Page 1 of 4 1234 LastLast
Results 1 to 10 of 35

Thread: Key-Find has high Jacked my Browser

  1. #1
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default Key-Find has high Jacked my Browser

    Hi, I was trying to help a friend find a website FreeUSATV,com I clicked to do a download and the trouble begin. My browser got high jacked with Key-finder as my home page I have Google Chrome as a browser. I went to the settings and It's the pages I set it for but it opens up Key-Finder when I open the browser. I'm sure it has spyware. Can please help!

    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.51.2
    Run by kenneth at 10:48:03 on 2014-04-02
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.235 [GMT -4:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .
    ============== Running Processes ================
    .
    C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    c:\program files\idt\wdm\STacSV.exe
    C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
    C:\Program Files\DefaultTab\DefaultTabSearch.exe
    C:\Documents and Settings\kenneth\Application Data\DefaultTab\DefaultTab\DTUpdate.exe
    C:\Program Files\Java\jre7\bin\jqs.exe
    C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Google\Update\1.3.23.9\GoogleCrashHandler.exe
    C:\Program Files\Fortunitas\updateFortunitas.exe
    C:\Program Files\Fortunitas\bin\utilFortunitas.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
    C:\program files\real\realplayer\update\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\kenneth\Application Data\Dropbox\bin\Dropbox.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WeatherAlerts.exe
    C:\Program Files\Fortunitas\bin\FilterApp_C.exe
    C:\Program Files\Fortunitas\bin\XTLSApp.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\Program Files\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\WINDOWS\system32\svchost.exe -k NetworkService
    C:\WINDOWS\system32\svchost.exe -k LocalService
    C:\WINDOWS\system32\svchost.exe -k LocalService
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.key-find.com/?type=hp&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144
    uSearch Bar = www.bing.com
    uSearch Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
    uDefault_Page_URL = hxxp://www.key-find.com/?type=hp&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144
    mStart Page = hxxp://www.key-find.com/?type=hp&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144
    mSearch Page = hxxp://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    mDefault_Page_URL = hxxp://www.key-find.com/?type=hp&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144
    mDefault_Search_URL = hxxp://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe"
    mSearchAssistant = hxxp://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    mCustomizeSearch = hxxp://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    uURLSearchHooks: {ec966aaa-1510-4c02-8eb0-b42ad0c25e8b} - <orphaned>
    uURLSearchHooks: {eef3855c-fc2d-41e6-8d91-d368f51b3055} - <orphaned>
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
    BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
    BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - c:\documents and settings\kenneth\application data\defaulttab\defaulttab\DefaultTabBHO.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.9012.1008\swg.dll
    BHO: Fortunitas: {c6f3fc7b-d607-44ec-9caf-2a41d547137f} - c:\program files\fortunitas\Fortunitasbho.dll
    BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0560.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
    BHO: {ec966aaa-1510-4c02-8eb0-b42ad0c25e8b} - <orphaned>
    BHO: {eef3855c-fc2d-41e6-8d91-d368f51b3055} - <orphaned>
    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\program files\msn\toolbar\3.0.0560.0\msneshellx.dll
    TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
    mRun: [Auction Auto Bidder] <no file>
    dRun: [SearchProtect] c:\windows\system32\config\systemprofile\application data\searchprotect\bin\cltmng.exe
    StartupFolder: c:\docume~1\kenneth\startm~1\programs\startup\deskto~1.lnk - c:\documents and settings\kenneth\local settings\application data\weatheralerts\DesktopWeatherAlertsApp.exe
    StartupFolder: c:\docume~1\kenneth\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\kenneth\application data\dropbox\bin\Dropbox.exe
    StartupFolder: c:\docume~1\kenneth\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\kenneth\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
    StartupFolder: c:\docume~1\kenneth\startm~1\programs\startup\weathe~1.lnk - c:\documents and settings\kenneth\local settings\application data\weatheralerts\WeatherAlerts.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} - hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
    TCP: NameServer = 192.168.1.254
    TCP: Interfaces\{D4397C3C-4801-45DB-97C8-078873CCB5F1} : DHCPNameServer = 192.168.1.254
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\33.0.1750.154\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&CUI=UN16857030743449312&UM=2&SearchSource=3&q={searchTerms}
    FF - prefs.js: browser.search.selectedEngine - key-find
    FF - prefs.js: browser.startup.homepage - hxxp://www.key-find.com/?type=hp&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144
    FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&SearchSource=2&CUI=UN16857030743449312&UM=2&q=
    FF - component: c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\extensions\appbar@alot.com\components\AlotXpcom.dll
    FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
    FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
    FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
    FF - plugin: c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\npdlplugin.dll
    FF - plugin: c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\extensions\{ec966aaa-1510-4c02-8eb0-b42ad0c25e8b}\plugins\np-mswmp.dll
    FF - plugin: c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\extensions\{ec966aaa-1510-4c02-8eb0-b42ad0c25e8b}\plugins\npConduitFirefoxPlugin.dll
    FF - plugin: c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\extensions\{f0e59437-6148-4a98-b0a6-60d557ef57f4}\plugins\np-mswmp.dll
    FF - plugin: c:\documents and settings\kenneth\application data\mozilla\firefox\profiles\ytasw4hq.default\extensions\{f0e59437-6148-4a98-b0a6-60d557ef57f4}\plugins\npConduitFirefoxPlugin.dll
    FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre7\bin\npjpi170_25.dll
    FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
    FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\windows\system32\npdeployJava1.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Default Tab: - %profile%\extensions\addon@defaulttab.com
    FF - Ext: ALOT Appbar: - %profile%\extensions\appbar@alot.com
    FF - Ext: Vafmusic4 : {ec966aaa-1510-4c02-8eb0-b42ad0c25e8b} - %profile%\extensions\{ec966aaa-1510-4c02-8eb0-b42ad0c25e8b}
    FF - Ext: WhiteSmoke B : {f0e59437-6148-4a98-b0a6-60d557ef57f4} - %profile%\extensions\{f0e59437-6148-4a98-b0a6-60d557ef57f4}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: avast! Online Security: - c:\program files\avast software\avast\webrep\FF
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: extensions.autoDisableScopes - 0
    FF - user.js: extensions.shownSelectionUI - true
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2013-5-16 49944]
    R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [2013-5-16 180760]
    R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-8-24 21488]
    R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-8-24 15856]
    R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2009-7-2 103792]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-5-16 776976]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-5-16 411552]
    R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2009-8-24 25584]
    R1 tStLibG;tStLibG;c:\windows\system32\drivers\tStLibG.sys [2014-4-1 55232]
    R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\roxio\backontrack\disaster recovery\SaibSVC.exe [2009-6-2 457200]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswmonflt.sys [2013-5-16 67824]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2014-4-1 50344]
    R2 BOTService;BOTService;c:\program files\roxio\backontrack\instant restore\BOTService.exe [2009-7-9 199152]
    R2 DefaultTabSearch;DefaultTabSearch;c:\program files\defaulttab\DefaultTabSearch.exe [2013-12-19 574464]
    R2 DefaultTabUpdate;DefaultTabUpdate;c:\documents and settings\kenneth\application data\defaulttab\defaulttab\DTUpdate.exe [2013-6-1 107520]
    R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader\rndlresolversvc.exe [2013-8-14 39056]
    R2 Update Fortunitas;Update Fortunitas;c:\program files\fortunitas\updateFortunitas.exe [2014-3-28 350496]
    R2 Util Fortunitas;Util Fortunitas;c:\program files\fortunitas\bin\utilFortunitas.exe [2014-3-31 350496]
    R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-8-24 113664]
    R3 Cam3820;Cam3820 PC Camera Driver;c:\windows\system32\drivers\cam3820a.sys [2009-6-18 308608]
    R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [2009-3-31 39424]
    S2 ca82e1a5;Optimizer Pro Crash Monitor;c:\windows\system32\rundll32.exe [2008-4-15 33280]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 bcm;WiMAX Network Adapter;c:\windows\system32\drivers\drxvi314.sys [2009-11-3 282112]
    S3 bcmbusctr;WiMAX Bus Driver;c:\windows\system32\drivers\BcmBusCtr.sys [2009-11-3 51712]
    S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\rts5121.sys --> c:\windows\system32\drivers\RTS5121.sys [?]
    S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\drivers\rts516xir.sys --> c:\windows\system32\drivers\Rts516xIR.sys [?]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 754856]
    .
    =============== Created Last 30 ================
    .
    2014-04-01 04:58:00 -------- d-----w- c:\documents and settings\kenneth\application data\DropboxMaster
    2014-04-01 04:57:28 -------- d-----w- c:\program files\Dropbox
    2014-04-01 04:53:21 -------- d-----w- c:\documents and settings\kenneth\application data\Dropbox
    2014-04-01 04:32:45 43152 ----a-w- c:\windows\avastSS.scr
    2014-04-01 04:09:40 55232 ----a-w- c:\windows\system32\drivers\tStLibG.sys
    2014-03-31 03:05:30 -------- d-----w- c:\program files\OPTIMIZER PRO
    2014-03-31 03:05:21 -------- d-----w- c:\documents and settings\kenneth\application data\key-find
    2014-03-31 03:03:54 -------- d-----w- c:\documents and settings\kenneth\local settings\application data\Local_Weather_LLC
    2014-03-31 03:03:47 -------- d-----w- c:\program files\Fortunitas
    2014-03-31 03:02:42 -------- d-----w- c:\documents and settings\kenneth\local settings\application data\WeatherAlerts
    2014-03-18 10:43:17 13312 ----a-w- c:\windows\system32\xp_eos.exe
    2014-03-18 10:43:17 13312 ------w- c:\windows\system32\dllcache\xp_eos.exe
    .
    ==================== Find3M ====================
    .
    2014-04-01 04:32:49 180760 ----a-w- c:\windows\system32\drivers\aswVmm.sys
    2014-04-01 04:32:48 776976 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2014-04-01 04:32:47 67824 ----a-w- c:\windows\system32\drivers\aswmonflt.sys
    2014-04-01 04:32:47 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
    2014-03-12 11:29:12 692616 -c--a-w- c:\windows\system32\FlashPlayerApp.exe
    2014-03-12 11:29:10 71048 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2014-02-24 11:46:36 920064 ----a-w- c:\windows\system32\wininet.dll
    2014-02-24 11:45:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2014-02-24 11:45:57 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2014-02-24 11:45:42 18944 ----a-w- c:\windows\system32\corpol.dll
    2014-02-24 10:54:21 385024 ----a-w- c:\windows\system32\html.iec
    2014-02-07 02:01:37 1879040 ----a-w- c:\windows\system32\win32k.sys
    2014-02-05 08:55:04 562688 ----a-w- c:\windows\system32\qedit.dll
    2014-02-03 18:52:32 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2014-02-03 18:52:31 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2014-02-03 18:41:34 813232 -c--a-w- c:\program files\RealPlayer.exe
    2014-01-04 03:13:05 420864 ----a-w- c:\windows\system32\vbscript.dll
    2013-05-16 13:33:09 117478104 -c--a-w- c:\program files\avast_free_antivirus_setup.exe
    2013-05-04 15:08:38 411003 -c--a-w- c:\program files\PinBot-v1-3-Setup.exe
    2013-01-12 13:19:09 40437664 -c--a-w- c:\program files\QuickTimeInstaller.exe
    2012-09-12 16:34:28 5433105 -c--a-w- c:\program files\hifsetup.exe
    2012-08-24 05:47:54 26822384 -c--a-w- c:\program files\QuickBooksInstallDiagnosticTool.exe
    2012-08-16 06:33:34 1561792 -c--a-w- c:\program files\gimp_installer_2068.exe
    2012-08-12 07:41:59 352968 -c--a-w- c:\program files\SoftonicDownloader_for_mobipocket-reader-desktop.exe
    2012-08-12 06:45:24 10606592 -c--a-w- c:\program files\creator.msi
    2012-08-09 05:32:32 6785285 -c--a-w- c:\program files\kompozer-0.8b3.en-US.win32.exe
    2012-07-24 06:49:27 52249417 -c--a-w- c:\program files\ListingFactory_2012_Setup.exe
    2012-07-23 15:02:54 609436 -c--a-w- c:\program files\spelloe_setup.exe
    2012-07-10 16:40:28 1982061 -c--a-w- c:\program files\Auctonic.exe
    2012-07-05 16:00:47 18117717 -c--a-w- c:\program files\GimPhoto-1.4.3_setup.exe
    2012-05-10 06:53:20 151801119 -c--a-w- c:\program files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_en-US.exe
    2012-05-10 06:40:00 1247056 -c--a-w- c:\program files\wlsetup-web.exe
    2012-05-10 05:29:01 1810833 -c--a-w- c:\program files\HCP.exe
    2011-01-15 05:53:40 3834294 ----a-w- c:\program files\Twitter Marketing Bot.exe
    .
    ============= FINISH: 10:49:37.58 ===============

    aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
    Run date: 2014-04-02 10:57:06
    -----------------------------
    10:57:06.752 OS Version: Windows 5.1.2600 Service Pack 3
    10:57:06.752 Number of processors: 2 586 0x1C02
    10:57:06.752 ComputerName: PC801713467250 UserName: kenneth
    10:57:07.549 Initialize success
    10:57:12.690 AVAST engine defs: 14040200
    10:58:41.208 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
    10:58:41.208 Disk 0 Vendor: SAMSUNG_ HH10 Size: 152627MB BusType: 3
    10:58:41.505 Disk 0 MBR read successfully
    10:58:41.521 Disk 0 MBR scan
    10:58:41.536 Disk 0 Windows VISTA default MBR code
    10:58:41.567 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152616 MB offset 2048
    10:58:41.630 Disk 0 scanning sectors +312560640
    10:58:41.724 Disk 0 scanning C:\WINDOWS\system32\drivers
    10:58:59.709 Service scanning
    10:59:17.865 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
    10:59:23.616 Modules scanning
    10:59:34.382 Disk 0 trace - called modules:
    10:59:34.429
    10:59:35.163 AVAST engine scan C:\WINDOWS
    10:59:54.726 AVAST engine scan C:\WINDOWS\system32
    11:03:39.905 AVAST engine scan C:\WINDOWS\system32\drivers
    11:04:02.812 AVAST engine scan C:\Documents and Settings\kenneth
    11:10:40.480 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\MBR.dat"
    11:10:40.590 The log file has been saved successfully to "C:\Documents and Settings\kenneth\Desktop\aswMBR.txt"


    I hope I did this right! Thanks for your help in advance!

  2. #2
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default



    Sorry your having problems, lets try a few things.

    -AdwCleaner-by Xplode

    Click on this link to download : ADWCleaner
    Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

    Do not click on any links in the top Advertisment.



    • Close all open programs and internet browsers.
    • Double click on AdwCleaner.exe to run the tool.
    • Click on Scan.
    • After the scan is complete click on "Clean"
    • Confirm each time with Ok.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the content of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.






    Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  3. #3
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default Here are the logs

    # AdwCleaner v3.023 - Report created 03/04/2014 at 01:32:12
    # Updated 01/04/2014 by Xplode
    # Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
    # Username : kenneth - PC801713467250
    # Running from : C:\Documents and Settings\kenneth\Desktop\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****

    [#] Service Deleted : ca82e1a5
    [#] Service Deleted : DefaultTabSearch
    [#] Service Deleted : DefaultTabUpdate

    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\optimizer pro v3.2
    Folder Deleted : C:\Program Files\Conduit
    Folder Deleted : C:\Program Files\DefaultTab
    Folder Deleted : C:\Program Files\LyricsSpeaker
    Folder Deleted : C:\Program Files\Optimizer Pro
    Folder Deleted : C:\Program Files\SingAlong
    Folder Deleted : C:\Program Files\MixiDJ_V37
    Folder Deleted : C:\Program Files\Vafmusic4
    Folder Deleted : C:\Documents and Settings\kenneth\Local Settings\Application Data\Conduit
    Folder Deleted : C:\Documents and Settings\kenneth\Local Settings\Application Data\MixiDJ_V37
    Folder Deleted : C:\Documents and Settings\kenneth\Local Settings\Application Data\Vafmusic4
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\DefaultTab
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\PriceGong
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\SearchProtect
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\alot-appbar
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Smartbar
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\CT3302997
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\CT3298573
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\CT3279141
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\{F0E59437-6148-4A98-B0A6-60D557EF57F4}
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\addon@defaulttab.com
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\appbar@alot.com
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\quick_start@gmail.com
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\{ec966aaa-1510-4c02-8eb0-b42ad0c25e8b}
    Folder Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\Extensions\{eef3855c-fc2d-41e6-8d91-d368f51b3055}
    [!] Folder Deleted : C:\Documents and Settings\LocalService\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
    [!] Folder Deleted : C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
    File Deleted : C:\alotserviceruntime.log
    File Deleted : C:\Documents and Settings\All Users\Desktop\eBay.lnk
    File Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\eBay.lnk
    File Deleted : C:\DOCUME~1\kenneth\LOCALS~1\Temp\Uninstall.exe
    File Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\searchplugins\Conduit.xml
    File Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\searchplugins\search.xml
    File Deleted : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\user.js

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com]
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
    Key Deleted : HKCU\Toolbar
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser
    Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser.1
    Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
    Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
    Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
    Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298573
    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3302997
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{38495740-0035-4471-851E-F5BBB86AB085}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FEB62B15-CC00-4736-AAEC-BA046C9DFF73}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEF3855C-FC2D-41E6-8D91-D368F51B3055}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6492E171-2427-4932-B414-33574A089F5E}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEF3855C-FC2D-41E6-8D91-D368F51B3055}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6492E171-2427-4932-B414-33574A089F5E}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C84BABA-BF9D-4E42-A684-5288580631D2}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0D057E38-1E36-47AA-B86F-297F71B9FE0A}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F79395C3-8B78-403E-8953-4C242D3A3C62}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3CF028A3-25EE-4A0F-A414-F0F935CCCACA}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DAD0840B-6432-4C32-BC5A-757FDC153140}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D6CA6011-7554-4A76-9526-C29DB405CD6C}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A531D99C-5A22-449B-83DA-872725C6D0ED}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEF3855C-FC2D-41E6-8D91-D368F51B3055}]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEF3855C-FC2D-41E6-8D91-D368F51B3055}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEF3855C-FC2D-41E6-8D91-D368F51B3055}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}]
    Key Deleted : HKCU\Software\Conduit
    Key Deleted : HKCU\Software\ConduitSearchScopes
    Key Deleted : HKCU\Software\Default Tab
    Key Deleted : HKCU\Software\DefaultTab
    Key Deleted : HKCU\Software\lyricsspeaker
    Key Deleted : HKCU\Software\Optimizer Pro
    Key Deleted : HKCU\Software\PriceGong
    Key Deleted : HKCU\Software\SearchProtect
    Key Deleted : HKCU\Software\SmartBar
    Key Deleted : HKCU\Software\Softonic
    Key Deleted : HKCU\Software\MixiDJ_V37
    Key Deleted : HKCU\Software\Vafmusic4
    Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
    Key Deleted : HKLM\Software\Conduit
    Key Deleted : HKLM\Software\Default Tab
    Key Deleted : HKLM\Software\DefaultTab
    Key Deleted : HKLM\Software\SearchProtect
    Key Deleted : HKLM\Software\MixiDJ_V37
    Key Deleted : HKLM\Software\Vafmusic4
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MixiDJ_V37 Toolbar
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vafmusic4 Toolbar
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab Chrome
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTab
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MixiDJ_V37 Toolbar
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Vafmusic4 Toolbar
    Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

    ***** [ Browsers ] *****

    -\\ Internet Explorer v8.0.6001.18702


    -\\ Mozilla Firefox v3.6.3 (en-US)

    [ File : C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\prefs.js ]

    Line Deleted : user_pref("CT3279141.1000082.isPlayDisplay", "true");
    Line Deleted : user_pref("CT3279141.1000082.state", "{\"state\":\"stopped\",\"text\":\"1.FM (Cou...\",\"description\":\"1.FM (Country)\",\"url\":\"hxxp://1.fm/wm/energycountry32k.asx\"}");
    Line Deleted : user_pref("CT3279141.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
    Line Deleted : user_pref("CT3279141.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
    Line Deleted : user_pref("CT3279141.FF19Solved", "true");
    Line Deleted : user_pref("CT3279141.FirstTime", "true");
    Line Deleted : user_pref("CT3279141.FirstTimeFF3", "true");
    Line Deleted : user_pref("CT3279141.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279141&SearchSource=2&CUI=UN20580107978990285&UM=UM_ID&q=");
    Line Deleted : user_pref("CT3279141.UserID", "UN20580107978990285");
    Line Deleted : user_pref("CT3279141.User_UniqueID.enc", "YjdmYmQzZjMtMjM2ZC04MTgzLWVkNzgtNjM2ZTA2OTg3ODg5");
    Line Deleted : user_pref("CT3279141.autoDisableScopes", -1);
    Line Deleted : user_pref("CT3279141.browser.search.defaultthis.engineName", "true");
    Line Deleted : user_pref("CT3279141.defaultSearch", "true");
    Line Deleted : user_pref("CT3279141.embeddedsData", "[{\"appId\":\"130028020976478709\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...]
    Line Deleted : user_pref("CT3279141.enableAlerts", "always");
    Line Deleted : user_pref("CT3279141.enableFix404ByUser", "TRUE");
    Line Deleted : user_pref("CT3279141.enableSearchFromAddressBar", "true");
    Line Deleted : user_pref("CT3279141.enlargeSearchBox", "{\"enabled\":true,\"maxWidth\":1000,\"minWidth\":250,\"width\":500}");
    Line Deleted : user_pref("CT3279141.firstTimeDialogOpened", "true");
    Line Deleted : user_pref("CT3279141.fixPageNotFoundError", "true");
    Line Deleted : user_pref("CT3279141.fixPageNotFoundErrorByUser", "true");
    Line Deleted : user_pref("CT3279141.fixUrls", true);
    Line Deleted : user_pref("CT3279141.hxxp___api31_starwebnet_com.pid2.enc", "NTYzMmRmY2UtYmVkZS1iNDNkLThjYWEtOWI1MjBjMGVjNDkw");
    Line Deleted : user_pref("CT3279141.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOltdLCJhY3Rpb25zIjpbXX0=");
    Line Deleted : user_pref("CT3279141.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoiYXBpLmpvbGx5d2FsbGV0LmNvbS9hZmZpbGlhdGUvaW5pdCIsInF1ZXJ5VXJsIjoiYXBpLmpvbGx5d2FsbGV0LmNvbS9hZmZpbGlh[...]
    Line Deleted : user_pref("CT3279141.hxxp___toolbar_jollywallet_com_tlb_2.jw_token.enc", "ZWVkNTczMWMtYThhYS1hNjE4LWQ5MWItOWZiZjdkMTQzMmYz");
    Line Deleted : user_pref("CT3279141.hxxp___toolbar_jollywallet_com_tlb_2.key_list_id.enc", "MjAxMjA4MDItMDAw");
    Line Deleted : user_pref("CT3279141.hxxp___www_toolbar_ads_com_internetapp.APP_WIN_FEATURES.enc", "");
    Line Deleted : user_pref("CT3279141.installDate", "26/2/2013 1:19:49");
    Line Deleted : user_pref("CT3279141.installId", "9818");
    Line Deleted : user_pref("CT3279141.installType", "conduitnsisintegration");
    Line Deleted : user_pref("CT3279141.isCheckedStartAsHidden", true);
    Line Deleted : user_pref("CT3279141.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
    Line Deleted : user_pref("CT3279141.isFirstTimeToolbarLoading", "false");
    Line Deleted : user_pref("CT3279141.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
    Line Deleted : user_pref("CT3279141.key_user_agree_ia12.enc", "MQ==");
    Line Deleted : user_pref("CT3279141.key_wellcome_ia12.enc", "MQ==");
    Line Deleted : user_pref("CT3279141.keyword", "true");
    Line Deleted : user_pref("CT3279141.lastVersion", "10.14.65.43");
    Line Deleted : user_pref("CT3279141.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
    Line Deleted : user_pref("CT3279141.migrateAppsAndComponents", true);
    Line Deleted : user_pref("CT3279141.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT3279141%26SearchSource%3D13%26CUI%3DUN20580107978990285\",\"EB_MAIN_FRAME_TITLE\":\[...]
    Line Deleted : user_pref("CT3279141.openThankYouPage", "false");
    Line Deleted : user_pref("CT3279141.openUninstallPage", "true");
    Line Deleted : user_pref("CT3279141.revertSettingsEnabled", "true");
    Line Deleted : user_pref("CT3279141.search.searchAppId", "130028020976478709");
    Line Deleted : user_pref("CT3279141.search.searchCount", "0");
    Line Deleted : user_pref("CT3279141.searchFromAddressBarEnabledByUser", "true");
    Line Deleted : user_pref("CT3279141.searchInNewTabEnabledByUser", "true");
    Line Deleted : user_pref("CT3279141.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
    Line Deleted : user_pref("CT3279141.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3279141\"}");
    Line Deleted : user_pref("CT3279141.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://WhiteSmokeB.OurToolbar.com//xpi\"}");
    Line Deleted : user_pref("CT3279141.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"WhiteSmoke B\"}");
    Line Deleted : user_pref("CT3279141.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1376020390614");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_appsMetadata_lastUpdate", "1376020393840");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1376020391297");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_location_lastUpdate", "1376020386296");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_login_10.14.65.43_lastUpdate", "1376020404507");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1376020390747");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_searchAPI_lastUpdate", "1376020386275");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_serviceMap_lastUpdate", "1376020384946");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_setupAPI_lastUpdate", "1376020391701");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_toolbarContextMenu_lastUpdate", "1376020391057");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_toolbarSettings_lastUpdate", "1376020386463");
    Line Deleted : user_pref("CT3279141.serviceLayer_services_translation_lastUpdate", "1376020390509");
    Line Deleted : user_pref("CT3279141.settingsINI", true);
    Line Deleted : user_pref("CT3279141.shouldFirstTimeDialog", "false");
    Line Deleted : user_pref("CT3279141.smartbar.CTID", "CT3279141");
    Line Deleted : user_pref("CT3279141.smartbar.Uninstall", "0");
    Line Deleted : user_pref("CT3279141.smartbar.homepage", true);
    Line Deleted : user_pref("CT3279141.smartbar.toolbarName", "WhiteSmoke B ");
    Line Deleted : user_pref("CT3279141.startPage", "true");
    Line Deleted : user_pref("CT3279141_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376020360850,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
    Line Deleted : user_pref("CT3298573.FF19Solved", "true");
    Line Deleted : user_pref("CT3298573.UserID", "UN16857030743449312");
    Line Deleted : user_pref("CT3298573.browser.search.defaultthis.engineName", "true");
    Line Deleted : user_pref("CT3298573.fullUserID", "UN16857030743449312.IN.20130810114936");
    Line Deleted : user_pref("CT3298573.installDate", "10/08/2013 11:49:34");
    Line Deleted : user_pref("CT3298573.installSessionId", "{00CCA5C0-94D1-4FEA-9B40-A571D84958BA}");
    Line Deleted : user_pref("CT3298573.installSp", "TRUE");
    Line Deleted : user_pref("CT3298573.installerVersion", "1.5.4.5");
    Line Deleted : user_pref("CT3298573.keyword", "true");
    Line Deleted : user_pref("CT3298573.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3279141&octid=CT3279141&SearchSource=61&CUI=UN20580107978990285&UM=UM_ID&UP=SPBF8E644F-74BF-47DE-AB7F-4C1747C24738");
    Line Deleted : user_pref("CT3298573.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3302997&SearchSource=2&CUI=UN34716549461819022&UM=2&q=");
    Line Deleted : user_pref("CT3298573.originalSearchEngine", "Vafmusic4 Customized Web Search");
    Line Deleted : user_pref("CT3298573.originalSearchEngineName", "");
    Line Deleted : user_pref("CT3298573.searchRevert", "false");
    Line Deleted : user_pref("CT3298573.searchUserMode", "2");
    Line Deleted : user_pref("CT3298573.smartbar.homepage", "true");
    Line Deleted : user_pref("CT3298573.versionFromInstaller", "10.16.9.6");
    Line Deleted : user_pref("CT3298573.xpeMode", "0");
    Line Deleted : user_pref("CT3302997.FF19Solved", "true");
    Line Deleted : user_pref("CT3302997.FirstTime", "true");
    Line Deleted : user_pref("CT3302997.FirstTimeFF3", "true");
    Line Deleted : user_pref("CT3302997.UserID", "UN34716549461819022");
    Line Deleted : user_pref("CT3302997.addressUrlXPETakeover", "true");
    Line Deleted : user_pref("CT3302997.autoDisableScopes", 10);
    Line Deleted : user_pref("CT3302997.browser.search.defaultthis.engineName", "true");
    Line Deleted : user_pref("CT3302997.defaultSearch", "true");
    Line Deleted : user_pref("CT3302997.defaultSearchXPETakeover", "true");
    Line Deleted : user_pref("CT3302997.enableAlerts", "true");
    Line Deleted : user_pref("CT3302997.enableFix404ByUser", "TRUE");
    Line Deleted : user_pref("CT3302997.enableSearchFromAddressBar", "true");
    Line Deleted : user_pref("CT3302997.fixPageNotFoundError", "true");
    Line Deleted : user_pref("CT3302997.fixPageNotFoundErrorByUser", "true");
    Line Deleted : user_pref("CT3302997.fixUrls", true);
    Line Deleted : user_pref("CT3302997.installDate", "1/6/2013 2:50:20");
    Line Deleted : user_pref("CT3302997.installId", "stub.exe");
    Line Deleted : user_pref("CT3302997.installSessionId", "{9A9C510D-8C3C-4DE5-94EA-8F0FDC35CEF3}");
    Line Deleted : user_pref("CT3302997.installSp", "TRUE");
    Line Deleted : user_pref("CT3302997.installType", "conduitnsisintegration");
    Line Deleted : user_pref("CT3302997.installerVersion", "1.4.2.3");
    Line Deleted : user_pref("CT3302997.isCheckedStartAsHidden", true);
    Line Deleted : user_pref("CT3302997.keyword", "true");
    Line Deleted : user_pref("CT3302997.lastVersion", "10.16.2.9");
    Line Deleted : user_pref("CT3302997.migrateAppsAndComponents", true);
    Line Deleted : user_pref("CT3302997.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT3279141%26SearchSource%3D13%26CUI%3DUN20580107978990285\",\"EB_MAIN_FRAME_TITLE\":\[...]
    Line Deleted : user_pref("CT3302997.openThankYouPage", "false");
    Line Deleted : user_pref("CT3302997.openUninstallPage", "true");
    Line Deleted : user_pref("CT3302997.originalHomepage", "about:home");
    Line Deleted : user_pref("CT3302997.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279141&SearchSource=2&CUI=UN20580107978990285&UM=UM_ID&q=");
    Line Deleted : user_pref("CT3302997.originalSearchEngine", "WhiteSmoke B Customized Web Search");
    Line Deleted : user_pref("CT3302997.revertSettingsEnabled", "false");
    Line Deleted : user_pref("CT3302997.searchInNewTabEnabledByUser", "true");
    Line Deleted : user_pref("CT3302997.searchRevert", "false");
    Line Deleted : user_pref("CT3302997.searchUserMode", "2");
    Line Deleted : user_pref("CT3302997.serviceLayer_services_serviceMap_lastUpdate", "1376020384627");
    Line Deleted : user_pref("CT3302997.settingsINI", true);
    Line Deleted : user_pref("CT3302997.shouldFirstTimeDialog", "false");
    Line Deleted : user_pref("CT3302997.smartbar.CTID", "CT3302997");
    Line Deleted : user_pref("CT3302997.smartbar.Uninstall", "0");
    Line Deleted : user_pref("CT3302997.smartbar.homepage", "true");
    Line Deleted : user_pref("CT3302997.smartbar.toolbarName", "Vafmusic4 ");
    Line Deleted : user_pref("CT3302997.startPage", "true");
    Line Deleted : user_pref("CT3302997.startPageXPETakeover", "true");
    Line Deleted : user_pref("CT3302997.versionFromInstaller", "10.16.2.9");
    Line Deleted : user_pref("CT3302997_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1376020360133,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
    Line Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3279141&SearchSource=13&CUI=UN20580107978990285");
    Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke B Customized Web Search");
    Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279141&SearchSource=2&CUI=UN20580107978990285&UM=UM_ID&q=");
    Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3302997&SearchSource=2&CUI=UN34716549461819022&UM=2&q=");
    Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3279141");
    Line Deleted : user_pref("browser.search.defaultthis.engineName", "MixiDJ V37 Customized Web Search");
    Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&CUI=UN16857030743449312&UM=2&SearchSource=3&q={searchTerms}");
    Line Deleted : user_pref("extensions.defaulttab.config", "{\"status\": \"ok\", \"config\": {\"dns_error_handling\": \"Scenario_1,Scenario_2\", \"set_default_search\": \"Search|Bueno\", \"window_content\": \"<html>\\[...]
    Line Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&SearchSource=2&CUI=UN16857030743449312&UM=2&q=");
    Line Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3298573");
    Line Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3302997&CUI=UN34716549461819022&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3279141&SearchSource=13&CUI=UN205801[...]
    Line Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3279141&SearchSource=2&CUI=UN20580107978990285&UM=UM_ID&q=,hxxp://search.conduit.com/ResultsExt.aspx[...]
    Line Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3298573");
    Line Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3298573");
    Line Deleted : user_pref("smartbar.machineId", "QYSLHY1UBDRB8RVBQ5BHT1KTVVZUA1UBSTDJCN/428TRWSHB9KJ0RP9O1QP5WKFMQWMIHQALM42RH4PJWD5Q0A");
    Line Deleted : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3302997&CUI=UN34716549461819022&UM=2&SearchSource=13");
    Line Deleted : user_pref("smartbar.originalSearchAddressUrl", "");
    Line Deleted : user_pref("smartbar.originalSearchEngine", "");

