-05-23 19:31
ComboFix3.txt 2013-05-22 23:50
.
Pre-Run: 322,030,878,720 bytes free
Post-Run: 324,091,920,384 bytes free
.
- - End Of File - - B396803EA6F1234B6F0B1E98AF06D77D

[OCD]

Hi fujymo,

A few last scans to be sure nothing has slipped by.

=========================

1. Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Right click SecurityCheck.exe, select "Run as Administrator" and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

2. Re-run OTL (it should be located on your desktop).

Windows Vista and Windows 7 users Right Click and select "Run as Administrator" on the icon to run it.

• Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Uncheck the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open one notepad window. OTL.Txt. (No Extras.txt will be produced)
  Note:The log can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please copy (Edit->Select All, Edit->Copy) the contents of the file, and post it with your next reply.

=========================

In your next post please provide the following:

• checkup.txt
• OTL.txt
• Any outstanding issues we haven't addressed?

[fujymo]

OCD,

The computer is running great and here are the logs you requested:

Thanks,

Fujymo

Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
(On Access scanning disabled!)
Error obtaining update status for antivirus!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
CCleaner
Java 7 Update 7
Java version out of Date!
Adobe Flash Player 11.3.300.271
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Spybot Teatimer.exe is disabled!
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````





OTL logfile created on: 5/25/2013 8:59:03 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Matt\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.40 Gb Available Physical Memory | 80.18% Memory free
5.99 Gb Paging File | 4.91 Gb Available in Paging File | 81.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 301.49 Gb Free Space | 66.16% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.50 Gb Free Space | 55.00% Space Free | Partition Type: NTFS
Drive E: | 513.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 931.51 Gb Total Space | 895.27 Gb Free Space | 96.11% Space Free | Partition Type: NTFS

Computer Name: MATT-DESKTOP | User Name: Matt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Matt\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
PRC - C:\Windows\System32\dldocoms.exe ( )
PRC - C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
PRC - C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
PRC - C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
PRC - C:\Windows\System32\PSIService.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldoscw.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldocfg.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldodatr.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\DLDOptp.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldocats.dll ()


========== Services (SafeList) ==========

SRV - (SDWSCService) -- C:\Program Files\Spybot File not found
SRV - (SDUpdateService) -- C:\Program Files\Spybot File not found
SRV - (SDScannerService) -- C:\Program Files\Spybot File not found
SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AERTFilters) -- C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
SRV - (dldoCATSCustConnectService) -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\dldoserv.exe ()
SRV - (dldo_device) -- C:\Windows\System32\dldocoms.exe ( )
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()


========== Driver Services (SafeList) ==========

DRV - (mbr) -- C:\ComboFix\mbr.sys File not found
DRV - (FastUserSwitchingCompatibility) -- C:\Windows\system32\FastUserSwitchingCompatibilityex.dll File not found
DRV - (catchme) -- C:\Users\Matt\AppData\Local\Temp\catchme.sys File not found
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (e1express) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Matt\Desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 EC F9 57 39 BC CD 01 [binary data]
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {08F727FD-82AA-44B9-B329-0582C526FEF6}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{08F727FD-82AA-44B9-B329-0582C526FEF6}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\..\SearchScopes\{449557DB-175E-49CB-B8E6-2CAD5F2B1A34}: "URL" = http://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20121145,17118,0,18,0
IE - HKCU\..\SearchScopes\{898F1C31-C646-4836-B7E4-C9068F2BF0BB}: "URL" = http://www.mysearchresults.com/search?&c=0000&t=01&q={searchTerms}
IE - HKCU\..\SearchScopes\{A90FF914-FAF9-4116-93F9-FEA9BB38677F}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=8F01DA46-A859-4625-B783-4D9361447BD4&apn_sauid=72AC7A36-71E8-4FF8-84C2-913E758320F7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..keyword.URL: ""
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/08/17 12:35:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Extensions
[2013/04/30 09:13:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions
[2012/11/06 12:30:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\staged
[2009/07/13 19:11:12 | 000,004,816 | ---- | M] () (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\ojacgfbroj@ojacgfbroj.org.xpi
[2012/11/06 12:30:53 | 000,022,425 | ---- | M] () (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\staged\addon@defaulttab.com.xpi
[2012/09/16 16:12:07 | 000,002,299 | ---- | M] () -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\searchplugins\askcom.xml

O1 HOSTS File: ([2013/05/24 17:02:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
O4 - HKLM..\Run: [Dell 968 AIO Printer Fax Server] C:\Program Files\Dell 968 AIO Printer\fm3032.exe ()
O4 - HKLM..\Run: [dldomon.exe] C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Spybot-S&D Cleaning] C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4EF6EFA6-64CD-49AF-A1CD-823511F6E664}: DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{64169AB7-D8F3-421A-BBBB-26BFF19CF8A6}: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/01/10 15:11:17 | 000,000,175 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2012/06/15 17:12:01 | 000,000,000 | ---D | M] - F:\autorun -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 08:56:20 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Matt\Desktop\OTL.exe
[2013/05/24 17:06:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/05/24 17:06:35 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\temp
[2013/05/23 19:57:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/23 15:40:23 | 000,000,000 | ---D | C] -- C:\Users\Matt\Desktop\deans
[2013/05/23 15:31:12 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/05/22 19:33:30 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/05/22 19:33:30 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/05/22 19:33:30 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/05/22 19:25:09 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/05/22 19:24:52 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/05/22 19:19:40 | 005,069,782 | R--- | C] (Swearware) -- C:\Users\Matt\Desktop\ComboFix.exe
[2013/05/15 03:07:47 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/05/15 03:07:47 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/05/15 03:07:46 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/05/15 03:07:46 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/05/15 03:07:45 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/05/15 03:07:45 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/05/15 03:07:43 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/05/15 03:03:46 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/05/14 20:23:49 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2013/05/14 20:23:41 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2013/05/14 20:08:12 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013/05/14 20:08:12 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wwanprotdim.dll
[2013/05/14 20:08:05 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013/05/14 20:08:01 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2013/05/14 20:08:01 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2013/05/14 20:04:49 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Diagnostics
[2013/05/14 18:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013/05/14 18:12:52 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe
[2013/05/14 18:12:40 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013/05/08 14:15:45 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\MFAData
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Avg2013
[2013/05/08 13:48:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/05/08 13:48:12 | 000,000,000 | ---D | C] -- C:\Users\Matt\Documents\ProcAlyzer Dumps
[2013/05/08 07:48:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/05/08 07:48:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/05/08 06:39:24 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\ElevatedDiagnostics
[2013/05/07 06:57:15 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Roaming\Malwarebytes
[2013/05/07 06:57:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/07 06:56:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/05/07 06:56:53 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/05/07 06:56:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/05/07 06:56:35 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Programs

========== Files - Modified Within 30 Days ==========

[2013/05/25 08:56:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Matt\Desktop\OTL.exe
[2013/05/25 08:56:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/25 08:48:08 | 000,890,854 | ---- | M] () -- C:\Users\Matt\Desktop\SecurityCheck.exe
[2013/05/25 08:42:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/24 17:02:15 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013/05/23 16:51:03 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/23 16:51:03 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/23 15:32:46 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/22 19:12:41 | 005,069,782 | R--- | M] (Swearware) -- C:\Users\Matt\Desktop\ComboFix.exe
[2013/05/15 03:26:02 | 000,409,752 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/15 03:05:36 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/15 03:05:36 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/15 03:03:45 | 000,000,118 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2013/05/14 18:45:22 | 000,000,104 | ---- | M] () -- C:\Users\Matt\Desktop\Control Panel - Shortcut.lnk
[2013/05/14 18:12:59 | 000,002,121 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013/05/13 13:12:24 | 000,011,083 | ---- | M] () -- C:\ProgramData\dldo
[2013/05/09 08:23:07 | 000,002,828 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys
[2013/05/09 08:21:29 | 000,000,088 | RHS- | M] () -- C:\Windows\System32\E141A877EE.sys
[2013/05/08 14:30:14 | 000,002,198 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/05/08 13:17:19 | 000,056,532 | ---- | M] () -- C:\Users\Matt\Documents\cc_20130508_131709.reg
[2013/05/08 07:48:09 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/05/07 06:57:02 | 000,001,069 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/05/02 11:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