    -\\ Google Chrome v33.0.1750.154

    [ File : C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


    *************************

    AdwCleaner[R0].txt - [25821 octets] - [03/04/2014 01:29:22]
    AdwCleaner[S0].txt - [26192 octets] - [03/04/2014 01:32:12]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [26253 octets] ##########

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.3 (03.23.2014:1)
    OS: Microsoft Windows XP x86
    Ran by kenneth on Thu 04/03/2014 at 1:56:34.46
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5FB76A0E-7C3F-45EE-AFDE-6B66C15942FE}
    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{ECB0515E-E11C-41A6-B3CE-ECEE03B5B13A}



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\pc1data"
    Successfully deleted: [Folder] "C:\Documents and Settings\kenneth\Application Data\pc cleaners"
    Successfully deleted: [Folder] "C:\Documents and Settings\kenneth\Application Data\pcpro"
    Successfully deleted: [Folder] "C:\Documents and Settings\kenneth\Local Settings\Application Data\cre"



    ~~~ FireFox

    Successfully deleted the following from C:\Documents and Settings\kenneth\Application Data\mozilla\firefox\profiles\ytasw4hq.default\prefs.js

    user_pref("extensions.alotab.errorUrl", "hxxp://search.alot.com/error?src_id=30662&client_id=1c8a5cb4a851d83eaa3b8879&camp_id=4052&install_time=2013-08-09T03:52:37Z&pr=errs&tb
    user_pref("extensions.defaulttab.active.affiliate", 3566);
    user_pref("extensions.defaulttab.active.overridechromesearch", false);
    user_pref("extensions.defaulttab.active.overridekeywordsearch", false);
    user_pref("extensions.defaulttab.browserID", "21F0380D2FCD791AD582AA3DD2044036");
    user_pref("extensions.defaulttab.firstrun", false);
    user_pref("extensions.defaulttab.installedVersion", "2.0");
    user_pref("extensions.defaulttab.lastUsed", 1376020504);



    ~~~ Chrome

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [Blacklisted Policy]





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Thu 04/03/2014 at 2:30:09.46
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  4. #4
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Good,

    You had a ton of bogus toolbars and whatnot installed, sometimes these are all linked together.

    http://techpageone.dell.com/technolo...0#.Uz0kWvldVL3
    I want to give you a heads up on Windows XP as Microsoft will be dropping support for this version in just a few days, it will go down the same path as Win 95 and 98, it will still work and you can continue to use it but without all the windows updates that help make it secure you would be taking a chance doing any online banking or purchases using a credit card, the bad guys are chomping at the bit waiting for this as XP will then be easier to exploit.

    You may want to consider upgrading to Windows 7 but that depends on the firing power of this computer, you can download and run the Win 7 upgrade advisor and see where you stand, we can go over this a bit later when where done
    http://www.microsoft.com/en-us/downl...ils.aspx?id=20



    Please download Malwarebytes from Here or Here

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected .
    • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
    Post the report please







    OTL by OldTimer
    • Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Click the "Scan All Users" checkbox.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
        Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  5. #5
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default Malwarebytes log

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 4/3/2014
    Scan Time: 1:43:13 PM
    Logfile: Malwarebytes log.txt
    Administrator: Yes

    Version: 2.00.0.1000
    Malware Database: v2014.04.03.05
    Rootkit Database: v2014.03.27.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Chameleon: Disabled

    OS: Windows XP Service Pack 3
    CPU: x86
    File System: NTFS
    User: kenneth

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 290644
    Time Elapsed: 1 hr, 10 min, 12 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Shuriken: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 5
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\updateFortunitas.exe, 1460, Delete-on-Reboot, [737eba6bee8df145ff1bab9aa06159a7]
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\utilFortunitas.exe, 1904, Delete-on-Reboot, [d71ad74e077445f1a07ae16402ff9c64]
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\FilterApp_C.exe, 2256, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5]
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLSApp.exe, 3348, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5]
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WeatherAlerts.exe, 1732, Delete-on-Reboot, [668ba085e2995adccfcb5203d2305ca4]

    Modules: 3
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLS.dll, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLS.dll, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLSApp.dll, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],

    Registry Keys: 29
    PUP.Optional.Fortunitas.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Fortunitas, Quarantined, [737eba6bee8df145ff1bab9aa06159a7],
    PUP.Optional.Fortunitas.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util Fortunitas, Quarantined, [d71ad74e077445f1a07ae16402ff9c64],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\CLSID\{c6f3fc7b-d607-44ec-9caf-2a41d547137f}, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{eff4f283-3c8b-4a01-8297-ddc839210b86}, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{94F1FD29-FDC2-4BF9-B008-AFB0452634E6}, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C6F3FC7B-D607-44EC-9CAF-2A41D547137F}, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\CLSID\{C6F3FC7B-D607-44EC-9CAF-2A41D547137F}\INPROCSERVER32, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.LyricsAd, HKLM\SOFTWARE\CLASSES\CLSID\{15467C9F-3784-4109-89C9-6ED7100B96B8}, Quarantined, [f3fea87d3843c76fb3ba010d07fbd62a],
    PUP.Optional.LyricsAd, HKLM\SOFTWARE\CLASSES\TYPELIB\{1B13EA0A-0F47-4678-8848-0CB84FDE303D}, Quarantined, [f3fea87d3843c76fb3ba010d07fbd62a],
    PUP.Optional.LyricsAd, HKLM\SOFTWARE\CLASSES\INTERFACE\{BE0B5EDA-7AA2-4D65-B0D7-3785B1BD285F}, Quarantined, [f3fea87d3843c76fb3ba010d07fbd62a],
    PUP.Optional.LyricsAd, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{15467C9F-3784-4109-89C9-6ED7100B96B8}, Quarantined, [f3fea87d3843c76fb3ba010d07fbd62a],
    PUP.Optional.LyricsAd, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{15467C9F-3784-4109-89C9-6ED7100B96B8}, Quarantined, [f3fea87d3843c76fb3ba010d07fbd62a],
    PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Quarantined, [856c2ef7a2d9142223f544ca11f103fd],
    PUP.Optional.DefaultTab.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7F6AFBF1-E065-4627-A2FD-810366367D01}, Quarantined, [856c2ef7a2d9142223f544ca11f103fd],
    PUP.Optional.RelatedSearchs.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}, Quarantined, [ab46af761d5ec76f3cc2b556cb37bf41],
    PUP.Optional.RelatedSearchs.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{96A25A24-2E87-4374-8A50-CC6F943FCE4D}, Quarantined, [ab46af761d5ec76f3cc2b556cb37bf41],
    PUP.Optional.TopArcadeHits.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF190686-9E72-403C-B99D-682ABDB63C5B}, Quarantined, [ed048f969eddfe382395d66a3ec45ca4],
    PUP.Optional.DefaultTab.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{B2D33ED6-EBBD-467C-BF6F-F175D9B51363}, Quarantined, [866b2afb7605cd69d516d33aea1839c7],
    PUP.Optional.DefaultTab.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{BAD84EE2-624D-4e7c-A8BB-41EFD720FD77}, Quarantined, [b04161c48eeda591e7050409bd452ad6],
    PUP.Optional.Solimba, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETUP.EXE, Quarantined, [628faa7bd8a387afc9318c71bd43cb35],
    PUP.Optional.WeatherAlerts.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DesktopWeatherAlerts, Quarantined, [f4fd47deb0cb65d15406dc5f699b5fa1],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Fortunitas, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, HKLM\SOFTWARE\Fortunitas, Quarantined, [b73a9f86116ada5cac730665bb4703fd],
    PUP.Optional.DefaultTab.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DefaultTab, Quarantined, [777a7da80d6e1e182272cea1cc3639c7],
    PUP.Optional.Fortunitas.A, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Fortunitas, Quarantined, [50a1e1441f5cae88d7473635d42e9b65],

    Registry Values: 1
    PUP.Optional.ConduitSearchProtect, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\bin\cltmng.exe, Quarantined, [b140d253611ace68e6e186f99f64fe02]

    Registry Data: 3
    Trojan.0Access, HKLM\SOFTWARE\CLASSES\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\INPROCSERVER32, C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\n., Good: (fastprox.dll), Bad: (C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\n.),Replaced,[fbf65bca94e7ca6cd779ea27e51f5da3]
    PUM.Hijack.StartMenu, HKU\S-1-5-21-2420282109-1773090242-3309790634-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|StartMenuLogoff, 1, Good: (0), Bad: (1),Replaced,[7b761d08afccb383c66d3dd2689cba46]
    PUM.Hijack.StartMenu, HKU\S-1-5-21-2420282109-1773090242-3309790634-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|StartMenuLogoff, 1, Good: (0), Bad: (1),Replaced,[50a144e1f388d85e91a28e819e666898]

    Folders: 17
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\TEMP, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\lib, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\Local_Weather_LLC, Quarantined, [c72a9e87f6850630f8a1b99c08fa6d93],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\Local_Weather_LLC\WeatherAlerts.exe_Url_2eymnc5l1vm4ey5z1beasywuj0cfb4ch, Quarantined, [c72a9e87f6850630f8a1b99c08fa6d93],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\Local_Weather_LLC\WeatherAlerts.exe_Url_2eymnc5l1vm4ey5z1beasywuj0cfb4ch\1.4.0.0, Quarantined, [c72a9e87f6850630f8a1b99c08fa6d93],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts, Delete-on-Reboot, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330231138, Quarantined, [668ba085e2995adccfcb5203d2305ca4],

    Files: 82
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\updateFortunitas.exe, Delete-on-Reboot, [737eba6bee8df145ff1bab9aa06159a7],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\utilFortunitas.exe, Delete-on-Reboot, [d71ad74e077445f1a07ae16402ff9c64],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\FortunitasBHO.dll, Quarantined, [af4226ff641774c2b46553f24eb3827e],
    PUP.Optional.DomalQ, C:\Documents and Settings\kenneth\My Documents\Downloads\Java.exe, Quarantined, [49a8c560cead1c1a43f473ca3ec20bf5],
    PUP.Optional.Solimba, C:\Documents and Settings\kenneth\My Documents\Downloads\Setup.exe, Quarantined, [628faa7bd8a387afc9318c71bd43cb35],
    HackTool.Agent, C:\Program Files\Twitter Marketing Bot.exe, Quarantined, [579ac1647209d363e221364204fc57a9],
    PUP.Optional.Softonic.A, C:\Program Files\SoftonicDownloader_for_mobipocket-reader-desktop.exe, Quarantined, [a54c3ee7bdbe42f4165da3754ab77789],
    PUP.Optional.InstallIQ.A, C:\Program Files\gimp_installer_2068.exe, Quarantined, [6c85b174ff7c092d19868f7fc8395da3],
    PUP.Optional.Monetizer, C:\Documents and Settings\kenneth\Local Settings\Temp\jki140.tmp, Quarantined, [26cb70b5ee8d94a29f7247207988ad53],
    Backdoor.Bot, C:\Documents and Settings\kenneth\Local Settings\Temp\e1524b6e-1d63-4fe8-86d8-712b2ef6604d\android.exe, Quarantined, [7c7553d27b0022149d0e194b33ce857b],
    PUP.Optional.WeatherAlerts.A, C:\Documents and Settings\kenneth\Local Settings\Temp\e1524b6e-1d63-4fe8-86d8-712b2ef6604d\software\DesktopWeatherAlertsSetup.exe, Quarantined, [c52cc65f5229e35306541427be464ab6],
    PUP.Optional.Fortunitas.A, C:\Documents and Settings\kenneth\Local Settings\Temp\e1524b6e-1d63-4fe8-86d8-712b2ef6604d\software\FortunitasSetup.exe, Quarantined, [9a57012499e2e155d705767621e24eb2],
    PUP.Optional.SkyTech.A, C:\Documents and Settings\kenneth\Local Settings\Temp\e1524b6e-1d63-4fe8-86d8-712b2ef6604d\software\tugs_key-find.exe, Quarantined, [07ea0322512a95a1acfb3d119170a759],
    PUP.Optional.SilenceInstall, C:\Documents and Settings\kenneth\Local Settings\Temp\e1524b6e-1d63-4fe8-86d8-712b2ef6604d\software\VOPackage.exe, Quarantined, [8071998c403b41f5428ced4dfa067789],
    PUP.Optional.SkyTech.A, C:\Documents and Settings\kenneth\Local Settings\Temp\fullpackage_temp1396234924\alilog.dll, Quarantined, [37baa87d0972b185f41fc66c1be542be],
    PUP.Optional.SkyTech.A, C:\Documents and Settings\kenneth\Local Settings\Temp\fullpackage_temp1396234924\package1.zip, Quarantined, [11e01f06aecd072fe72c75bd7090b050],
    Backdoor.Bot, C:\Documents and Settings\kenneth\Local Settings\Temp\android\android.exe, Quarantined, [af420e17b0cb3afce1ca0e56649dc33d],
    PUP.Optional.WeatherAlerts.A, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsuninstall.exe, Quarantined, [f4fd47deb0cb65d15406dc5f699b5fa1],
    PUP.Optional.QuickStart.A, C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\newtabv3.crx, Quarantined, [14ddce5763180135fb51f36b41c10af6],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\Fortunitas.ico, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\7za.exe, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\FortunitasUninstall.exe, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\updateFortunitas.InstallState, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\7za.exe, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\BrowserAdapterS.7z, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\FilterApp_C.exe, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLS.dll, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLSApp.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\XTLSApp.exe, Delete-on-Reboot, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.Bromon.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.BrowserAdapterS.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.CompatibilityChecker.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.FFUpdate.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.IEUpdate.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.Fortunitas.A, C:\Program Files\Fortunitas\bin\plugins\Fortunitas.PurBrowseG.dll, Quarantined, [e50c53d222593df90e0fdd8e5ea45ba5],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\DesktopWeatherAlerts.lnk, Quarantined, [d918899c4338ad89a2ab204b1ee409f7],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\Weather Alerts.lnk, Quarantined, [10e1cf565c1fe155113d73f828da867a],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\nsprotector.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\abstraction.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\application.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\popupTransparent.xul, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\dialogsApi.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\lib\json2.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\bubble.css, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\bubble.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\main.html, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\information.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\main.html, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\settings.js, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.SearchProtect.A, C:\WINDOWS\system32\config\systemprofile\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png, Quarantined, [a74a869f25568babd3f3176aa85be11f],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\Local_Weather_LLC\WeatherAlerts.exe_Url_2eymnc5l1vm4ey5z1beasywuj0cfb4ch\1.4.0.0\user.config, Quarantined, [c72a9e87f6850630f8a1b99c08fa6d93],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsApp.exe, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsApp.exe.config, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsApp0.dat, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsBrowser.exe, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsBrowser.exe.config, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsK.dat.U.dat, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\DesktopWeatherAlertsU.dat, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\ICSharpCode.SharpZipLib.dll, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\mod.DesktopWeatherAlertsApp0.dat, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\uninstall.exe, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WAUpdater.exe, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WAUpdater.exe.config, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WeatherAlerts.exe, Delete-on-Reboot, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\WeatherAlerts.exe.config, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790\3711.0.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790\3711.1.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790\3711.2.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790\3711.3.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330230343.790\mergetree, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330231138\3711.2.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330231138\3711.3.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330231138\3711.4.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],
    PUP.Optional.WeatherAlerts, C:\Documents and Settings\kenneth\Local Settings\Application Data\WeatherAlerts\0330231138\3711.5.tmp, Quarantined, [668ba085e2995adccfcb5203d2305ca4],

    Physical Sectors: 0
    (No malicious items detected)


    (end)

    I was headed to work and closed it without saving it. I came home and search the software to copy it. It's above!

  6. #6
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default OTL.Txt log

    OTL logfile created on: 4/4/2014 1:15:16 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1015.23 Mb Total Physical Memory | 341.27 Mb Available Physical Memory | 33.62% Memory free
    2.38 Gb Paging File | 1.80 Gb Available in Paging File | 75.32% Paging File free
    Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 149.04 Gb Total Space | 101.01 Gb Free Space | 67.78% Space Free | Partition Type: NTFS

    Computer Name: PC801713467250 | User Name: kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Documents and Settings\kenneth\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
    PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
    PRC - C:\Program Files\Google\Update\1.3.23.9\GoogleCrashHandler.exe (Google Inc.)
    PRC - C:\Documents and Settings\kenneth\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    PRC - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
    PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
    PRC - C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
    PRC - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
    PRC - C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
    PRC - c:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
    PRC - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


    ========== Modules (No Company Name) ==========

    MOD - c:\Documents and Settings\kenneth\Local Settings\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcloorr.dll ()
    MOD - C:\Program Files\AVAST Software\Avast\defs\14040301\algo.dll ()
    MOD - C:\Program Files\AVAST Software\Avast\libcef.dll ()
    MOD - C:\Documents and Settings\kenneth\Application Data\Dropbox\bin\wxmsw28uh_vc.dll ()
    MOD - C:\Documents and Settings\kenneth\Application Data\Dropbox\bin\libcef.dll ()
    MOD - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
    MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
    MOD - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()


    ========== Services (SafeList) ==========

    SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
    SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
    SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
    SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
    SRV - (MBAMService) -- C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
    SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
    SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
    SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe ()
    SRV - (STacSV) -- c:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
    SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
    SRV - (GameConsoleService) -- C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)


    ========== Driver Services (SafeList) ==========

    DRV - (WDICA) -- File not found
    DRV - (USBCCID) -- system32\DRIVERS\Rts5161ccid.sys File not found
    DRV - (Rts516xIR) -- system32\DRIVERS\Rts516xIR.sys File not found
    DRV - (RSUSBSTOR) -- System32\Drivers\RTS5121.sys File not found
    DRV - (RimUsb) -- System32\Drivers\RimUsb.sys File not found
    DRV - (PDRFRAME) -- File not found
    DRV - (PDRELI) -- File not found
    DRV - (PDFRAME) -- File not found
    DRV - (PDCOMP) -- File not found
    DRV - (PCTINDIS5) -- C:\WINDOWS\system32\PCTINDIS5.SYS File not found
    DRV - (PCIDump) -- File not found
    DRV - (lbrtfdc) -- File not found
    DRV - (Changer) -- File not found
    DRV - (MBAMSwissArmy) -- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys (Malwarebytes Corporation)
    DRV - (aswVmm) -- C:\WINDOWS\System32\drivers\aswVmm.sys ()
    DRV - (aswTdi) -- C:\WINDOWS\system32\drivers\aswTdi.sys (AVAST Software)
    DRV - (aswSnx) -- C:\WINDOWS\system32\drivers\aswSnx.sys (AVAST Software)
    DRV - (aswSP) -- C:\WINDOWS\system32\drivers\aswSP.sys (AVAST Software)
    DRV - (aswMonFlt) -- C:\WINDOWS\system32\drivers\aswmonflt.sys (AVAST Software)
    DRV - (aswRvrt) -- C:\WINDOWS\System32\drivers\aswRvrt.sys ()
    DRV - (AswRdr) -- C:\WINDOWS\system32\drivers\aswRdr.sys (AVAST Software)
    DRV - (tStLibG) -- C:\WINDOWS\system32\drivers\tStLibG.sys (StdLib)
    DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
    DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys ()
    DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
    DRV - (bcmbusctr) -- C:\WINDOWS\system32\drivers\BcmBusCtr.sys (Beceem communications pvt ltd.)
    DRV - (bcm) -- C:\WINDOWS\system32\drivers\drxvi314.sys (Beceem communications pvt ltd.)
    DRV - (SysCow) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
    DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
    DRV - (Cam3820) -- C:\WINDOWS\system32\drivers\cam3820a.sys (CamVendor)
    DRV - (SaibVd32) -- C:\WINDOWS\system32\drivers\SaibVd32.sys (Sonic Solutions)
    DRV - (SahdIa32) -- C:\WINDOWS\system32\drivers\SahdIa32.sys (Sonic Solutions)
    DRV - (SaibIa32) -- C:\WINDOWS\system32\drivers\SaibIa32.sys (Sonic Solutions)
    DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
    DRV - (L1c) -- C:\WINDOWS\system32\drivers\l1c51x86.sys (Atheros Communications, Inc.)
    DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
    IE - HKLM\..\SearchScopes,DefaultScope =
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\..\SearchScopes\{E04D8C24-22C9-424C-90F9-0FA9DFB1C771}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = www.bing.com
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\SearchScopes\{547EEAAC-3665-4e6c-B326-C622D698543A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=HPNTDF&pc=HPNTDF&src=IE-SearchBox
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\SearchScopes\{E04D8C24-22C9-424C-90F9-0FA9DFB1C771}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADSA_enUS358
    IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - user.js - File not found

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: File not found
    FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.3.51: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.3: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.3: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.3: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
    FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.3.51: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
    FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
    FF - HKLM\Software\MozillaPlugins\@skyhookwireless.com/LokiPlugin,version=3.1.0.05: C:\Program Files\Skyhook Wireless\Loki ActiveX Component\versions\3.1.0.05\loki.dll (Skyhook Wireless)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/04/01 00:32:54 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014/02/03 14:58:13 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2014/02/03 14:58:13 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2014/02/03 14:56:06 | 000,000,000 | ---D | M]
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/02/03 14:56:04 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\lspeaker@lyricsspeaker.net: C:\Program Files\LyricsSpeaker\120.xpi

    [2012/05/07 15:59:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\kenneth\Application Data\Mozilla\Extensions
    [2014/04/03 01:33:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\extensions
    [2012/05/07 15:59:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2012/05/07 15:59:29 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\extensions\staged-xpis
    [2009/03/18 16:40:42 | 000,019,153 | ---- | M] () (No name found) -- C:\Documents and Settings\kenneth\Application Data\Mozilla\Firefox\Profiles\ytasw4hq.default\extensions\staged-xpis\{20a82645-c095-46ed-80e3-08825760534b}\MicrosoftDotNetFrameworkAssistant.xpi
    [2013/07/31 09:46:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}
    File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\{F0E59437-6148-4A98-B0A6-60D557EF57F4}
    File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\ADDON@DEFAULTTAB.COM
    File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\APPBAR@ALOT.COM
    File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\QUICK_START@GMAIL.COM
    [2014/04/01 00:32:54 | 000,000,000 | ---D | M] (avast! Online Security) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
    [2009/12/05 05:47:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
    [2014/02/03 14:55:23 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
    [2014/03/30 23:04:11 | 000,000,551 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\key-find.xml

    ========== Chrome ==========

    CHR - default_search_provider: Google (Enabled)
    CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
    CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
    CHR - homepage: http://att.my.yahoo.com/
    CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll
    CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
    CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll
    CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\33.0.1750.154\pdf.dll
    CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
    CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll
    CHR - plugin: RealPlayer Download Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll
    CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
    CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
    CHR - plugin: Microsoft® DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
    CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
    CHR - plugin: Microsoft® DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
    CHR - plugin: RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
    CHR - plugin: RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
    CHR - plugin: RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
    CHR - plugin: RealDownloader Plugin (Enabled) = C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
    CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
    CHR - plugin: Java(TM) Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
    CHR - plugin: Windows Live® Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
    CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
    CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
    CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
    CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    CHR - Extension: Google Drive = C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
    CHR - Extension: YouTube = C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
    CHR - Extension: Google Search = C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
    CHR - Extension: Google Wallet = C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
    CHR - Extension: Gmail = C:\Documents and Settings\kenneth\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