========== Files Created - No Company Name ==========

[2013/05/25 08:48:08 | 000,890,854 | ---- | C] () -- C:\Users\Matt\Desktop\SecurityCheck.exe
[2013/05/22 19:33:30 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/05/22 19:33:30 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/05/22 19:33:30 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/05/22 19:33:30 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/05/22 19:33:30 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/05/15 03:03:45 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2013/05/14 18:45:21 | 000,000,104 | ---- | C] () -- C:\Users\Matt\Desktop\Control Panel - Shortcut.lnk
[2013/05/14 18:12:59 | 000,002,133 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013/05/14 18:12:59 | 000,002,121 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013/05/08 13:17:15 | 000,056,532 | ---- | C] () -- C:\Users\Matt\Documents\cc_20130508_131709.reg
[2013/05/08 07:48:09 | 000,000,967 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/05/07 06:57:02 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/20 17:40:56 | 000,005,632 | ---- | C] () -- C:\Users\Matt\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/17 16:13:54 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012/08/17 15:01:29 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2012/08/17 15:01:29 | 000,000,088 | RHS- | C] () -- C:\Windows\System32\E141A877EE.sys
[2012/08/17 12:46:10 | 000,011,083 | ---- | C] () -- C:\ProgramData\dldo
[2012/08/17 12:45:11 | 000,348,160 | ---- | C] () -- C:\Windows\System32\dldocoin.dll
[2012/08/17 12:41:39 | 000,049,152 | ---- | C] () -- C:\Windows\System32\dldooem.dll
[2012/08/17 12:41:39 | 000,045,056 | ---- | C] () -- C:\Windows\System32\DLDOPMON.DLL
[2012/08/17 12:41:39 | 000,032,768 | ---- | C] () -- C:\Windows\System32\DLDOFXPU.DLL
[2012/08/17 12:41:39 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DLDOPMRC.DLL
[2012/08/17 12:38:53 | 000,438,272 | ---- | C] ( ) -- C:\Windows\System32\dldohcp.dll
[2012/08/17 12:38:53 | 000,348,160 | ---- | C] () -- C:\Windows\System32\dldoinst.dll
[2012/08/17 12:38:52 | 000,954,368 | ---- | C] ( ) -- C:\Windows\System32\dldousb1.dll
[2012/08/17 12:38:52 | 000,503,808 | ---- | C] () -- C:\Windows\System32\dldoutil.dll
[2012/08/17 12:38:52 | 000,360,448 | ---- | C] ( ) -- C:\Windows\System32\dldoinpa.dll
[2012/08/17 12:38:52 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\dldoiesc.dll
[2012/08/17 12:38:51 | 001,069,056 | ---- | C] ( ) -- C:\Windows\System32\dldoserv.dll
[2012/08/17 12:38:51 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dldopmui.dll
[2012/08/17 12:38:51 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\dldoprox.dll
[2012/08/17 12:38:50 | 000,569,344 | ---- | C] ( ) -- C:\Windows\System32\dldolmpm.dll
[2012/08/17 12:38:50 | 000,176,128 | ---- | C] () -- C:\Windows\System32\dldoinsb.dll
[2012/08/17 12:38:50 | 000,176,128 | ---- | C] () -- C:\Windows\System32\dldoins.dll
[2012/08/17 12:38:50 | 000,143,360 | ---- | C] () -- C:\Windows\System32\dldojswr.dll
[2012/08/17 12:38:50 | 000,106,496 | ---- | C] () -- C:\Windows\System32\dldoinsr.dll
[2012/08/17 12:38:49 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\dldohbn3.dll
[2012/08/17 12:38:49 | 000,320,752 | ---- | C] ( ) -- C:\Windows\System32\dldoih.exe
[2012/08/17 12:38:49 | 000,208,896 | ---- | C] () -- C:\Windows\System32\dldogrd.dll
[2012/08/17 12:38:48 | 000,595,184 | ---- | C] ( ) -- C:\Windows\System32\dldocoms.exe
[2012/08/17 12:38:48 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dldocub.dll
[2012/08/17 12:38:48 | 000,077,824 | ---- | C] () -- C:\Windows\System32\dldocu.dll
[2012/08/17 12:38:48 | 000,036,864 | ---- | C] () -- C:\Windows\System32\dldocur.dll
[2012/08/17 12:38:47 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\dldocomc.dll
[2012/08/17 12:38:47 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\dldocomm.dll
[2012/08/17 12:38:46 | 000,365,808 | ---- | C] ( ) -- C:\Windows\System32\dldocfg.exe
[2012/08/17 12:38:46 | 000,077,906 | ---- | C] () -- C:\Windows\System32\dldocfg.dll
[2012/08/17 09:38:10 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012/08/17 01:47:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/11/10 02:28:32 | 000,204,960 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2011/11/10 02:28:32 | 000,157,152 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2011/10/21 19:30:16 | 000,243,168 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011/09/12 23:06:18 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat

========== ZeroAccess Check ==========

[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 00:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 08:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 21:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

[fujymo]

By the way I have restarted MSSECES and it has updated.

[OCD]

Hi fujymo,

Good thing we ran that last scan, something did slip by.

=========================

1. Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Ask
• Ask.com

=========================

2. Run OTL.exe

Windows Vista and Windows 7 users Right Click and select "Run as Administrator"

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :OTL
  IE - HKCU\..\SearchScopes\{898F1C31-C646-4836-B7E4-C9068F2BF0BB}: "URL" = http://www.mysearchresults.com/search?&c=0000&t=01&q={searchTerms}
  IE - HKCU\..\SearchScopes\{A90FF914-FAF9-4116-93F9-FEA9BB38677F}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&
  FF - prefs.js..browser.search.selectedEngine: "Ask.com"
  FF - prefs.js..browser.search.order.1: "Ask.com
  [2012/09/16 16:12:07 | 000,002,299 | ---- | M] () -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\searchplugins\askcom.xml
  
  :Commands
  [purity]
  [createrestorepoint]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then re-run OTL and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

=========================

If this doesn't remove those entries we will remove them manually.

=========================

In your next post please provide the following:

• OTL fix log
• Fresh OTL.txt

[fujymo]

OCD,

The ASK and ASK.Com was not listed under the program and features. When I originally ran the code I missed the last two commands [emptytemp] [Reboot]. After I ran OTL and rebooted I noticed the emptytemp. I copied the commands section of the code and reran OTL with the commands only. Hopefully this was ok. The computer seems to be running great. Here are the OTL logs you requested:

========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{898F1C31-C646-4836-B7E4-C9068F2BF0BB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{898F1C31-C646-4836-B7E4-C9068F2BF0BB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A90FF914-FAF9-4116-93F9-FEA9BB38677F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A90FF914-FAF9-4116-93F9-FEA9BB38677F}\ not found.
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: "Ask.com removed from browser.search.order.1
C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\searchplugins\askcom.xml moved successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 05252013_115334

AFTER THIS POINT I REBOOTED AND NOTICED REST OF THE COMMANDS AND RERAN ALL OF THE COMMANDS



All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Matt
->Temp folder emptied: 1049489 bytes
->Temporary Internet Files folder emptied: 43307852 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 22290890 bytes
->Flash cache emptied: 16037 bytes

User: Mcx1-MATT-DESKTOP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 104056 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 64.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 05252013_120001

Files\Folders moved on Reboot...
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R7PJ9KEC\showthread[4].htm moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...