    O1 HOSTS File: ([2008/04/15 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
    O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
    O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
    O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
    O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
    O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O3 - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
    O3 - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [Auction Auto Bidder] File not found
    O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
    O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
    O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
    O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
    O4 - Startup: C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\kenneth\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    O4 - Startup: C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
    O4 - Startup: C:\Documents and Settings\user1\Start Menu\Programs\Startup\xenwuj.lnk = File not found
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/s...irector/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.microsoft.com/downlo...oadManager.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4397C3C-4801-45DB-97C8-078873CCB5F1}: DhcpNameServer = 192.168.1.254
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\WINDOWS\Firestorm High.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Firestorm High.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2014/04/04 00:48:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.exe
    [2014/04/03 12:28:58 | 000,107,736 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
    [2014/04/03 12:28:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
    [2014/04/03 12:28:02 | 000,050,648 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
    [2014/04/03 12:28:01 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2014/04/03 12:28:01 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
    [2014/04/03 12:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2014/04/03 12:16:14 | 017,523,384 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\kenneth\Desktop\mbam-setup-2.0.0.1000.exe
    [2014/04/03 01:56:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
    [2014/04/03 01:53:32 | 001,038,974 | ---- | C] (Thisisu) -- C:\Documents and Settings\kenneth\Desktop\JRT.exe
    [2014/04/03 01:29:19 | 000,000,000 | ---D | C] -- C:\AdwCleaner
    [2014/04/02 10:55:41 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Documents and Settings\kenneth\Desktop\aswMBR.exe
    [2014/04/02 10:46:18 | 000,688,992 | R--- | C] (Swearware) -- C:\Documents and Settings\kenneth\Desktop\dds.scr
    [2014/04/02 10:40:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2014/04/02 10:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
    [2014/04/02 10:39:00 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
    [2014/04/01 01:02:31 | 000,000,000 | R--D | C] -- C:\Documents and Settings\kenneth\My Documents\Dropbox
    [2014/04/01 00:58:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\DropboxMaster
    [2014/04/01 00:57:28 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox
    [2014/04/01 00:56:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Start Menu\Programs\Dropbox
    [2014/04/01 00:53:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\Dropbox
    [2014/04/01 00:32:45 | 000,043,152 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2014/04/01 00:09:40 | 000,055,232 | ---- | C] (StdLib) -- C:\WINDOWS\System32\drivers\tStLibG.sys
    [2014/03/30 23:05:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\key-find
    [2014/03/30 23:03:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Start Menu\Programs\Weather Alerts
    [2014/03/18 06:43:17 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xp_eos.exe
    [2014/03/18 06:43:17 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xp_eos.exe
    [2014/03/12 00:55:52 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll
    [2014/03/12 00:55:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll
    [2014/03/12 00:55:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
    [2014/03/12 00:55:51 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll
    [2014/03/12 00:55:51 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
    [2014/03/12 00:55:50 | 000,206,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll
    [2014/03/12 00:55:50 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll
    [2014/03/12 00:55:50 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll
    [2014/03/12 00:55:50 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll
    [2014/03/12 00:55:50 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll
    [2014/03/12 00:55:49 | 000,759,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll
    [2014/03/12 00:55:49 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll
    [2014/03/12 00:55:49 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll
    [2014/03/12 00:55:49 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\corpol.dll
    [2014/03/12 00:55:49 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\corpol.dll
    [2014/03/12 00:55:48 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
    [2014/03/12 00:55:48 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll
    [2014/03/12 00:55:48 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll
    [2014/03/12 00:55:48 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec
    [2014/03/12 00:55:47 | 000,920,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
    [2014/03/12 00:55:47 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll
    [2014/03/12 00:55:47 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
    [2014/03/12 00:55:47 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll
    [2014/03/12 00:55:47 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll
    [2014/03/12 00:55:46 | 001,216,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
    [2014/03/12 00:55:45 | 006,022,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
    [2014/03/12 00:55:45 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl
    [2014/03/12 00:55:45 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl
    [2014/03/12 00:55:44 | 011,113,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
    [2014/03/12 00:55:43 | 002,006,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
    [2014/03/12 00:55:43 | 000,522,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
    [2013/01/12 09:18:55 | 040,437,664 | ---- | C] (Apple Inc.) -- C:\Program Files\QuickTimeInstaller.exe
    [2012/08/24 01:47:33 | 026,822,384 | ---- | C] (Intuit) -- C:\Program Files\QuickBooksInstallDiagnosticTool.exe
    [2012/08/09 01:32:18 | 006,785,285 | ---- | C] (KompoZer ) -- C:\Program Files\kompozer-0.8b3.en-US.win32.exe
    [2012/07/24 02:49:15 | 052,249,417 | ---- | C] (www.AuctionListingCreator.com ) -- C:\Program Files\ListingFactory_2012_Setup.exe
    [2012/07/10 12:39:18 | 001,982,061 | ---- | C] (Auctonic) -- C:\Program Files\Auctonic.exe
    [2012/07/05 01:19:48 | 000,813,232 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RealPlayer.exe
    [2012/05/10 02:39:47 | 001,247,056 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web.exe
    [2012/05/10 01:28:54 | 001,810,833 | ---- | C] (BrainWave) -- C:\Program Files\HCP.exe
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2014/04/04 01:26:02 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\ADOBE FLASH PLAYER UPDATER.JOB
    [2014/04/04 01:19:29 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
    [2014/04/04 01:00:08 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GOOGLEUPDATETASKMACHINEUA.JOB
    [2014/04/04 00:56:44 | 000,107,736 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
    [2014/04/04 00:48:04 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\kenneth\Desktop\OTL.exe
    [2014/04/04 00:42:01 | 000,000,366 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
    [2014/04/04 00:37:32 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/04/04 00:37:28 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/04/04 00:37:15 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\REALUPGRADELOGONTASKS-1-5-21-2420282109-1773090242-3309790634-1007.JOB
    [2014/04/04 00:35:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GOOGLEUPDATETASKMACHINECORE.JOB
    [2014/04/04 00:34:59 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/04/04 00:34:59 | 000,000,226 | ---- | M] () -- C:\WINDOWS\tasks\MICROSOFT WINDOWS XP END OF SERVICE NOTIFICATION LOGON.JOB
    [2014/04/04 00:34:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2014/04/04 00:34:12 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
    [2014/04/03 13:54:14 | 000,000,312 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/04/03 12:28:16 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2014/04/03 12:19:57 | 017,523,384 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\kenneth\Desktop\mbam-setup-2.0.0.1000.exe
    [2014/04/03 01:53:39 | 001,038,974 | ---- | M] (Thisisu) -- C:\Documents and Settings\kenneth\Desktop\JRT.exe
    [2014/04/03 01:19:51 | 001,426,178 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\AdwCleaner.exe
    [2014/04/02 11:10:40 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\MBR.dat
    [2014/04/02 10:56:48 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Documents and Settings\kenneth\Desktop\aswMBR.exe
    [2014/04/02 10:46:19 | 000,688,992 | R--- | M] (Swearware) -- C:\Documents and Settings\kenneth\Desktop\dds.scr
    [2014/04/02 10:39:27 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2014/04/02 10:39:02 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\NTREGOPT.lnk
    [2014/04/02 10:39:02 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\ERUNT.lnk
    [2014/04/02 10:31:03 | 000,000,468 | ---- | M] () -- C:\WINDOWS\tasks\DTReg.job
    [2014/04/01 10:51:37 | 000,001,032 | ---- | M] () -- C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\Dropbox.lnk
    [2014/04/01 10:50:19 | 000,001,020 | ---- | M] () -- C:\Documents and Settings\kenneth\Desktop\Dropbox.lnk
    [2014/04/01 00:42:18 | 000,001,733 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
    [2014/04/01 00:32:49 | 000,180,760 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2014/04/01 00:32:49 | 000,057,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
    [2014/04/01 00:32:48 | 000,776,976 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
    [2014/04/01 00:32:48 | 000,411,552 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
    [2014/04/01 00:32:47 | 000,067,824 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmonflt.sys
    [2014/04/01 00:32:47 | 000,049,944 | ---- | M] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2014/04/01 00:32:46 | 000,054,832 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
    [2014/04/01 00:32:45 | 000,271,264 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
    [2014/04/01 00:32:45 | 000,043,152 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
    [2014/04/01 00:09:40 | 000,055,232 | ---- | M] (StdLib) -- C:\WINDOWS\System32\drivers\tStLibG.sys
    [2014/03/30 23:13:14 | 000,506,052 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2014/03/30 23:13:14 | 000,089,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2014/03/30 23:04:53 | 000,001,786 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
    [2014/03/30 23:04:50 | 000,001,997 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    [2014/03/30 23:04:12 | 000,002,015 | ---- | M] () -- C:\Documents and Settings\kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2014/03/30 23:04:12 | 000,000,999 | ---- | M] () -- C:\Documents and Settings\kenneth\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2014/03/25 12:38:13 | 000,000,330 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/03/24 12:01:03 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\REALUPGRADESCHEDULEDTASKS-1-5-21-2420282109-1773090242-3309790634-1007.JOB
    [2014/03/18 13:52:32 | 000,000,220 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
    [2014/03/12 07:29:12 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
    [2014/03/12 07:29:10 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
    [2014/03/12 07:25:25 | 000,379,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2014/03/12 03:07:13 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2014/03/05 09:26:10 | 000,050,648 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
    [2014/03/05 09:26:02 | 000,023,256 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
    [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2014/04/03 12:28:16 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    [2014/04/03 01:19:42 | 001,426,178 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\AdwCleaner.exe
    [2014/04/02 11:10:40 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\MBR.dat
    [2014/04/02 10:39:27 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2014/04/02 10:39:02 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\NTREGOPT.lnk
    [2014/04/02 10:39:02 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\ERUNT.lnk
    [2014/04/02 10:19:13 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/04/01 10:51:36 | 000,001,032 | ---- | C] () -- C:\Documents and Settings\kenneth\Start Menu\Programs\Startup\Dropbox.lnk
    [2014/04/01 01:02:31 | 000,001,020 | ---- | C] () -- C:\Documents and Settings\kenneth\Desktop\Dropbox.lnk
    [2014/03/31 23:38:25 | 000,000,282 | ---- | C] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
    [2014/03/31 23:38:22 | 000,000,290 | ---- | C] () -- C:\WINDOWS\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2420282109-1773090242-3309790634-1007.job
    [2014/03/18 11:59:39 | 000,000,226 | ---- | C] () -- C:\WINDOWS\tasks\MICROSOFT WINDOWS XP END OF SERVICE NOTIFICATION LOGON.JOB
    [2014/03/18 11:59:39 | 000,000,220 | ---- | C] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
    [2013/06/20 03:20:35 | 012,570,054 | ---- | C] () -- C:\Program Files\hifsetup.zip
    [2013/05/16 09:47:33 | 000,180,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys
    [2013/05/16 09:47:33 | 000,049,944 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys
    [2013/05/16 09:03:43 | 117,478,104 | ---- | C] () -- C:\Program Files\avast_free_antivirus_setup.exe
    [2013/05/15 00:16:45 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2013/05/04 11:08:25 | 000,411,003 | ---- | C] ( ) -- C:\Program Files\PinBot-v1-3-Setup.exe
    [2013/04/19 13:11:31 | 150,064,088 | ---- | C] () -- C:\Program Files\AFM Tutorial_Videos.zip
    [2013/04/19 12:07:05 | 004,790,449 | ---- | C] () -- C:\Program Files\afm_v2_06.zip
    [2013/04/16 02:58:50 | 001,271,683 | ---- | C] () -- C:\Program Files\inbox-profits.zip
    [2013/04/15 01:48:21 | 000,474,688 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2420282109-1773090242-3309790634-1007-0.dat
    [2013/04/15 01:31:24 | 050,947,546 | ---- | C] () -- C:\Program Files\Free_PLR_Products-dkas.zip
    [2013/04/15 00:56:37 | 000,000,442 | ---- | C] () -- C:\Program Files\Shortcut to afm.lnk
    [2013/04/14 17:30:56 | 086,167,160 | ---- | C] () -- C:\Program Files\PLR_Facebook_Fans_Stampede.zip
    [2013/04/14 16:39:47 | 004,764,001 | ---- | C] () -- C:\Program Files\afm.zip
    [2013/04/12 17:18:39 | 000,045,814 | ---- | C] () -- C:\Program Files\extension_1_0_5.crx
    [2013/04/11 11:52:55 | 009,593,826 | ---- | C] () -- C:\Program Files\eBay_Social_Selling_Best_Practices[1].pdf
    [2013/03/23 08:57:34 | 336,558,358 | ---- | C] () -- C:\Program Files\FanPage Store Generator.zip
    [2013/03/22 18:59:11 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2013/02/17 14:57:54 | 000,111,115 | ---- | C] () -- C:\Program Files\STF_2013-02-17_1361127423957 GA 2012 return.pdf
    [2013/02/17 14:56:08 | 000,164,764 | ---- | C] () -- C:\Program Files\FTF_2013-02-17_1361127298608 Fed 2012 return.pdf
    [2013/02/17 14:53:23 | 000,024,649 | ---- | C] () -- C:\Program Files\2012 Ga refund.pdf
    [2013/01/25 11:36:58 | 000,000,130 | ---- | C] () -- C:\Documents and Settings\kenneth\Local Settings\Application Data\fusioncache.dat
    [2012/12/13 03:36:13 | 000,361,526 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    [2012/11/14 01:49:14 | 000,246,364 | ---- | C] () -- C:\Program Files\2freechapters-silentsalesmachine-dot-com[1].pdf
    [2012/08/24 11:56:00 | 000,012,314 | ---- | C] () -- C:\Documents and Settings\kenneth\.recently-used.xbel
    [2012/08/15 01:55:26 | 000,016,839 | ---- | C] () -- C:\Program Files\Autograph Ebook cover 3.jpg
    [2012/07/23 13:43:24 | 003,762,328 | ---- | C] () -- C:\Program Files\InternetBusinessBasics.zip
    [2012/07/23 13:36:17 | 005,227,079 | ---- | C] () -- C:\Program Files\InternetMarketingFromA-Z.zip
    [2012/07/23 11:02:34 | 000,609,436 | ---- | C] () -- C:\Program Files\spelloe_setup.exe
    [2012/07/19 13:46:18 | 000,000,095 | ---- | C] () -- C:\WINDOWS\ANS2000.INI
    [2012/07/19 13:46:18 | 000,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini
    [2012/07/19 13:46:18 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini
    [2012/07/06 13:36:30 | 000,008,192 | ---- | C] () -- C:\Documents and Settings\kenneth\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2012/07/06 03:08:19 | 000,008,983 | ---- | C] () -- C:\Program Files\ETSY 089.jpg
    [2012/07/06 03:08:18 | 000,061,506 | ---- | C] () -- C:\Program Files\ETSY 051.jpg
    [2012/07/06 02:15:36 | 000,020,224 | ---- | C] () -- C:\Program Files\Green.jpg
    [2012/07/06 01:45:58 | 000,000,220 | ---- | C] () -- C:\Documents and Settings\kenneth\.gtk-bookmarks
    [2012/07/05 12:00:34 | 018,117,717 | ---- | C] () -- C:\Program Files\GimPhoto-1.4.3_setup.exe
    [2012/06/22 00:11:39 | 010,606,592 | ---- | C] () -- C:\Program Files\creator.msi
    [2012/05/31 12:35:38 | 000,264,025 | ---- | C] () -- C:\Program Files\Cabinet-Repair-Vol-1-PDF.pdf
    [2012/05/28 09:43:11 | 000,013,990 | ---- | C] () -- C:\Program Files\Turbo lister problems.csv
    [2012/05/10 02:52:41 | 151,801,119 | ---- | C] () -- C:\Program Files\Apache_OpenOffice_incubating_3.4.0_Win_x86_install_en-US.exe
    [2012/05/10 01:20:47 | 005,433,105 | ---- | C] () -- C:\Program Files\hifsetup.exe
    [2012/05/10 01:13:47 | 007,589,922 | ---- | C] () -- C:\Program Files\kop-setup.zip
    [2012/05/09 09:43:49 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\kenneth\Application Data\wklnhst.dat
    [2012/05/07 16:08:40 | 000,022,032 | ---- | C] () -- C:\WINDOWS\DCEBoot.exe
    [2012/05/07 14:02:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2012/05/01 19:21:35 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
    [2011/01/15 01:53:42 | 006,624,351 | ---- | C] () -- C:\Program Files\twitter-marketing-bot.mp4
    [2011/01/15 01:53:42 | 000,039,391 | ---- | C] () -- C:\Program Files\TwitterMarketingBot.png
    [2011/01/15 01:53:40 | 000,071,852 | ---- | C] () -- C:\Program Files\Twitter Marketing Bot.ubot

    ========== ZeroAccess Check ==========

    [2013/05/07 00:57:36 | 000,002,048 | -HS- | M] () -- C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\@
    [2013/05/07 00:57:36 | 000,000,000 | -HSD | M] -- C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\L
    [2013/05/17 08:04:12 | 000,000,000 | -HSD | M] -- C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\U
    [2013/05/07 00:57:54 | 000,000,928 | ---- | M] () -- C:\RECYCLER\S-1-5-18\$a1d0c5961d66e3a4bb4dbce057b0ee27\U\00000001.@
    [2009/08/24 12:33:48 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
    "ThreadingModel" = Both
    "" = C:\RECYCLER\S-1-5-21-2420282109-1773090242-3309790634-1007\$a1d0c5961d66e3a4bb4dbce057b0ee27\n.

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/15 08:00:00 | 001,499,136 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
    "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/15 08:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    ========== LOP Check ==========

    [2013/12/04 15:02:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AddOn
    [2014/01/19 10:43:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
    [2013/12/05 18:22:31 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Canon Easy-WebPrint EX
    [2013/12/05 13:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canon IJ Network Tool
    [2013/12/04 09:19:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
    [2013/12/04 09:56:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJEGV
    [2013/12/04 09:15:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJETV
    [2013/12/04 13:33:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJQuickMenu
    [2013/12/04 14:00:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJWSpt
    [2012/05/01 19:24:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Clearwire
    [2012/12/13 09:52:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Package Cache
    [2009/08/24 13:22:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
    [2009/08/24 13:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
    [2014/01/19 10:55:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\AVAST Software
    [2013/12/04 13:33:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\Canon
    [2013/12/05 18:19:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\Canon Easy-WebPrint EX
    [2012/07/19 13:12:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
    [2014/04/04 00:37:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\Dropbox
    [2014/04/01 01:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\DropboxMaster
    [2012/08/24 12:10:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\gtk-2.0
    [2012/09/20 09:06:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\KDPublishingPro
    [2014/03/30 23:05:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\key-find
    [2012/08/09 01:33:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\kompozer.net
    [2012/08/12 03:49:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\Mobipocket
    [2012/05/10 09:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\OpenOffice.org
    [2012/05/09 09:43:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\Template
    [2013/05/02 23:45:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\ubot
    [2013/04/14 16:44:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\kenneth\Application Data\UBot Studio

    ========== Purity Check ==========



    < End of report >

  7. #7
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default Extras

    OTL Extras logfile created on: 4/4/2014 1:15:16 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\kenneth\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1015.23 Mb Total Physical Memory | 341.27 Mb Available Physical Memory | 33.62% Memory free
    2.38 Gb Paging File | 1.80 Gb Available in Paging File | 75.32% Paging File free
    Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 149.04 Gb Total Space | 101.01 Gb Free Space | 67.78% Space Free | Partition Type: NTFS

    Computer Name: PC801713467250 | User Name: kenneth | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

    [HKEY_USERS\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 4

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{026C3D27-9BE1-46BE-BEAE-6DE38A0F4FBE}" = RealNetworks - Microsoft Visual C++ 2005 Runtime
    "{0517F875-BBB2-4812-A63E-733B33CEF215}" = Roxio Instant Restore
    "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
    "{10385C4F-A6B2-4913-975D-6828928222EC}" = HP User Guides 0165
    "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3200_series" = Canon MG3200 series MP Drivers
    "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
    "{20aa4150-b5f4-11de-8a39-0800200c9a66}_is1" = KompoZer 0.8b3
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 51
    "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
    "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
    "{2B682751-E749-441C-A4B3-1F538E26E56E}" = Roxio Instant Restore Recovery Disk
    "{2D4E1F8A-901B-4BBD-B311-B6E56059066E}" = Microsoft Live Search Toolbar
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
    "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
    "{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
    "{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}" = Roxio BackOnTrack
    "{342126E1-173C-4585-BFBE-3EBDD20E3E9E}" = Mobipocket Reader 6.2
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{431A5BB6-E5E2-444E-8AF3-70E6BF16DEF6}" = HP Webcam-50
    "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
    "{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{51071D66-D034-4239-94E0-723FCA10B6FE}" = OpenOffice.org 3.4
    "{54CC7901-804D-4155-B353-21F0CC9112AB}" = HP Wireless Assistant
    "{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
    "{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
    "{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
    "{69B02159-7622-4DBB-B9EE-F933039830AD}" = QuickBooks Pro 2006
    "{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
    "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
    "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{87A83C6F-F53C-448A-B078-FF00E3EAEB29}" = Roxio Disaster Recovery
    "{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8D446EE0-0C2E-4981-B84F-0F63779DFF50}" = KDPublishingPro
    "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
    "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
    "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
    "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
    "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
    "{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
    "{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
    "{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.5 MUI
    "{AFE499B5-FCC4-45E6-A1A5-3C51AE0E539B}" = Mobipocket Creator 4.2
    "{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
    "{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
    "{B92C2C6C-F70E-497B-88A7-1FEF9888272B}" = Adobe AIR
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}" = RealDownloader
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D9555FC7-99B1-4675-9104-732EA581B2AC}" = DOMAIN NAME SEARCH SOFTWARE with Google PageRank
    "{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
    "{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar
    "{E1CFE7F3-A062-4904-AA05-084E5C27F499}" = Auctonic
    "{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
    "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
    "{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
    "{EEA95E6C-6847-49BE-83C9-ED92D8E18983}" = HP QuickSync
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 12 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Advanced Registry Optimizer_is1" = Advanced Registry Optimizer
    "Auction Auto Bidder_is1" = Auction Auto Bidder
    "avast" = avast! Free Antivirus
    "Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
    "Canon MG3200 series On-screen Manual" = Canon MG3200 series On-screen Manual
    "Canon MG3200 series User Registration" = Canon MG3200 series User Registration
    "Canon_IJ_Network_Scanner_Selector_EX" = Canon IJ Network Scanner Selector EX
    "Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
    "Canon_IJ_Scan_Utility" = Canon IJ Scan Utility
    "CanonMyPrinter" = Canon My Printer
    "Easy-WebPrint EX" = Canon Easy-WebPrint EX
    "ENTERPRISE" = Microsoft Office Enterprise 2007
    "ERUNT_is1" = ERUNT 1.1j
    "GimPhoto" = GimPhoto 1.4.3
    "Google Chrome" = Google Chrome
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "Hot Item Finder2.1.1.1" = Hot Item Finder
    "ie8" = Windows Internet Explorer 8
    "key-find uninstaller" = key-find uninstaller
    "Keyword Optimizer Pro 22.0.1.7" = Keyword Optimizer Pro 2
    "Loki ActiveX Control" = Loki ActiveX Control
    "lspeaker@lyricsspeaker.net" = LyricsSpeaker
    "Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.00.0.1000
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
    "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
    "PinAutomation - Traffic Robot v1.2_is1" = PinAutomation - Traffic Robot v1.2
    "RealPlayer 16.0" = RealPlayer
    "Spell Checker For OE 2.1" = Spell Checker For OE 2.1
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "WildTangent hp Master Uninstall" = HP Games
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "WinLiveSuite_Wave3" = Windows Live Essentials

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Dropbox" = Dropbox
    "JNLP" = JNLP

    ========== Last 20 Event Log Errors ==========

    [ Application Events ]
    Error - 3/31/2014 11:38:10 PM | Computer Name = PC801713467250 | Source = ESENT | ID = 454
    Description = wuauclt (1420) Database recovery/restore failed with unexpected error
    -1216.

    Error - 3/31/2014 11:42:21 PM | Computer Name = PC801713467250 | Source = LoadPerf | ID = 3002
    Description = The performance counter explain text string value in the registry
    is incorrectly formatted. The bogus string is ? *, the bogus index value is the first
    DWORD in Data section while the last valid index values are the second and third
    DWORD in Data section.

    Error - 4/1/2014 12:30:21 AM | Computer Name = PC801713467250 | Source = crypt32 | ID = 131083
    Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
    with error: The data is invalid.

    Error - 4/1/2014 12:55:00 AM | Computer Name = PC801713467250 | Source = LoadPerf | ID = 3002
    Description = The performance counter explain text string value in the registry
    is incorrectly formatted. The bogus string is ? *, the bogus index value is the first
    DWORD in Data section while the last valid index values are the second and third
    DWORD in Data section.

    Error - 4/3/2014 1:51:12 AM | Computer Name = PC801713467250 | Source = RstIdle | ID = 0
    Description =

    Error - 4/3/2014 2:01:00 AM | Computer Name = PC801713467250 | Source = RstIdle | ID = 0
    Description =

    Error - 4/3/2014 2:14:00 AM | Computer Name = PC801713467250 | Source = RstIdle | ID = 0
    Description =

    Error - 4/3/2014 2:26:56 AM | Computer Name = PC801713467250 | Source = RstIdle | ID = 0
    Description =

    Error - 4/3/2014 1:48:50 PM | Computer Name = PC801713467250 | Source = LoadPerf | ID = 3002
    Description = The performance counter explain text string value in the registry
    is incorrectly formatted. The bogus string is ? *, the bogus index value is the first
    DWORD in Data section while the last valid index values are the second and third
    DWORD in Data section.

    Error - 4/3/2014 1:55:59 PM | Computer Name = PC801713467250 | Source = RstIdle | ID = 0
    Description =

    [ System Events ]
    Error - 4/3/2014 1:33:45 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7031
    Description = The Util Fortunitas service terminated unexpectedly. It has done
    this 1 time(s). The following corrective action will be taken in 5000 milliseconds:
    Restart the service.

    Error - 4/3/2014 1:33:45 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7031
    Description = The Print Spooler service terminated unexpectedly. It has done this
    2 time(s). The following corrective action will be taken in 60000 milliseconds:
    Restart the service.

    Error - 4/3/2014 11:54:56 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the BOTService service.

    Error - 4/3/2014 1:51:03 PM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AliIde IntelIde PCIIde ViaIde

    Error - 4/3/2014 1:53:33 PM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the MBAMService service.

    Error - 4/3/2014 1:54:03 PM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the BOTService service.

    Error - 4/4/2014 12:20:17 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the MBAMService service.

    Error - 4/4/2014 12:20:48 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the BOTService service.

    Error - 4/4/2014 12:35:30 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the MBAMService service.

    Error - 4/4/2014 12:35:53 AM | Computer Name = PC801713467250 | Source = Service Control Manager | ID = 7011
    Description = Timeout (30000 milliseconds) waiting for a transaction response from
    the MBAMService service.


    < End of report >

    Still got Key-Find popping up as my Google Chrome browser opens!

  8. #8
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Good Morning,

    Still got Key-Find popping up as my Google Chrome browser opens!
    Yep, I still see it, I am going to work up a fix for you using OTL and we will remove it

    In the meantime I am concerned about this as its a marker for the Zero Access Rootkit
    Trojan.0Access


    So lets do this first, this is just a scan to see if its present


    Please download TDSSKiller.zip
    • Extract it to your desktop
    • Double click TDSSKiller.exe
    • when the window opens, click on Change Parameters
    • under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
    • click OK
    • Press Start Scan
      • As we are only looking for a log of what is on the machine right now > choose to skip whatever is found
      • Then click Continue > Reboot now
    • Copy and paste the log in your next reply
      • A copy of the log will be saved automatically to the root of the drive (typically C:\)
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  9. #9
    Junior Member
    Join Date
    Nov 2005
    Location
    Atlanta
    Posts
    28