OTL logfile created on: 5/25/2013 12:07:25 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Matt\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.90 Gb Available Physical Memory | 63.46% Memory free
5.99 Gb Paging File | 4.92 Gb Available in Paging File | 82.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 301.17 Gb Free Space | 66.09% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.50 Gb Free Space | 55.00% Space Free | Partition Type: NTFS
Drive E: | 513.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 931.51 Gb Total Space | 895.27 Gb Free Space | 96.11% Space Free | Partition Type: NTFS

Computer Name: MATT-DESKTOP | User Name: Matt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Matt\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe (PIXELA CORPORATION)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
PRC - C:\Windows\System32\dldocoms.exe ( )
PRC - C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
PRC - C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
PRC - C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
PRC - C:\Windows\System32\PSIService.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldoscw.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldocfg.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldodatr.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\DLDOptp.dll ()
MOD - C:\Program Files\Dell 968 AIO Printer\dldocats.dll ()
MOD - C:\Program Files\PIXELA\Everio MediaBrowser\pxl_m17n_tool.dll ()


========== Services (SafeList) ==========

SRV - (SDWSCService) -- C:\Program Files\Spybot File not found
SRV - (SDUpdateService) -- C:\Program Files\Spybot File not found
SRV - (SDScannerService) -- C:\Program Files\Spybot File not found
SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AERTFilters) -- C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
SRV - (dldoCATSCustConnectService) -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\dldoserv.exe ()
SRV - (dldo_device) -- C:\Windows\System32\dldocoms.exe ( )
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()


========== Driver Services (SafeList) ==========

DRV - (FastUserSwitchingCompatibility) -- C:\Windows\system32\FastUserSwitchingCompatibilityex.dll File not found
DRV - (catchme) -- C:\Users\Matt\AppData\Local\Temp\catchme.sys File not found
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (FTSER2K) -- C:\Windows\System32\drivers\ftser2k.sys (FTDI Ltd.)
DRV - (FTDIBUS) -- C:\Windows\System32\drivers\ftdibus.sys (FTDI Ltd.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (e1express) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Matt\Desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 EC F9 57 39 BC CD 01 [binary data]
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {08F727FD-82AA-44B9-B329-0582C526FEF6}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{08F727FD-82AA-44B9-B329-0582C526FEF6}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\..\SearchScopes\{449557DB-175E-49CB-B8E6-2CAD5F2B1A34}: "URL" = http://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20121145,17118,0,18,0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.order.1: """
FF - prefs.js..keyword.URL: ""
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/08/17 12:35:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Extensions
[2013/04/30 09:13:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions
[2012/11/06 12:30:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\staged
[2009/07/13 19:11:12 | 000,004,816 | ---- | M] () (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\ojacgfbroj@ojacgfbroj.org.xpi
[2012/11/06 12:30:53 | 000,022,425 | ---- | M] () (No name found) -- C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\703d1z1b.default\extensions\staged\addon@defaulttab.com.xpi

O1 HOSTS File: ([2013/05/24 17:02:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
O4 - HKLM..\Run: [Dell 968 AIO Printer Fax Server] C:\Program Files\Dell 968 AIO Printer\fm3032.exe ()
O4 - HKLM..\Run: [dldomon.exe] C:\Program Files\Dell 968 AIO Printer\dldomon.exe ()
O4 - HKLM..\Run: [MemoryCardManager] C:\Program Files\Dell 968 AIO Printer\memcard.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Spybot-S&D Cleaning] C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4EF6EFA6-64CD-49AF-A1CD-823511F6E664}: DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{64169AB7-D8F3-421A-BBBB-26BFF19CF8A6}: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/01/10 15:11:17 | 000,000,175 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2012/06/15 17:12:01 | 000,000,000 | ---D | M] - F:\autorun -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013/05/25 11:53:34 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/05/25 08:56:20 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Matt\Desktop\OTL.exe
[2013/05/24 17:06:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013/05/24 17:06:35 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\temp
[2013/05/23 19:57:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013/05/23 15:40:23 | 000,000,000 | ---D | C] -- C:\Users\Matt\Desktop\deans
[2013/05/23 15:31:12 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013/05/22 19:33:30 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013/05/22 19:33:30 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013/05/22 19:33:30 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013/05/22 19:25:09 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/05/22 19:24:52 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013/05/22 19:19:40 | 005,069,782 | R--- | C] (Swearware) -- C:\Users\Matt\Desktop\ComboFix.exe
[2013/05/15 03:07:47 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/05/15 03:07:47 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/05/15 03:07:46 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/05/15 03:07:46 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/05/15 03:07:45 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/05/15 03:07:45 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/05/15 03:07:43 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/05/15 03:03:46 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/05/14 20:23:49 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2013/05/14 20:23:41 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2013/05/14 20:08:12 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013/05/14 20:08:12 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wwanprotdim.dll
[2013/05/14 20:08:05 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013/05/14 20:08:01 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2013/05/14 20:08:01 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2013/05/14 20:04:49 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Diagnostics
[2013/05/14 18:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013/05/14 18:12:52 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe
[2013/05/14 18:12:40 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
[2013/05/08 14:15:45 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\MFAData
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2013/05/08 14:15:45 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Avg2013
[2013/05/08 13:48:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/05/08 13:48:12 | 000,000,000 | ---D | C] -- C:\Users\Matt\Documents\ProcAlyzer Dumps
[2013/05/08 07:48:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/05/08 07:48:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/05/08 06:39:24 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\ElevatedDiagnostics
[2013/05/07 06:57:15 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Roaming\Malwarebytes
[2013/05/07 06:57:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/05/07 06:56:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/05/07 06:56:53 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013/05/07 06:56:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/05/07 06:56:35 | 000,000,000 | ---D | C] -- C:\Users\Matt\AppData\Local\Programs

========== Files - Modified Within 30 Days ==========

[2013/05/25 12:02:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/25 12:02:15 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/25 12:01:30 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 12:01:30 | 000,014,816 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/25 11:47:43 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/25 08:56:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Matt\Desktop\OTL.exe
[2013/05/25 08:48:08 | 000,890,854 | ---- | M] () -- C:\Users\Matt\Desktop\SecurityCheck.exe
[2013/05/24 17:02:15 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013/05/22 19:12:41 | 005,069,782 | R--- | M] (Swearware) -- C:\Users\Matt\Desktop\ComboFix.exe
[2013/05/15 03:26:02 | 000,409,752 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/15 03:05:36 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/15 03:05:36 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/15 03:03:45 | 000,000,118 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2013/05/14 18:45:22 | 000,000,104 | ---- | M] () -- C:\Users\Matt\Desktop\Control Panel - Shortcut.lnk
[2013/05/14 18:12:59 | 000,002,121 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013/05/13 13:12:24 | 000,011,083 | ---- | M] () -- C:\ProgramData\dldo
[2013/05/09 08:23:07 | 000,002,828 | -HS- | M] () -- C:\Windows\System32\KGyGaAvL.sys
[2013/05/09 08:21:29 | 000,000,088 | RHS- | M] () -- C:\Windows\System32\E141A877EE.sys
[2013/05/08 14:30:14 | 000,002,198 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/05/08 13:17:19 | 000,056,532 | ---- | M] () -- C:\Users\Matt\Documents\cc_20130508_131709.reg
[2013/05/08 07:48:09 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/05/07 06:57:02 | 000,001,069 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/05/02 11:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