    Default TDSSkiller log

    02:28:21.0015 3568 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
    02:28:26.0281 3568 ============================================================
    02:28:26.0281 3568 Current date / time: 2014/04/05 02:28:26.0281
    02:28:26.0281 3568 SystemInfo:
    02:28:26.0281 3568
    02:28:26.0281 3568 OS Version: 5.1.2600 ServicePack: 3.0
    02:28:26.0281 3568 Product type: Workstation
    02:28:26.0281 3568 ComputerName: PC801713467250
    02:28:26.0281 3568 UserName: kenneth
    02:28:26.0281 3568 Windows directory: C:\WINDOWS
    02:28:26.0281 3568 System windows directory: C:\WINDOWS
    02:28:26.0281 3568 Processor architecture: Intel x86
    02:28:26.0281 3568 Number of processors: 2
    02:28:26.0281 3568 Page size: 0x1000
    02:28:26.0281 3568 Boot type: Normal boot
    02:28:26.0281 3568 ============================================================
    02:28:27.0328 3568 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
    02:28:27.0343 3568 ============================================================
    02:28:27.0343 3568 \Device\Harddisk0\DR0:
    02:28:27.0343 3568 MBR partitions:
    02:28:27.0343 3568 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x12A14400
    02:28:27.0343 3568 ============================================================
    02:28:27.0375 3568 C: <-> \Device\Harddisk0\DR0\Partition1
    02:28:27.0375 3568 ============================================================
    02:28:27.0375 3568 Initialize success
    02:28:27.0375 3568 ============================================================
    02:29:17.0140 3548 ============================================================
    02:29:17.0140 3548 Scan started
    02:29:17.0140 3548 Mode: Manual; TDLFS;
    02:29:17.0140 3548 ============================================================
    02:29:17.0671 3548 ================ Scan system memory ========================
    02:29:20.0765 3548 System memory - ok
    02:29:20.0765 3548 ================ Scan services =============================
    02:29:20.0984 3548 [ A15069EEC83EBC54150564B2585CFDBA ] 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
    02:29:21.0000 3548 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 - ok
    02:29:21.0187 3548 Abiosdsk - ok
    02:29:21.0234 3548 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
    02:29:21.0250 3548 abp480n5 - ok
    02:29:21.0296 3548 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
    02:29:21.0312 3548 ACPI - ok
    02:29:21.0343 3548 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
    02:29:21.0343 3548 ACPIEC - ok
    02:29:21.0453 3548 [ 9D96B0D5855FD1B98023B3EEC9F06786 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    02:29:21.0453 3548 AdobeFlashPlayerUpdateSvc - ok
    02:29:21.0468 3548 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys
    02:29:21.0484 3548 adpu160m - ok
    02:29:21.0562 3548 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
    02:29:21.0562 3548 aec - ok
    02:29:21.0656 3548 [ 822D53766D57C90C437536232ECE9023 ] AESTAud C:\WINDOWS\system32\drivers\AESTAud.sys
    02:29:21.0671 3548 AESTAud - ok
    02:29:21.0750 3548 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
    02:29:21.0750 3548 AFD - ok
    02:29:21.0796 3548 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
    02:29:21.0796 3548 agp440 - ok
    02:29:21.0828 3548 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
    02:29:21.0828 3548 agpCPQ - ok
    02:29:21.0843 3548 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys
    02:29:21.0859 3548 Aha154x - ok
    02:29:21.0875 3548 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys
    02:29:21.0875 3548 aic78u2 - ok
    02:29:21.0906 3548 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys
    02:29:21.0906 3548 aic78xx - ok
    02:29:21.0953 3548 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
    02:29:21.0953 3548 Alerter - ok
    02:29:22.0000 3548 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
    02:29:22.0000 3548 ALG - ok
    02:29:22.0015 3548 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys
    02:29:22.0031 3548 AliIde - ok
    02:29:22.0078 3548 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys
    02:29:22.0078 3548 alim1541 - ok
    02:29:22.0125 3548 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys
    02:29:22.0125 3548 amdagp - ok
    02:29:22.0156 3548 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys
    02:29:22.0171 3548 amsint - ok
    02:29:22.0187 3548 AppMgmt - ok
    02:29:22.0265 3548 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys
    02:29:22.0265 3548 asc - ok
    02:29:22.0296 3548 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys
    02:29:22.0296 3548 asc3350p - ok
    02:29:22.0375 3548 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys
    02:29:22.0375 3548 asc3550 - ok
    02:29:22.0578 3548 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    02:29:22.0593 3548 aspnet_state - ok
    02:29:22.0640 3548 [ B347D2FEAE2D063943F16EC98634AB89 ] aswMonFlt C:\WINDOWS\system32\drivers\aswMonFlt.sys
    02:29:22.0656 3548 aswMonFlt - ok
    02:29:22.0687 3548 [ 71A7C3DB37ED3F6118AC7FEB50574C35 ] AswRdr C:\WINDOWS\system32\drivers\aswRdr.sys
    02:29:22.0703 3548 AswRdr - ok
    02:29:22.0734 3548 [ 84B4C00AE8CDFC52CF68F322D821F34C ] aswRvrt C:\WINDOWS\system32\drivers\aswRvrt.sys
    02:29:22.0750 3548 aswRvrt - ok
    02:29:22.0812 3548 [ 3A50AD6AE8D8A0F78F03316F5B93FE45 ] aswSnx C:\WINDOWS\system32\drivers\aswSnx.sys
    02:29:22.0843 3548 aswSnx - ok
    02:29:22.0875 3548 [ B6381B4DC603C558419641BA969930E0 ] aswSP C:\WINDOWS\system32\drivers\aswSP.sys
    02:29:22.0906 3548 aswSP - ok
    02:29:22.0937 3548 [ 4A90E597A9AF787C4CEA0DE95C1F74A7 ] aswTdi C:\WINDOWS\system32\drivers\aswTdi.sys
    02:29:22.0937 3548 aswTdi - ok
    02:29:22.0984 3548 [ 680448905E27BBC6587ADB28597640D6 ] aswVmm C:\WINDOWS\system32\drivers\aswVmm.sys
    02:29:23.0000 3548 aswVmm - ok
    02:29:23.0046 3548 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    02:29:23.0046 3548 AsyncMac - ok
    02:29:23.0125 3548 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
    02:29:23.0156 3548 atapi - ok
    02:29:23.0156 3548 Atdisk - ok
    02:29:23.0203 3548 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    02:29:23.0218 3548 Atmarpc - ok
    02:29:23.0296 3548 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
    02:29:23.0296 3548 AudioSrv - ok
    02:29:23.0328 3548 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
    02:29:23.0343 3548 audstub - ok
    02:29:23.0453 3548 [ BEA8D0FA8805CC2E6BB49728166699C7 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    02:29:23.0453 3548 avast! Antivirus - ok
    02:29:23.0531 3548 [ 477F7ADDEF02A8242744417BF90E8E33 ] bcm C:\WINDOWS\system32\DRIVERS\drxvi314.sys
    02:29:23.0546 3548 bcm - ok
    02:29:23.0703 3548 [ 69DD2805F42F2DE52A5FCBCFA9D8848F ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
    02:29:23.0734 3548 BCM43XX - ok
    02:29:23.0781 3548 [ A2BE7E717D1B4DECBFD56E2C83E4A92E ] bcmbusctr C:\WINDOWS\system32\DRIVERS\BcmBusCtr.sys
    02:29:23.0781 3548 bcmbusctr - ok
    02:29:23.0812 3548 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
    02:29:23.0828 3548 Beep - ok
    02:29:23.0906 3548 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
    02:29:23.0984 3548 BITS - ok
    02:29:24.0109 3548 [ 06902820703ECB60C192B4581AB13754 ] BOTService C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
    02:29:24.0109 3548 BOTService - ok
    02:29:24.0171 3548 [ F934D1B230F84E1D19DD00AC5A7A83ED ] Bridge C:\WINDOWS\system32\DRIVERS\bridge.sys
    02:29:24.0187 3548 Bridge - ok
    02:29:24.0203 3548 [ F934D1B230F84E1D19DD00AC5A7A83ED ] BridgeMP C:\WINDOWS\system32\DRIVERS\bridge.sys
    02:29:24.0203 3548 BridgeMP - ok
    02:29:24.0265 3548 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
    02:29:24.0265 3548 Browser - ok
    02:29:24.0328 3548 [ 5AF2367C6E70D0488EB47A87D5D899C8 ] Cam3820 C:\WINDOWS\system32\Drivers\cam3820a.sys
    02:29:24.0343 3548 Cam3820 - ok
    02:29:24.0359 3548 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
    02:29:24.0359 3548 cbidf - ok
    02:29:24.0390 3548 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
    02:29:24.0390 3548 cbidf2k - ok
    02:29:24.0437 3548 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    02:29:24.0453 3548 CCDECODE - ok
    02:29:24.0468 3548 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
    02:29:24.0468 3548 cd20xrnt - ok
    02:29:24.0500 3548 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
    02:29:24.0515 3548 Cdaudio - ok
    02:29:24.0546 3548 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
    02:29:24.0546 3548 Cdfs - ok
    02:29:24.0578 3548 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
    02:29:24.0578 3548 Cdrom - ok
    02:29:24.0609 3548 Changer - ok
    02:29:24.0656 3548 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
    02:29:24.0656 3548 CiSvc - ok
    02:29:24.0687 3548 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
    02:29:24.0687 3548 ClipSrv - ok
    02:29:24.0765 3548 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    02:29:24.0859 3548 clr_optimization_v2.0.50727_32 - ok
    02:29:24.0906 3548 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    02:29:25.0031 3548 clr_optimization_v4.0.30319_32 - ok
    02:29:25.0109 3548 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
    02:29:25.0109 3548 CmBatt - ok
    02:29:25.0140 3548 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys
    02:29:25.0140 3548 CmdIde - ok
    02:29:25.0187 3548 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
    02:29:25.0187 3548 Compbatt - ok
    02:29:25.0218 3548 COMSysApp - ok
    02:29:25.0281 3548 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys
    02:29:25.0296 3548 Cpqarray - ok
    02:29:25.0359 3548 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
    02:29:25.0359 3548 CryptSvc - ok
    02:29:25.0375 3548 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
    02:29:25.0390 3548 dac2w2k - ok
    02:29:25.0406 3548 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys
    02:29:25.0421 3548 dac960nt - ok
    02:29:25.0500 3548 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
    02:29:25.0515 3548 DcomLaunch - ok
    02:29:25.0593 3548 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
    02:29:25.0609 3548 Dhcp - ok
    02:29:25.0625 3548 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
    02:29:25.0640 3548 Disk - ok
    02:29:25.0640 3548 dmadmin - ok
    02:29:25.0703 3548 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
    02:29:25.0734 3548 dmboot - ok
    02:29:25.0796 3548 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
    02:29:25.0796 3548 dmio - ok
    02:29:25.0828 3548 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
    02:29:25.0828 3548 dmload - ok
    02:29:25.0890 3548 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
    02:29:25.0906 3548 dmserver - ok
    02:29:25.0953 3548 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
    02:29:25.0968 3548 DMusic - ok
    02:29:26.0031 3548 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
    02:29:26.0046 3548 Dnscache - ok
    02:29:26.0078 3548 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
    02:29:26.0093 3548 Dot3svc - ok
    02:29:26.0140 3548 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys
    02:29:26.0156 3548 dpti2o - ok
    02:29:26.0218 3548 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
    02:29:26.0218 3548 drmkaud - ok
    02:29:26.0265 3548 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
    02:29:26.0281 3548 EapHost - ok
    02:29:26.0296 3548 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
    02:29:26.0312 3548 ERSvc - ok
    02:29:26.0359 3548 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
    02:29:26.0375 3548 Eventlog - ok
    02:29:26.0468 3548 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
    02:29:26.0468 3548 EventSystem - ok
    02:29:26.0500 3548 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
    02:29:26.0515 3548 Fastfat - ok
    02:29:26.0562 3548 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
    02:29:26.0578 3548 FastUserSwitchingCompatibility - ok
    02:29:26.0609 3548 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
    02:29:26.0625 3548 Fdc - ok
    02:29:26.0687 3548 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
    02:29:26.0687 3548 Fips - ok
    02:29:26.0718 3548 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
    02:29:26.0718 3548 Flpydisk - ok
    02:29:26.0750 3548 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
    02:29:26.0765 3548 FltMgr - ok
    02:29:26.0890 3548 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    02:29:26.0906 3548 FontCache3.0.0.0 - ok
    02:29:26.0937 3548 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
    02:29:26.0937 3548 Fs_Rec - ok
    02:29:26.0968 3548 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    02:29:26.0968 3548 Ftdisk - ok
    02:29:27.0078 3548 [ C44D560E441F091EA3B72F778EC60DE2 ] GameConsoleService C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe
    02:29:27.0093 3548 GameConsoleService - ok
    02:29:27.0109 3548 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
    02:29:27.0109 3548 Gpc - ok
    02:29:27.0265 3548 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
    02:29:27.0281 3548 gupdate - ok
    02:29:27.0296 3548 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
    02:29:27.0296 3548 gupdatem - ok
    02:29:27.0375 3548 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    02:29:27.0390 3548 gusvc - ok
    02:29:27.0421 3548 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
    02:29:27.0421 3548 HDAudBus - ok
    02:29:27.0562 3548 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
    02:29:27.0578 3548 helpsvc - ok
    02:29:27.0593 3548 HidServ - ok
    02:29:27.0671 3548 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
    02:29:27.0671 3548 HidUsb - ok
    02:29:27.0734 3548 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
    02:29:27.0750 3548 hkmsvc - ok
    02:29:27.0796 3548 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys
    02:29:27.0796 3548 hpn - ok
    02:29:27.0968 3548 [ FDF273A845F1FFCCEADF363AAF47582F ] hpqwmiex C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    02:29:27.0984 3548 hpqwmiex - ok
    02:29:28.0062 3548 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
    02:29:28.0078 3548 HTTP - ok
    02:29:28.0156 3548 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
    02:29:28.0171 3548 HTTPFilter - ok
    02:29:28.0187 3548 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys
    02:29:28.0203 3548 i2omgmt - ok
    02:29:28.0234 3548 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys
    02:29:28.0250 3548 i2omp - ok
    02:29:28.0312 3548 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    02:29:28.0328 3548 i8042prt - ok
    02:29:28.0625 3548 [ 48846B31BE5A4FA662CCFDE7A1BA86B9 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
    02:29:28.0781 3548 ialm - ok
    02:29:28.0859 3548 [ D483687EACE0C065EE772481A96E05F5 ] iaStor C:\WINDOWS\system32\DRIVERS\iaStor.sys
    02:29:28.0875 3548 iaStor - ok
    02:29:29.0015 3548 [ 6F95324909B502E2651442C1548AB12F ] IDriverT c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    02:29:29.0015 3548 IDriverT - ok
    02:29:29.0156 3548 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    02:29:29.0187 3548 idsvc - ok
    02:29:29.0250 3548 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
    02:29:29.0265 3548 Imapi - ok
    02:29:29.0328 3548 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
    02:29:29.0343 3548 ImapiService - ok
    02:29:29.0375 3548 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys
    02:29:29.0390 3548 ini910u - ok
    02:29:29.0437 3548 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
    02:29:29.0437 3548 IntelIde - ok
    02:29:29.0468 3548 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
    02:29:29.0468 3548 intelppm - ok
    02:29:29.0531 3548 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
    02:29:29.0531 3548 Ip6Fw - ok
    02:29:29.0546 3548 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    02:29:29.0562 3548 IpFilterDriver - ok
    02:29:29.0609 3548 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
    02:29:29.0625 3548 IpInIp - ok
    02:29:29.0687 3548 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
    02:29:29.0687 3548 IpNat - ok
    02:29:29.0734 3548 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
    02:29:29.0734 3548 IPSec - ok
    02:29:29.0796 3548 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
    02:29:29.0796 3548 IRENUM - ok
    02:29:29.0875 3548 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
    02:29:29.0875 3548 isapnp - ok
    02:29:30.0078 3548 [ B9436A665A8621073A12338B16D7BFD4 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe
    02:29:30.0078 3548 JavaQuickStarterService - ok
    02:29:30.0109 3548 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    02:29:30.0109 3548 Kbdclass - ok
    02:29:30.0187 3548 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
    02:29:30.0203 3548 kmixer - ok
    02:29:30.0265 3548 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
    02:29:30.0281 3548 KSecDD - ok
    02:29:30.0343 3548 [ 140F9B777FA84E2F5EEEA5CADC112E53 ] L1c C:\WINDOWS\system32\DRIVERS\l1c51x86.sys
    02:29:30.0343 3548 L1c - ok
    02:29:30.0421 3548 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
    02:29:30.0437 3548 LanmanServer - ok
    02:29:30.0515 3548 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
    02:29:30.0531 3548 lanmanworkstation - ok
    02:29:30.0546 3548 lbrtfdc - ok
    02:29:30.0625 3548 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
    02:29:30.0625 3548 LmHosts - ok
    02:29:30.0687 3548 [ C846349849475B7EC8B20A825449D531 ] MBAMProtector C:\WINDOWS\system32\drivers\mbam.sys
    02:29:30.0687 3548 MBAMProtector - ok
    02:29:30.0781 3548 [ 47DF4BC3D1561B6DAFA0862735FA1493 ] MBAMScheduler C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
    02:29:30.0828 3548 MBAMScheduler - ok
    02:29:30.0890 3548 [ 2CFC417EED3BF5DDA255CB7EF7E09D45 ] MBAMService C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
    02:29:30.0906 3548 MBAMService - ok
    02:29:30.0937 3548 [ 661B911FA04E73FB073FF9B1C9BD2E05 ] MBAMSwissArmy C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
    02:29:30.0937 3548 MBAMSwissArmy - ok
    02:29:30.0984 3548 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
    02:29:31.0000 3548 Messenger - ok
    02:29:31.0109 3548 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
    02:29:31.0109 3548 Microsoft Office Groove Audit Service - ok
    02:29:31.0156 3548 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
    02:29:31.0156 3548 mnmdd - ok
    02:29:31.0203 3548 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
    02:29:31.0218 3548 mnmsrvc - ok
    02:29:31.0265 3548 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
    02:29:31.0281 3548 Modem - ok
    02:29:31.0312 3548 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
    02:29:31.0328 3548 Mouclass - ok
    02:29:31.0359 3548 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
    02:29:31.0359 3548 mouhid - ok
    02:29:31.0390 3548 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
    02:29:31.0390 3548 MountMgr - ok
    02:29:31.0406 3548 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys
    02:29:31.0421 3548 mraid35x - ok
    02:29:31.0453 3548 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    02:29:31.0453 3548 MRxDAV - ok
    02:29:31.0531 3548 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    02:29:31.0546 3548 MRxSmb - ok
    02:29:31.0609 3548 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
    02:29:31.0625 3548 MSDTC - ok
    02:29:31.0671 3548 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
    02:29:31.0687 3548 Msfs - ok
    02:29:31.0703 3548 MSIServer - ok
    02:29:31.0718 3548 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
    02:29:31.0734 3548 MSKSSRV - ok
    02:29:31.0781 3548 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    02:29:31.0781 3548 MSPCLOCK - ok
    02:29:31.0796 3548 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
    02:29:31.0812 3548 MSPQM - ok
    02:29:31.0843 3548 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    02:29:31.0843 3548 mssmbios - ok
    02:29:31.0906 3548 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
    02:29:31.0906 3548 MSTEE - ok
    02:29:31.0968 3548 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
    02:29:31.0968 3548 Mup - ok
    02:29:32.0015 3548 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    02:29:32.0015 3548 NABTSFEC - ok
    02:29:32.0078 3548 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
    02:29:32.0093 3548 napagent - ok
    02:29:32.0125 3548 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
    02:29:32.0125 3548 NDIS - ok
    02:29:32.0171 3548 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    02:29:32.0171 3548 NdisIP - ok
    02:29:32.0218 3548 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    02:29:32.0234 3548 NdisTapi - ok
    02:29:32.0281 3548 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    02:29:32.0296 3548 Ndisuio - ok
    02:29:32.0328 3548 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    02:29:32.0328 3548 NdisWan - ok
    02:29:32.0406 3548 [ 2F597BB467E05B1FE3830EABD821B8E0 ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
    02:29:32.0406 3548 NDProxy - ok
    02:29:32.0437 3548 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
    02:29:32.0453 3548 NetBIOS - ok
    02:29:32.0484 3548 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
    02:29:32.0484 3548 NetBT - ok
    02:29:32.0546 3548 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
    02:29:32.0562 3548 NetDDE - ok
    02:29:32.0593 3548 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
    02:29:32.0593 3548 NetDDEdsdm - ok
    02:29:32.0656 3548 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
    02:29:32.0671 3548 Netlogon - ok
    02:29:32.0703 3548 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
    02:29:32.0718 3548 Netman - ok
    02:29:32.0781 3548 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    02:29:32.0812 3548 NetTcpPortSharing - ok
    02:29:32.0859 3548 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
    02:29:32.0875 3548 Nla - ok
    02:29:32.0906 3548 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
    02:29:32.0921 3548 Npfs - ok
    02:29:32.0984 3548 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
    02:29:33.0000 3548 Ntfs - ok
    02:29:33.0015 3548 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
    02:29:33.0031 3548 NtLmSsp - ok
    02:29:33.0109 3548 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
    02:29:33.0125 3548 NtmsSvc - ok
    02:29:33.0171 3548 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
    02:29:33.0187 3548 Null - ok
    02:29:33.0203 3548 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    02:29:33.0218 3548 NwlnkFlt - ok
    02:29:33.0250 3548 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    02:29:33.0250 3548 NwlnkFwd - ok
    02:29:33.0375 3548 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
    02:29:33.0406 3548 odserv - ok
    02:29:33.0468 3548 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    02:29:33.0468 3548 ose - ok
    02:29:33.0546 3548 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys
    02:29:33.0546 3548 Parport - ok
    02:29:33.0625 3548 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
    02:29:33.0625 3548 PartMgr - ok
    02:29:33.0671 3548 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
    02:29:33.0671 3548 ParVdm - ok
    02:29:33.0765 3548 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
    02:29:33.0765 3548 PCI - ok
    02:29:33.0796 3548 PCIDump - ok
    02:29:33.0812 3548 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
    02:29:33.0828 3548 PCIIde - ok
    02:29:33.0859 3548 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
    02:29:33.0859 3548 Pcmcia - ok
    02:29:33.0875 3548 PCTINDIS5 - ok
    02:29:33.0906 3548 PDCOMP - ok
    02:29:33.0921 3548 PDFRAME - ok
    02:29:33.0953 3548 PDRELI - ok
    02:29:33.0968 3548 PDRFRAME - ok
    02:29:34.0015 3548 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys
    02:29:34.0015 3548 perc2 - ok
    02:29:34.0046 3548 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys
    02:29:34.0062 3548 perc2hib - ok
    02:29:34.0156 3548 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
    02:29:34.0156 3548 PlugPlay - ok
    02:29:34.0203 3548 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
    02:29:34.0203 3548 PolicyAgent - ok
    02:29:34.0250 3548 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
    02:29:34.0250 3548 PptpMiniport - ok
    02:29:34.0265 3548 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
    02:29:34.0281 3548 ProtectedStorage - ok
    02:29:34.0312 3548 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
    02:29:34.0312 3548 PSched - ok
    02:29:34.0343 3548 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
    02:29:34.0359 3548 Ptilink - ok
    02:29:34.0437 3548 [ 40FEDD328F98245AD201CF5F9F311724 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
    02:29:34.0437 3548 PxHelp20 - ok
    02:29:34.0484 3548 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys
    02:29:34.0484 3548 ql1080 - ok
    02:29:34.0562 3548 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
    02:29:34.0562 3548 Ql10wnt - ok
    02:29:34.0593 3548 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys
    02:29:34.0593 3548 ql12160 - ok
    02:29:34.0640 3548 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys
    02:29:34.0656 3548 ql1240 - ok
    02:29:34.0687 3548 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys
    02:29:34.0687 3548 ql1280 - ok
    02:29:34.0734 3548 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
    02:29:34.0734 3548 RasAcd - ok
    02:29:34.0796 3548 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
    02:29:34.0812 3548 RasAuto - ok
    02:29:34.0843 3548 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    02:29:34.0843 3548 Rasl2tp - ok
    02:29:34.0875 3548 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
    02:29:34.0906 3548 RasMan - ok
    02:29:34.0921 3548 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    02:29:34.0937 3548 RasPppoe - ok
    02:29:34.0953 3548 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
    02:29:34.0968 3548 Raspti - ok
    02:29:35.0046 3548 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
    02:29:35.0046 3548 Rdbss - ok
    02:29:35.0078 3548 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    02:29:35.0078 3548 RDPCDD - ok
    02:29:35.0140 3548 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
    02:29:35.0156 3548 rdpdr - ok
    02:29:35.0250 3548 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
    02:29:35.0250 3548 RDPWD - ok
    02:29:35.0328 3548 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
    02:29:35.0343 3548 RDSessMgr - ok
    02:29:35.0453 3548 [ 96EFEC24346A8EB1157E80523079ADDC ] RealNetworks Downloader Resolver Service C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
    02:29:35.0453 3548 RealNetworks Downloader Resolver Service - ok
    02:29:35.0500 3548 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
    02:29:35.0515 3548 redbook - ok
    02:29:35.0578 3548 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
    02:29:35.0578 3548 RemoteAccess - ok
    02:29:35.0609 3548 RimUsb - ok
    02:29:35.0687 3548 [ 2C4FB2E9F039287767C384E46EE91030 ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys
    02:29:35.0687 3548 RimVSerPort - ok
    02:29:35.0718 3548 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys
    02:29:35.0718 3548 ROOTMODEM - ok
    02:29:35.0765 3548 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
    02:29:35.0781 3548 RpcLocator - ok
    02:29:35.0843 3548 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll
    02:29:35.0859 3548 RpcSs - ok
    02:29:35.0875 3548 RSUSBSTOR - ok
    02:29:35.0937 3548 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
    02:29:35.0953 3548 RSVP - ok
    02:29:36.0000 3548 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
    02:29:36.0015 3548 rtl8139 - ok
    02:29:36.0031 3548 Rts516xIR - ok
    02:29:36.0062 3548 [ 0B2D5D2341437D7D7E1A6C7BBCE3786A ] SahdIa32 C:\WINDOWS\system32\Drivers\SahdIa32.sys
    02:29:36.0062 3548 SahdIa32 - ok
    02:29:36.0140 3548 [ 7A5F65B16249AF2BC9D18D815F5D7172 ] SaibIa32 C:\WINDOWS\system32\Drivers\SaibIa32.sys
    02:29:36.0140 3548 SaibIa32 - ok
    02:29:36.0234 3548 [ E333C9515822DE586A3FF759A0C9B7BF ] SaibVd32 C:\WINDOWS\system32\Drivers\SaibVd32.sys
    02:29:36.0234 3548 SaibVd32 - ok
    02:29:36.0265 3548 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
    02:29:36.0281 3548 SamSs - ok
    02:29:36.0312 3548 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
    02:29:36.0328 3548 SCardSvr - ok
    02:29:36.0390 3548 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
    02:29:36.0406 3548 Schedule - ok
    02:29:36.0437 3548 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
    02:29:36.0437 3548 Secdrv - ok
    02:29:36.0468 3548 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
    02:29:36.0484 3548 seclogon - ok
    02:29:36.0562 3548 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
    02:29:36.0578 3548 SENS - ok
    02:29:36.0593 3548 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys
    02:29:36.0609 3548 Serial - ok
    02:29:36.0734 3548 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\DRIVERS\sfloppy.sys
    02:29:36.0734 3548 Sfloppy - ok
    02:29:36.0843 3548 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
    02:29:36.0859 3548 SharedAccess - ok
    02:29:36.0906 3548 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
    02:29:36.0906 3548 ShellHWDetection - ok
    02:29:36.0921 3548 Simbad - ok
    02:29:36.0953 3548 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys
    02:29:36.0968 3548 sisagp - ok
    02:29:37.0000 3548 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
    02:29:37.0015 3548 SLIP - ok
    02:29:37.0062 3548 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys
    02:29:37.0062 3548 Sparrow - ok
    02:29:37.0140 3548 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
    02:29:37.0140 3548 splitter - ok
    02:29:37.0203 3548 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
    02:29:37.0218 3548 Spooler - ok
    02:29:37.0328 3548 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\WINDOWS\system32\Drivers\sptd.sys
    02:29:37.0328 3548 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: CDDDEC541BC3C96F91ECB48759673505
    02:29:37.0328 3548 sptd ( LockedFile.Multi.Generic ) - warning
    02:29:37.0328 3548 sptd - detected LockedFile.Multi.Generic (1)
    02:29:37.0406 3548 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
    02:29:37.0406 3548 sr - ok
    02:29:37.0484 3548 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
    02:29:37.0500 3548 srservice - ok
    02:29:37.0546 3548 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
    02:29:37.0562 3548 Srv - ok
    02:29:37.0609 3548 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
    02:29:37.0625 3548 SSDPSRV - ok
    02:29:37.0734 3548 [ F10F876ACBCA088F666AE6DF920B2B24 ] STacSV c:\program files\idt\wdm\STacSV.exe
    02:29:37.0750 3548 STacSV - ok
    02:29:37.0875 3548 [ 4F500B19D3E5E7D0FFB4488E404A95B4 ] STHDA C:\WINDOWS\system32\drivers\sthda.sys
    02:29:37.0937 3548 STHDA - ok
    02:29:38.0031 3548 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
    02:29:38.0046 3548 stisvc - ok
    02:29:38.0093 3548 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    02:29:38.0093 3548 streamip - ok
    02:29:38.0125 3548 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
    02:29:38.0140 3548 swenum - ok
    02:29:38.0187 3548 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
    02:29:38.0187 3548 swmidi - ok
    02:29:38.0218 3548 SwPrv - ok
    02:29:38.0250 3548 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys
    02:29:38.0250 3548 symc810 - ok
    02:29:38.0296 3548 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys
    02:29:38.0296 3548 symc8xx - ok
    02:29:38.0328 3548 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys
    02:29:38.0328 3548 sym_hi - ok
    02:29:38.0359 3548 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys
    02:29:38.0375 3548 sym_u3 - ok
    02:29:38.0406 3548 [ 8DA49473F997D4C5D821F1E358F94F2D ] SynTP C:\WINDOWS\system32\DRIVERS\SynTP.sys
    02:29:38.0421 3548 SynTP - ok
    02:29:38.0437 3548 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
    02:29:38.0453 3548 sysaudio - ok
    02:29:38.0515 3548 [ 9C1C6212623484331CCE11EBBBFA3139 ] SysCow C:\WINDOWS\system32\drivers\syscow32x.sys
    02:29:38.0531 3548 SysCow - ok
    02:29:38.0593 3548 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
    02:29:38.0609 3548 SysmonLog - ok
    02:29:38.0703 3548 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
    02:29:38.0718 3548 TapiSrv - ok
    02:29:38.0812 3548 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
    02:29:38.0828 3548 Tcpip - ok
    02:29:38.0875 3548 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
    02:29:38.0875 3548 TDPIPE - ok
    02:29:38.0921 3548 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
    02:29:38.0921 3548 TDTCP - ok
    02:29:39.0000 3548 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
    02:29:39.0015 3548 TermDD - ok
    02:29:39.0062 3548 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
    02:29:39.0093 3548 TermService - ok
    02:29:39.0140 3548 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
    02:29:39.0156 3548 Themes - ok
    02:29:39.0203 3548 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys
    02:29:39.0203 3548 TosIde - ok
    02:29:39.0250 3548 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
    02:29:39.0265 3548 TrkWks - ok
    02:29:39.0343 3548 [ 1BE0FF3E8B21A8A809491C331C09B1C7 ] tStLibG C:\WINDOWS\system32\drivers\tStLibG.sys
    02:29:39.0343 3548 tStLibG - ok
    02:29:39.0390 3548 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
    02:29:39.0406 3548 Udfs - ok
    02:29:39.0453 3548 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys
    02:29:39.0453 3548 ultra - ok
    02:29:39.0515 3548 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
    02:29:39.0531 3548 Update - ok
    02:29:39.0562 3548 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
    02:29:39.0578 3548 upnphost - ok
    02:29:39.0640 3548 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
    02:29:39.0656 3548 UPS - ok
    02:29:39.0687 3548 [ 1B611611C28D2DF25BC057D79C6F13FC ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    02:29:39.0703 3548 usbccgp - ok
    02:29:39.0718 3548 USBCCID - ok
    02:29:39.0781 3548 [ 4BAC8DF07F1D8434FC640E677A62204E ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
    02:29:39.0781 3548 usbehci - ok
    02:29:39.0812 3548 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
    02:29:39.0812 3548 usbhub - ok
    02:29:39.0859 3548 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
    02:29:39.0859 3548 usbprint - ok
    02:29:39.0937 3548 [ F8EDE2B6928970DCE3D5614C27D9E7F6 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
    02:29:39.0937 3548 usbscan - ok
    02:29:40.0031 3548 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    02:29:40.0031 3548 USBSTOR - ok
    02:29:40.0109 3548 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    02:29:40.0125 3548 usbuhci - ok
    02:29:40.0171 3548 [ 813236B1183CFCF289E367BD5DE6E29E ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
    02:29:40.0187 3548 usbvideo - ok
    02:29:40.0218 3548 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
    02:29:40.0234 3548 VgaSave - ok
    02:29:40.0265 3548 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys
    02:29:40.0281 3548 viaagp - ok
    02:29:40.0328 3548 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys
    02:29:40.0328 3548 ViaIde - ok
    02:29:40.0359 3548 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
    02:29:40.0375 3548 VolSnap - ok
    02:29:40.0406 3548 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
    02:29:40.0421 3548 VSS - ok
    02:29:40.0453 3548 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
    02:29:40.0468 3548 W32Time - ok
    02:29:40.0515 3548 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
    02:29:40.0515 3548 Wanarp - ok
    02:29:40.0609 3548 [ BBCFEAB7E871CDDAC2D397EE7FA91FDC ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys
    02:29:40.0625 3548 Wdf01000 - ok
    02:29:40.0656 3548 WDICA - ok
    02:29:40.0703 3548 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
    02:29:40.0703 3548 wdmaud - ok
    02:29:40.0781 3548 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
    02:29:40.0796 3548 WebClient - ok
    02:29:40.0906 3548 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
    02:29:40.0921 3548 winmgmt - ok
    02:29:40.0984 3548 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
    02:29:41.0000 3548 WmdmPmSN - ok
    02:29:41.0031 3548 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    02:29:41.0046 3548 WmiAcpi - ok
    02:29:41.0093 3548 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
    02:29:41.0093 3548 WmiApSrv - ok
    02:29:41.0203 3548 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
    02:29:41.0234 3548 WMPNetworkSvc - ok
    02:29:41.0281 3548 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
    02:29:41.0281 3548 WpdUsb - ok
    02:29:41.0453 3548 [ 15673BD0B86150CB8E27766059C72A9B ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
    02:29:41.0484 3548 WPFFontCache_v0400 - ok
    02:29:41.0578 3548 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\System32\wscsvc.dll
    02:29:41.0593 3548 wscsvc - ok
    02:29:41.0609 3548 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    02:29:41.0625 3548 WSTCODEC - ok
    02:29:41.0671 3548 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
    02:29:41.0687 3548 wuauserv - ok
    02:29:41.0765 3548 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    02:29:41.0765 3548 WudfPf - ok
    02:29:41.0781 3548 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    02:29:41.0796 3548 WudfRd - ok
    02:29:41.0828 3548 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
    02:29:41.0843 3548 WudfSvc - ok
    02:29:41.0906 3548 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
    02:29:41.0921 3548 WZCSVC - ok
    02:29:41.0984 3548 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
    02:29:42.0000 3548 xmlprov - ok
    02:29:42.0031 3548 ================ Scan global ===============================
    02:29:42.0078 3548 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
    02:29:42.0156 3548 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
    02:29:42.0203 3548 [ 69AE2B2E6968C316536E5B10B9702E63 ] C:\WINDOWS\system32\winsrv.dll
    02:29:42.0234 3548 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
    02:29:42.0250 3548 [Global] - ok
    02:29:42.0250 3548 ================ Scan MBR ==================================
    02:29:42.0281 3548 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
    02:29:43.0562 3548 \Device\Harddisk0\DR0 - ok
    02:29:43.0562 3548 ================ Scan VBR ==================================
    02:29:43.0593 3548 [ 4551FCE0420EFD31BB86D83D17FE8A07 ] \Device\Harddisk0\DR0\Partition1
    02:29:43.0609 3548 \Device\Harddisk0\DR0\Partition1 - ok
    02:29:43.0609 3548 ============================================================
    02:29:43.0609 3548 Scan finished
    02:29:43.0609 3548 ============================================================
    02:29:43.0640 2416 Detected object count: 1
    02:29:43.0640 2416 Actual detected object count: 1
    02:31:32.0906 2416 sptd ( LockedFile.Multi.Generic ) - skipped by user
    02:31:32.0906 2416 sptd ( LockedFile.Multi.Generic ) - User select action: Skip
    02:31:46.0406 1280 Deinitialize success