========== Files Created - No Company Name ==========

[2013/05/25 08:48:08 | 000,890,854 | ---- | C] () -- C:\Users\Matt\Desktop\SecurityCheck.exe
[2013/05/22 19:33:30 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013/05/22 19:33:30 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013/05/22 19:33:30 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013/05/22 19:33:30 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013/05/22 19:33:30 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013/05/15 03:03:45 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2013/05/14 18:45:21 | 000,000,104 | ---- | C] () -- C:\Users\Matt\Desktop\Control Panel - Shortcut.lnk
[2013/05/14 18:12:59 | 000,002,133 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013/05/14 18:12:59 | 000,002,121 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2013/05/08 13:17:15 | 000,056,532 | ---- | C] () -- C:\Users\Matt\Documents\cc_20130508_131709.reg
[2013/05/08 07:48:09 | 000,000,967 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/05/07 06:57:02 | 000,001,069 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/20 17:40:56 | 000,005,632 | ---- | C] () -- C:\Users\Matt\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/17 16:13:54 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012/08/17 15:01:29 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2012/08/17 15:01:29 | 000,000,088 | RHS- | C] () -- C:\Windows\System32\E141A877EE.sys
[2012/08/17 12:46:10 | 000,011,083 | ---- | C] () -- C:\ProgramData\dldo
[2012/08/17 12:45:11 | 000,348,160 | ---- | C] () -- C:\Windows\System32\dldocoin.dll
[2012/08/17 12:41:39 | 000,049,152 | ---- | C] () -- C:\Windows\System32\dldooem.dll
[2012/08/17 12:41:39 | 000,045,056 | ---- | C] () -- C:\Windows\System32\DLDOPMON.DLL
[2012/08/17 12:41:39 | 000,032,768 | ---- | C] () -- C:\Windows\System32\DLDOFXPU.DLL
[2012/08/17 12:41:39 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DLDOPMRC.DLL
[2012/08/17 12:38:53 | 000,438,272 | ---- | C] ( ) -- C:\Windows\System32\dldohcp.dll
[2012/08/17 12:38:53 | 000,348,160 | ---- | C] () -- C:\Windows\System32\dldoinst.dll
[2012/08/17 12:38:52 | 000,954,368 | ---- | C] ( ) -- C:\Windows\System32\dldousb1.dll
[2012/08/17 12:38:52 | 000,503,808 | ---- | C] () -- C:\Windows\System32\dldoutil.dll
[2012/08/17 12:38:52 | 000,360,448 | ---- | C] ( ) -- C:\Windows\System32\dldoinpa.dll
[2012/08/17 12:38:52 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\dldoiesc.dll
[2012/08/17 12:38:51 | 001,069,056 | ---- | C] ( ) -- C:\Windows\System32\dldoserv.dll
[2012/08/17 12:38:51 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dldopmui.dll
[2012/08/17 12:38:51 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\dldoprox.dll
[2012/08/17 12:38:50 | 000,569,344 | ---- | C] ( ) -- C:\Windows\System32\dldolmpm.dll
[2012/08/17 12:38:50 | 000,176,128 | ---- | C] () -- C:\Windows\System32\dldoinsb.dll
[2012/08/17 12:38:50 | 000,176,128 | ---- | C] () -- C:\Windows\System32\dldoins.dll
[2012/08/17 12:38:50 | 000,143,360 | ---- | C] () -- C:\Windows\System32\dldojswr.dll
[2012/08/17 12:38:50 | 000,106,496 | ---- | C] () -- C:\Windows\System32\dldoinsr.dll
[2012/08/17 12:38:49 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\dldohbn3.dll
[2012/08/17 12:38:49 | 000,320,752 | ---- | C] ( ) -- C:\Windows\System32\dldoih.exe
[2012/08/17 12:38:49 | 000,208,896 | ---- | C] () -- C:\Windows\System32\dldogrd.dll
[2012/08/17 12:38:48 | 000,595,184 | ---- | C] ( ) -- C:\Windows\System32\dldocoms.exe
[2012/08/17 12:38:48 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dldocub.dll
[2012/08/17 12:38:48 | 000,077,824 | ---- | C] () -- C:\Windows\System32\dldocu.dll
[2012/08/17 12:38:48 | 000,036,864 | ---- | C] () -- C:\Windows\System32\dldocur.dll
[2012/08/17 12:38:47 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\dldocomc.dll
[2012/08/17 12:38:47 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\dldocomm.dll
[2012/08/17 12:38:46 | 000,365,808 | ---- | C] ( ) -- C:\Windows\System32\dldocfg.exe
[2012/08/17 12:38:46 | 000,077,906 | ---- | C] () -- C:\Windows\System32\dldocfg.dll
[2012/08/17 09:38:10 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2012/08/17 01:47:06 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/11/10 02:28:32 | 000,204,960 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2011/11/10 02:28:32 | 000,157,152 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2011/10/21 19:30:16 | 000,243,168 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011/09/12 23:06:18 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat

========== ZeroAccess Check ==========

[2009/07/14 00:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 00:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 08:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 21:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

[OCD]

Hi fujymo,

Your log appears to be clean.

We have a few items to take care of before we get to the All Clean Speech.

=========================

You appear to have used AVG2013 at on time. Let's remove this remnant before we continue.

=========================

1. Delete a File/Folder

Using Windows Explorer (Windows Key + E), locate the following files/folders, and DELETE them (if still present):

• c:\users\Matt\AppData\Local\Avg2013 <-- delete the folder

Exit Explorer

=========================

2. Microsoft Security Essentials

Caution: On Access scanning disabled!

Access the Settings portion in Microsoft Security Essentials
Open M.S.E. > Settings > Real Time Protection > Make sure the box is ticked

=========================

3 Uninstall Combofix
The following will implement important cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bold text into the Run box and click OK:

ComboFix /Uninstall
(Note the space between the ..X and the /U, it needs to be there.)



=========================

4. Clean up with OTL:

• Right-click OTL.exe select "Run as Administrator" to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

=========================

5. You can now delete any tools and/or logs remaining on your desktop.

=========================

6. Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Java 7 Update 7

=========================

7. Update Java

• Get the current version of Java (Version 7 Update 21) by going to http://java.com/en/download/installed.jsp
• Select the Verify Java Version button and follow the onscreen instructions to update if necessary.

=========================

8. Disable Java in Web Browsers

Even though I just had you get the latest version of Java, there is a vulnerability with regards to Java and web browsers. Therefore, we recommend to disable java in web browsers.
More information can be found here: http://www.techsupportforum.com/foru...rs-683721.html

• Click on the Start button and then click on the Control Panel option.
• In the Control Panel Search enter Java Control Panel.
• Click on the Java icon to open the Java Control Panel.

Disable Java through the Java Control Panel

• In the Java Control Panel, click on the Security tab.
• Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser.
• Click Apply. When the Windows User Account Control (UAC) dialog appears, allow permissions to make the changes.
• Click OK in the Java Plug-in confirmation window.
• Restart the browser for changes to take effect.

=========================

6. Spybot - Search & Destroy's Tea Timer

We need to Enable Spybot - Search & Destroy's Tea Timer. Please follow the instruction below.

• Locate your copy of Spybot - Search & Destroy's and open it.
• In the menu bar at the top select "Mode", then select "Advanced".
• In the left hand menu expand the "Tools" menu.
• Select "Resident", then place a check mark for "Resident Tea Timer"
• Then exit the program by clicking "File" then select "Exit"

=========================

With the above items taken care of let's move on to the All Clean part of the process.

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

• NoScript
• AdBlockPlus

Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

Free Anti-Virus

• Avast Free Antivirus
• Avira Free Antivirus 2013
• PC Tools AntiVirus Free
• Ad-Aware Free Antivirus +

Free Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here.

• Online Armor Free
• Agnitum Outpost Firewall Free
• Comodo Firewall

Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

[fujymo]

OCD,

I am very satisfied and everything appears to be working great.

Thanks,

Fujymo