  10. #10
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Good, your fine


    Where going to run a fix with OTL, post the results from the fix and then run a new scan with OTL and post the new log. Take your time as I may be away until sometime tomorrow .

    Make sure you get this all, it has to start with :OTL and end with [Reboot]

    Open OTL.exe
    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

      Code:
      :OTL
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
      IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.key-find.com/web/?type=ds&ts=1396235048&from=tugs&uid=SAMSUNGXHM160HI_S18PJDNSA10144&q={searchTerms}
      IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
      IE - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.key-find.com/?type=hp&ts=...S18PJDNSA10144
      FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\lspeaker@lyricsspeaker.net: C:\Program Files\LyricsSpeaker\120.xpi
      File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\{EC966AAA-1510-4C02-8EB0-B42AD0C25E8B}
      File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\{F0E59437-6148-4A98-B0A6-60D557EF57F4}
      File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\ADDON@DEFAULTTAB.COM
      File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\KENNETH\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YTASW4HQ.DEFAULT\EXTENSIONS\APPBAR@ALOT.COM
      [2014/03/30 23:04:11 | 000,000,551 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\key-find.xml
      O3 - HKU\S-1-5-21-2420282109-1773090242-3309790634-1007\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
      O4 - HKLM..\Run: [Auction Auto Bidder] File not found
      [2014/03/30 23:05:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Application Data\key-find
      [2014/03/30 23:03:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\kenneth\Start Menu\Programs\Weather Alerts
      
      
      :Services
      
      :Reg
      
      :Files
      ipconfig /flushdns /c
      
      
      :Commands
      [purity]
      [resethosts]
      [EMPTYJAVA] 
      [emptytemp]
      [start explorer]
      [Reboot]
    • Then click the Run Fix button at the top. <--Not run Scan
    • Let the program run unhindered, reboot when it is done
    • Then post the results of the log it produces


    Then run a new scan with OTL and post the new log please
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •