Explore topic-wise InterviewSolutions in .

Found this MESSAGE about half way into a file called productcontext 1200. Should I be worried? Computer is running fine and all scans mbam, sasw,and sbsd COME up clean.


Hello, I'm your 32bit Impersonated custom action serverNo, It has been there a long time.
Almost any AV would have flagged it by now.Thanks for LOOKING, that's a relief

Hi, I have virus/malware problems that BitDefender does not seem able to deal with. Their support staff keeps asking for more information, but seems at a loss.

You guys once mentioned a free anti-virus program that was very effective. Could you repeat that information for me?

Thanksavast is goodavira free is goodMake sure you uninstall the old one first before you install the new one. It is never good to have more than one antvirus on your computer.

Avast: http://www.avast.com/eng/avast_4_home.html (make sure you register for the free code)

or

AVG: http://download.cnet.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10320142.html?part=dl-10044820&subj=dl&tag=button&cdlPid=11014801If you're having malware/virus issues it would be best to have your computer cleaned first. Go to the first thread in this forum and do what it SAYS and post the logs here.AVG is very good and very popular, I have been using computers since 2001 and I have not had one virus yet I'm quite proud. xQuote from: crog13 on December 01, 2009, 09:08:24 AM

AVG is very good and very popular, I have been using computers since 2001 and I have not had one virus yet I'm quite proud. x

avg takes up a lot of room and slows the pc down

Okay, let's not turn this into a "best anti virus" thread - there are enough of those. The OP asked for a good, free AV. The first two responses answered his question perfectly. Not sure why there was any need for anything after that

Hi,

I posted a log in Computer Hardware Forum, and was suggested I might have malware, so have carried out the tests and scans recommended by evilfantasy, and would like some advice.

I am still experiencing the fan on almost continously.

Logs attached:
SuperAntispyware
Malwarebytes' Anti-Malware
HijackThis

---------------------------------------------------------------------------------------------------------------

PREVIOUS POST October 15, 2009, 12:43:59 PM
Yesterday I started experiencing my laptop display blanking, then received a display driver error in notification menu. Unfortunately, the only bit of the error I got was "display driver nvl.." or something.

I rebooted, Windows didn't start properly, then ran "Startup REPAIR" (a Vista autmated scan? not sure) which concluded "unspecified changes to system configuration might have caused the problem" and recommended restoring to a System Restore point, which I click OK to.

Got to desktop ok, but the same error happened again re display driver (sorry, I didn't think to write it down).

I also at this point got another diagnosis application from Vista giving me errors with the Display driver, the specifics for the info on this are:

-----------------------------------
Product
Windows

Problem
Video hardware error

Date
14/10/2009 20:13

Status
Not Reported

Description
A problem with your video hardware caused Windows to stop working correctly.

Problem signature
Problem Event Name: LiveKernelEvent
OS Version: 6.0.6001.2.1.0.256.1
Locale ID: 2057

Files that help describe the problem
WD-20091014-2012.dmp
sysdata.xml
Version.txt

Extra information about the problem
BCCode: 117
BCP1: 84D1A3E8
BCP2: 8BA07350
BCP3: 00000000
BCP4: 00000000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 256_1
----------------------------------------------

I have copies of the other "files wthat help describe the problem", although I can't open the .dmp file.

Other things I then tried:
In Device Manager, I checked the Display adaptor, it was showing as working correctly. The driver files were showing from 2007. I clicked "update Driver" (Display Adaptor: NVIDIA GeForce 8400N GS), Windows searched for a driver for a while and began install.

But the screen then crashed: grey colour with vertical lines. Also the fan started going on for 4 seconds, off for 4 seconds, on and off like that. I forced a reboot but really from then on I could'nt see anything on the screen.

Thinking it might be just the display affected, and the normal BOOT up might be visible 'underneath' it, I pressed F8, then Enter, hoping to start a Safe Boot. The screen did change slightly, I think maybe it did something. But I still couldn't see anything so I just shut down.

I left it overnight to today, and switching on I could reboot, it ran the Startup Repair, again suggesting a System Restore. This time I didn't accept. It kept scanning with "attempting repair" I think, then rebooted itself and I could log on to Windows. However, now the fan is on continuously, although I can log on and apparently USE everything ok.

Note on checking the Display Adaptor driver now, it is:Date: 03/09/2008.

Current System information on Monitor is attached in Word Doc "System Information - Monitor.doc"

I am not sure what to do next. I am not aware of a "scan" I can do to check for problems. I am fairly
computer literate, working in IT support, although not the strongest on hardware faults.


-----------------------
System information:
OS Name: Microsoft Windows Vista Ultimate
Version: 6.0.6001 Service Pack 1 Build 6001
System Manufacturer: Dell Inc.
System Model: XPS M1330
System Type: X86-based PC
Processor: Intel Core 2 Duo CPU T8100 @ 2.10GHz
BIOS Version/Date: Dell Inc A09, 03/02/2008
Installed Physical Memory (RAM): 2.00 GB

-----------------------




Any suggestions greatly appreciated,

Heywogr


--------------------------------------------------------------------------------------------------------
PREVIOUS POST October 17, 2009, 10:23:08 AM
Hi, does anyone have any ideas on what I can do to solve this?

I've done an MBAM (Malwarebytes' AntiMalware) and it picked up a Win32/Cryptor and a Trojan.TDSS, and seemed to clear ok.

When I start in Safe Mode with Networking, it starts ok, everything seems fine. When I start normally, the fan just goes continuously or on/off. Does that mean it's a driver/service issue, or a virus?


[Saving space, attachment deleted by admin]it looks like you have a few problems and i think a keylogger has got into your pc

wait for an expert to help you , harryHi,

Sorry, I know there a thing about not bumping up your thread to have it looked at, but it's been over 5 weeks since I posted asking for help. I realise people are busy and do this voluntarily etc but if it's not going to be answered for weeks on end or even COMMENTED on that it's in a queue, it just gets annoying. What's the point of supporting or offering support, you might as well just say "don't post any requests for help for the time being until we have cleared our backlog" or something.

If no-one's going to look and and provide any assistance for the keylogger or any other issues I might have, I'll just close this post down in resignation in a few days.

Closing this topic as mentioned above. A wee bit disappointed...Nobody understands why you think a fan always on is a software problem.
Which fan? My old PC has two fans that are always on.
So some hardware experts told you you have malware?
How do you prove that?
I have been working with PC hardware for years ...
and have yet to get a fan infected with Mallarme!

And if I were to write an evil hack to corrupt somebody's fan, which I would not, but if I did...
I would make it turn the fan OFF!

The problem is your post is hard to believe...
unless you can provide m,ore detail. Sounds like hardware failure to me, really.

I don't see anything that could be a keylogger in the logs; they look pretty clean to me.

I had similar issues with a Radeon 7000VE; screen would get a bunch of yellow lines all over in 3d modes and unless I quit right away I'd be unable to see at the desktop either; then the whole thing would seize up. also got a few BSOD errors from it.

used a different video card, and the problems went away.


Since this is a laptop, that's not an option. Only sure-fire test to see if it's really software related is to PERFORM a complete reinstall, and if the problem persists, it's probably a hardware issue.Quote from: BC_Programmer on December 01, 2009, 02:44:55 PM

Sounds like hardware failure to me, really.

I don't see anything that could be a keylogger in the logs; they look pretty clean to me.

I had similar issues with a Radeon 7000VE; screen would get a bunch of yellow lines all over in 3d modes and unless I quit right away I'd be unable to see at the desktop either; then the whole thing would seize up. also got a few BSOD errors from it.

used a different video card, and the problems went away.

Since this is a laptop, that's not an option. Only sure-fire test to see if it's really software related is to perform a complete reinstall, and if the problem persists, it's probably a hardware issue.

Hi, hope someone can help me.

I run a website and it says that it is a ATTACK site when visitors come from google.
My site runs with a CMS and I ' hoping someone can help me with this.

I am willing to pay for help.Don't worry, all our help is free. First off, give us a LINK for your site, then POST your source code of the site here, so we can make sure the site ISN'T an attack site. After one of the malware specialists checks it, you can notify google that the site is infact NOT an attack site. If it is infected, the other EXPERTS can help with the DISINFECTION process and telling google that is now clean.

They've stopped.

Is it possible that there could be traces of the infection still on my external (seeing as it has been unplugged)?You can scan your external drive but first do this before plugging it in.

Panda USB and AutoRun Vaccine

Insert your external drive before you begin. Hold down the Shift key when inserting the flash drive until Windows detects it to bypass the autorun feature. This will keep the autorun.inf from executing automatically.

Download Panda USB and AutoRun Vaccine and save it to your desktop.

* Extract (unzip) the file to your desktop and a folder named USBVaccine will be created.
* Open that folder and double-click on USBVaccine.exe to start the program.
* Click Run
* Click the button to Vaccinate computer.
* Insert your USB flash drive.
* When the name of the drive appears in the dialog box, click the button to Vaccinate USB drive(s).
* Exit Panda USB and AutoRun Vaccine when done.

Note: Computer AutoRun Vaccination will prevent any AutoRun file from running, regardless of whether the removable device is INFECTED or not. USB Vaccination disables the autorun file so it cannot be read, modified or replaced by malicious code. The Panda Resarch Blog advises that once USB DRIVES have been vaccinated, they cannot be reversed except with a format. If you do this, be sure to back up your data files first or they will be lost during the formatting process.

----------

Let's clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done.

* Click START then RUN
* Now type COMBOFIX /Uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter.

The above procedure will:
* Delete: ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

----------

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• UPDATE anything listed.

I know that there currently is another thread on this, but as most forums do no condone hijacking other people's threads I decided it was best to make my own.

Whenever I do a search on Google(or any other website for that matter) the link I click on leads me to the incorrect page. Most of the pages that I am redirected to are advertisements, but some of them have been harmful pages that AVG has blocked me from viewing.

I should probably mention that for some reason I can't get into Safe Mode, but that is for another thread, another time. Unless it's somehow related...

Anyway, I FOLLOWED the directions on the first post, and here are the results.


Step 1: Add or Remove Programs
Nothing fishy looking in here.

Step 2: House Cleaning
Ran CCleaner.

Step 3: SUPERAntiSpyware

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/14/2009 at 10:56 PM

Application Version : 4.29.1002

Core Rules Database Version : 4162
Trace Rules Database Version: 2086

Scan type : Complete Scan
Total Scan Time : 01:10:24

Memory items scanned : 433
Memory threats detected : 0
Registry items scanned : 4737
Registry threats detected : 0
File items scanned : 115778
File threats detected : 0


Step 4: Malwarebytes Anti-MALWARE (MBAM)

Malwarebytes' Anti-Malware 1.41
Database version: 2949
Windows 5.1.2600 Service Pack 3

10/14/2009 10:05:58 pm
mbam-log-2009-10-14 (22-05-58).txt

Scan type: Quick Scan
Objects scanned: 91871
Time elapsed: 12 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Step 5: Update Your Java (JRE)
Updated Java and ran JavaRa.

Step 6: HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:10:20 pm, on 10/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SUPERAntiSpyware\caa73f0e-a377-4e7b-8a12-7099d1f02c89.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: (no NAME) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ACTIVEX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "E:\Program Files\RocketDock\RocketDock.exe"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://service.futuremark.com/virtualmark/tc/MSC3.cab
O16 - DPF: {E5ABEB00-B357-4884-9949-77B2C71A7EE3} (BoardCtl Class) - http://www.intel.com/design/motherbd/boardid/BoardID.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG9IDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 5852 bytes


So, how do I rid myself of this annoyance?
Hi HollowNobody, can you please go these following sites:
http://www.kaspersky.com/
http://www.eset.com/
http://www.avira.com/

Just a try. Check if you can access the above websites.Your HijackThis reportThanks for the reply.
Yes, I am able to access the websites listed. Quote from: HollowNobody on October 15, 2009, 03:14:49 PM

Thanks for the reply.
Yes, I am able to access the websites listed.

please do not touch your hjt log report and wait for an EXPERT to help you , getting bad help could harm your pc

C:\Program Files\SUPERAntiSpyware\caa73f0e-a377-4e7b-8a12-7099d1f02c89.exe

Did you rename SUPERAntiSpyware with that name?

After quarantining both of them nothing happens: no reboot, no dialog boxes, nothing.

Hi,

I am having trouble using google on Internet Explorer 8. The LINKS that are brought up when using google take me to random sites or spoof spyware and malware site. I have gone through the Steps that are instructed on here and i removed a couple of trojans and some spyware that come onto my laptop but the problem still persists. I do know that there was also FILES in my registery but these have been removed now aswell and when i run each scan etc the system is showing as clear of any spy/malware.

Could anyone possibly give me any other solutions to fixing the problem, i am currently using firefox just now and there is no problems with google. I could continue to use firefox but it is so slow on my computer its nearly impossible to use. I have did roll IE8 back and reinstall it but nothing changed when i DONE this.

I have posted my log files below.


Thanks for anyhelp yous can give



Malwarebytes' Anti-Malware 1.42
Database version: 3396
Windows 6.0.6000
Internet Explorer 8.0.6001.18865

21/12/2009 13:34:13
mbam-log-2009-12-21 (13-34-13).txt

Scan type: Quick Scan
Objects scanned: 91840
Time elapsed: 12 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No MALICIOUS items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:20, on 21/12/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\SYSTEM32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\sniper.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SBAMTray] C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe
O4 - HKLM\..\Run: [SBRegRebootCleaner] C:\Program Files\Sunbelt Software\VIPRE\SBRC.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O13 - Gopher Prefix:
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/selftest/en/Prg/ESTPTest.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/VistaMSNPUplden-gb.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: VIPRE Antivirus + Antispyware (SBAMSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 6445 bytes

Avira are making a two-year-for-one offer for their Premium Security Suite and I was wondering if this would be worth while.
For the past year or so I have had their Anti Virus Personal Free version and have no problems with that. The paid-for version has extras - anti spy/malware/phishing and FIREWALL etc. At the moment I also have the free versions of SuperAntispyware, Malwarebytes and Windows Firewall, which I presume I would not need if everything was covered by one umbrella, as it were.

Advice appreciated.

I have Windows Vista Home Premium.I use Kasperski Anti Virus, Spyware Blaster for passive malware protection on the browsers, scan with MalwareBytes & SUPER Antispyware every few weeks, and I use a router with a NAT. The only firewall I have is the one provided with Windows. I've never USED a 3RD party firewall. I also create an image of my system partition several times a week (don't overlook the security protection provided by backup images!!).

So to answer your question, if you feel it's worthwhile, then it is. If you're behind a router and use Windows' firewall, it's probably not needed though.i to get the offer but why take it , i have the same security as you plus ccleaner and thats all you need for a clean pc , go to tools and turn on the phishing filter , harrySorry Harry - but once again - ccleaner has nothing to do with security and I still have no idea what a "clean pc" is.Quote from: Allan on December 20, 2009, 01:40:57 PM

Sorry Harry - but once again - ccleaner has nothing to do with security and I still have no idea what a "clean pc" is.

Okay harry - it's Christmas week - I don't want to get into an argument about ccleaner

okay, I have done the other scans too

[Saving space, attachment deleted by admin]Thank you. Please do this:

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
(Description: INTEL hotkey applet. Unnecessary. Removing this will free up a small amount of system resources.)

O4 - HKLM\..\Run: [ISUSScheduler] \"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe\" -start
(Description: InstallShield updater - not needed at startup. Removing this may free up system resources.)

O4 - HKLM\..\Run: [TkBellExe] \"C:\Program Files\Common Files\Real\Update_OB\realsched.exe\" -osboot
(Description: RealPlayer scheduler. Completely unnecessary. Removing this entry will free up a small amount of system resources.)

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
(Description: For fuji cameras - only needed when you are going to uninstall the software.)

O4 - Global Startup: InterVideo WinCinema Manager.lnk.disabled
(Description: This is a shortcut that has been disabled. You may remove this without any ill effects.)

O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.

In your next reply please include the ESET Online Scan Logokay, I have done this scan also.
I have done so many scans that you have asked. I'm surprised that each scan keeps finding something new just when I thought the computer was finally clean!

[Saving space, attachment deleted by admin]Hello haus_kat. Infection removal can be a long and tedious process but it looks as if you're in the clear. I just need you to run another HJT scan and paste it here.okay, here is the hjt log. thanks for helping!

[Saving space, attachment deleted by admin]Hello haus_kat. You HJT log looks good and if there are no other issues, we'll do some clean-up.

Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone HOME" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

You can uninstall HJT. SAS & MBAM can be kept and update and run them about once a week to keep your computer clean.

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /uninstall in the runbox
* Then hit Enter

To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.

Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like FIREFOX.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Safe Surfing. I don't understand. I installed Online Armor days ago (mentioned in a previous post) and it was running when I did HJT scan. I have been unable to remove ComboFix. It won't uninstall because it says that Microsoft Security Essentials prevents it or something.

I have SpywareBlaster and I also got WOT some time ago but it just disappeared one day by itself. I guess you can only have one app at a time on FireFox? I installed another one after WOT and then I didn't see WOT there any more.Quote

I don't understand. I installed Online Armor days ago (mentioned in a previous post) and it was running when I did HJT scan.

I found and deleted everything except for C:\Combo-Fix folder and C:\Combo-Fix-quarantined-files.txt I searched for them but the computer found nothing with those names.

Hello! It looks like I am another victim of a Malaware/Spyware. Here are my symptoms:
- By visiting a dubious website, I noticed that my firewall detected that a lot of new programs were asking for Internet access. I declined those requests.
- I also noticed that everytime I tried to access programs like Notepad, Task Manager, I would get the following message: "application cannot be executed. The file is infected. Please activate your antivirus software".
- MOREOVER, everytime I tried to access www.bleepingcomputer.com or www.malaware.org, my browser would get redirected to a site that basically said "I have a virus"
- I ran HijackThis (2.0.2) and realized that \windows\system32\winupdate86.exe was one of the culprits. I cleaned that registry entry using HijackThis and deleted the file. This fixed some of the problems but the next time I rebooted, I had no internet connection and everytime I tried to install Malaware bytes, the setup program would crash. To fix that, I used System Resotre in XP to backup to a GOOD version of the OS and that seemed to give me back the Internet access and allowed me to install Malaware Bytes.
- Next, I ran Malaware bytes which found four problems, including Trojan Vundo. I have attached the log.
- Next, I ran DDS and I have attahced DDS.txt and Attach.txt
- I have also attached the log file from GMER, gmer.txt
- I could not run ComboFix as that seems to be unavailable right now.
- My concern is that by System Restore, I disabled loading the malaware but it's still lurking on the computer. I also read that the Trojan associated with the message, "application cannot be executed. The file is infected. Please activate your antivirus software", steals financial data.
- Do you guys see anything in the logs attached? I will really appreciate any help.

Here are the logs, which were generated in this order: MBAM.txt (malwarebytes), DDS.txt, Attach.txt, GMER.txt, Hijackthis.

GMER.txt:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-17 08:13:41
Windows 5.1.2600 SERVICE Pack 2
Running: 9l86u5c9.exe; Driver: C:\DOCUME~1\Gaurav\LOCALS~1\Temp\uxtyrpow.sys


---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xED41C78A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xED41C821]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xED41C738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xED41C74C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xED41C835]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xED41C861]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xED41C8CF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xED41C8B9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xED41C7CA]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xED41C8FB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xED41C80D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xED41C710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xED41C724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xED41C79E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xED41C937]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xED41C8A3]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xED41C88D]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xED41C84B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xED41C923]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xED41C90F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xED41C776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xED41C762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xED41C877]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xED41C7F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xED41C8E5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xED41C7E0]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xED41C7B4]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- DEVICES - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee PERSONAL Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \FileSystem\Fastfat \Fat BA22CC8A

AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- EOF - GMER 1.0.15 ----


[Saving space, attachment deleted by admin]

Now Micorsoft Outlook is not functioning correctly - upon starting, it doesn't do anything (keyboard shortcuts do not work)

If i minimize it using winkey+D or alt-tab i cannot bring it back up again,
and the MOUSE can't click on it (it vanishes when it is moved over outlook)

I restarted the computer twice to no avial. Any ideas?Looks good.

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > PROGRAMS > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

I'm not sure,maybe i could try to remove them.
O4 - HKCU\..\Run: [\VIE11.exe] C:\Windows\System32\VIE11.exe
O8 - Extra context menu item: Add to QQ Customized Panel - C:\Program Files\Tencent\QQ\AddPanel.htm
We can remove them if you don't know what they are. There are so many I would think it is a leftover from the virus.

Let me work up a fix real quick while you are doing the other steps.i notice that the porn SIGN and ms antivirus icon always at my desktop.
but i couldn't find the program at add/remove program
and the html balck scrren window always pop upok.after remove all VIE and QQ related key
it seems ok after reboot.
here is the updated:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:19 PM, on 25-Aug-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\nipalsm.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\RK Launcher\RKLauncher.exe
C:\WINDOWS\FlyakiteOSX\Software\Alt+Q Hotkey.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcrobatInfo.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: IE7pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IE7pro\IE7pro.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\System Files Updater.exe /S
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RK Launcher] C:\Program Files\RK Launcher\RKLauncher.exe
O4 - HKCU\..\Run: [Alt+Q Hotkey Tool] C:\WINDOWS\FlyakiteOSX\Software\Alt+Q Hotkey.exe
O4 - HKCU\..\Run: [MSCalsClocks] C:\Program Files\Microsoft Chinese Date & Time\ICalClk.exe
O4 - Startup: eCentral.lnk = C:\Program Files\Eshasoft\Calendar and Day Planner (USA Edition)\eCentral.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7pro\IE7pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.sheepshow.com.tw
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://webmail.ges.com.sg/iNotes6W.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207181156285
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207185880443
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EE884C7D-21A0-49EA-B6F2-61ACF4E226F6} (Microsoft Office Live Workspace Upload Tool) - http://workspace.office.live.com/Misc/Microsoft.OfficeLive.Workspace.RichUpload.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Windows_IE7.0 - Unknown owner - C:\WINDOWS\IE7.0.exe (file missing)

--
End of file - 9373 bytes
OK I found another one.

Name IE7.0.exe http://isc.sans.org/diary.html?storyid=2537

----------

Go to Start > Run, and copy/paste the following blue text into the Open box:

sc stop Windows_IE7.0

Now click OK then enter the next line:

sc DELETE Windows_IE7.0

Now click OK

----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

Download JavaRa and unzip it to your desktop.

• Double-click on JavaRa.exe to start the program.
  
• Click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. You can close it, you won't need to post it.
• Delete the JavaRa .zip .exe and .html files from the Desktop

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it yourself.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the RADIO button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

I've been noticing a lot of people online getting caught up in this program, so I thought I would post some links about it...

http://blog.trendmicro.com/fake-antivirus-trojans-ramping-up
http://sunbeltblog.blogspot.com/2008/08/new-rogue-power-antivirus-2009-uses.html

If you TAKE a LOOK at the screenshots, you'll see that it looks a lot like a cross between AVG and Comodo.I'm glad those pictures don't look familiar.I was curious this AFTERNOON and installed ONE in Sandboxie. It started to immediately "find" all sorts of weird files. It's so thorough that it can even detect infections that don't exist!

I've heard good things about both. Please help me choose between them, with your own list of opinions thank you.

I just need a good solid Anti Virus program, and my computer will be set : )Well, I've always been partial to AVG. The newest version has been having a lot of issues, though. I still use it as my primary anti-virus, but I don't recommend it nearly as often. I think your best bet is to try out each program for a few days (don't have them installed at the same time) and see which one you like better. Either way, you should have a decent amount of protection.Sorry Chris we were posting at the same time.


My views....

AVG

It's been around for a long time and is trusted to do a good job but with the recent version 8.0 there have been, for some users, multiple problems that aren't easily fixed. It can be HEAVY on resources for some and does use more than Avast.

Avast!

Light weight and does a good job in detecting and cleaning malware. The argument goes both ways for which is best. It ALSO has the option of doing a memory scan which is very good. On a personal level I like that it has skins. http://www.avast.com/eng/skins.html

You also can't count out Avira. I've seen a few people whos opinions matter say that it is now the best. But the TABLES always turn when it comes to AV's. One month one is better and the next it is RUNNING in second or third place.

Below is a list of the few free AV's that are trustworthy.

Remember to only install one antivirus!

1) Avast! Home Free Edition
2) AVG Free Edition
3) Avira AntiVir Personal
4) Comodo Antivirus
5) PC Tools AntiVirus Free Edition

While you are at it you may as well install a good free firewall as well.


1) Comodo (Uncheck during INSTALLATION "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" if you choose this one)
2) Online Armor
3) Sunbelt/Kerio
4) Agnitum
5) PC Tools Firewall Plus

And here we have...

--Computer 2--



[recovering disk space -- attachment deleted by admin]Download Malwarebytes' Anti-Malware (MBAM)

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Then click Finish.
  
• If an update is found, it will download and install the latest VERSION.
• Once the program has loaded, SELECT Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by CLICKING the Logs tab in MBAM.
• Copy and Paste the entire report in your next reply.

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  
• Accept any prompts. A log will appear (JavaRa.log), please post the contents of this log on the forum.
• Open JavaRa.exe again and select Search For Updates.
  
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Are you running Kaspersky firewall and Symantec AV?

• Go to your desktop and double click on the removal tool and then click Setup.
  
• Once open Click Next
  
• Accept the license agreement and click Next
  
• Type in the letters/numbers that you see into the text box then click Next.
  
• Then click Next and the tool will start running.
  
• Once finished restart the PC and run the tool again to ensure everything has been removed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Can someone pls help me with my logs. Thanks!

[recovering disk SPACE -- attachment deleted by admin]You should remove this entry with HJT...

O3 - TOOLBAR: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no FILE)

Other than that, you look clean to me. Are you EXPERIENCING any problems?

The only thing I see is that you need a firewall. You're vulnerable without a firewall, so you should look into getting either ZoneAlarm, Kerio Personal Firewall, or Comodo. They're all good free firewalls. Just be sure you only have one installed at a time! Download the firewall of your choice, disconnect from the internet, DISABLE Windows Firewall, and install your new firewall.

I ran superantispyware and malwarebytes in it, and just gave me cookies i needed to remove. Here is HJT log.....does it look clean? also, what do i need to update and what can i remove to make this puppy run faster? This is my aunt's computer...

Logfile of Trend Micro HIJACKTHIS v2.0.2
Scan saved at 10:09:59 AM, on 8/21/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\WEBROOT\Spy Sweeper\SpySweeper.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\cidaemon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search PAGE = http://my.netzero.net/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll
F3 - REG:win.ini: load= C:\PROGRAMS\ALDUS\PIPELINE\remind.exe
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Dell QuickSet] "C:\Program Files\Dell\QuickSet\QuickSet.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] "C:\Program Files\Common Files\Dell\EUSW\Support.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\MESSENGER\msmsgs.exe" /background
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114350035926
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1212803914825
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 6410 bytes


THANKS!

~Iamtonsoffun247O yea also I dont even see java on this computer. She uses Netzero as her internet connection, so Im not sure If i need that or not....Looks fine.

You might want to run this. http://www.malwarebytes.org/startuplite.phpWill that pretty much let me remove most of those 04 files? I just dont know which ones I can remove StartUpLite will tell you which ones are not needed.I know i keep askin dumb questions lol but does the comp need java? It doesnt have any on it at all.... Depends on what all the PC is used for. It never hurts to have it just in case.

http://www.java.com/en/download/index.jsp

anti virus 2008 there are 3 files in (C:\documents and settings\joe\local settings\teporary internet files\ )that i cant find or get to to delete. trend and Avg keep showing they are there but are unable to get them off my computer.

thank you for any help your able to give me.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:07 AM, on 8/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Use ViDown to download - C:\Program Files\ViDown\vd_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.msn.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191105959644
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218041048750
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 6319 bytes


Malwarebytes' Anti-Malware 1.25
Database version: 1070
Windows 5.1.2600 Service Pack 3

9:08:31 AM 8/19/2008
mbam-log-08-19-2008 (09-08-31).txt

Scan type: Quick Scan
Objects scanned: 44892
Time elapsed: 4 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data ITEMS Infected: 0
Folders Infected: 12
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\rhclr0j0en9c (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\joe\Application Data\Microsoft\dtsc (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\rhclr0j0en9c\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\joe\Application Data\Microsoft\dtsc\s (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\joe\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/19/2008 at 08:42 AM

Application Version : 4.15.1000

Core Rules Database Version : 3540
Trace Rules Database Version: 1529

Scan type : Complete Scan
Total Scan Time : 00:51:54

Memory items scanned : 421
Memory threats detected : 0
Registry items scanned : 6515
Registry threats detected : 1
File items scanned : 69330
File threats detected : 2


Rogue.AntiVirus 2008 Pro
HKU\S-1-5-21-57989841-261478967-725345543-1003\Software\antivirus 2008 pro
C:\Documents and Settings\joe\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus-2008pro.lnk
sorry i fixed the post
Welcome to CH.

I (as well as Microsoft, McAfee and Symantec) recommend that you DO NOT have more than one antivirus product installed and running on your computer at a time.

The real-time protection of two antivirus programs may conflict with each other and cause the following:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) Conflicts: Your system may lock up DUE to both products attempting to access the same file at the same time.
3) Performance: More that one antivirus will cause your PC to become slow and it may even crash or blue screen.

I strongly SUGGEST you either configure only one antivirus program to enable automatic real-time scanning, and leave the rest disabled, using them for on-demand scanners or go to Start > Control Panel > Add or Remove Programs and uninstall all but one antivirus program.

Now run a new HijackThis scan and post the log.If I were you, I would ditch Antivirus 2008...
http://www.bleepingcomputer.com/malware-removal/remove-xp-antivirus-2008-2009ok new logs and droped AVG

think its all clean. i still got avg hits in my restore files befor i droped down to one virus program.





SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/20/2008 at 10:01 AM

Application Version : 4.15.1000

Core Rules Database Version : 3541
Trace Rules Database Version: 1530

Scan type : Complete Scan
Total Scan Time : 00:42:45

Memory items scanned : 345
Memory threats detected : 0
Registry items scanned : 6516
Registry threats detected : 0
File items scanned : 68834
File threats detected : 0



Malwarebytes' Anti-Malware 1.25
Database version: 1072
Windows 5.1.2600 Service Pack 3

10:08:37 AM 8/20/2008
mbam-log-08-20-2008 (10-08-37).txt

Scan type: Quick Scan
Objects scanned: 45085
Time elapsed: 3 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:29 AM, on 8/20/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Use ViDown to download - C:\Program Files\ViDown\vd_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.msn.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191105959644
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1218041048750
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 5587 bytesLooks good now.

Next: Set a New Restore Point to prevent possible reinfection from an old one.

Please go to: Start -> All Programs -> Accessories -> System Tools -> System Restore -> System Restore Settings
Click to add a check mark beside Turn off System Restore and click Apply
When you are warned that all existing Restore Points will be deleted, click Yes to continue and wait a few moments to let System Restore clear.
Uncheck "Turn off System Restore"
Click "Apply," and then click "OK".

You can find more detailed instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

Hi, i can't download updates from Microsoft Update. I don't know what happened. Below are the results and problems:


Review Your Installation Results

The software upgrade is complete
You can now use the website to find and install the latest updates for your computer.

Continue


More high-priority updates are available
Your computer might be at risk until you install them. Check for the remaining updates and install them now.

Express

Restart now to finish installing updates
Your computer will not be up to date until you restart it. Please save any open files, photos or documents and restart now.



Installation Summary

Successful: 0
Failed: 1
Remaining: 19


--------------------------------------------------------------------------------

Successful Updates


--------------------------------------------------------------------------------


Failed Updates
For help installing an update successfully, see the solution under each problem description.


Problem: End User License Agreement (EULA) Not Accepted
Solution: Check for updates again and wait while you install updates. You will be asked to accept the EULA before any updates with a EULA can be installed.

Problem: Not Enough Disk Space
Solution: To make more space available, run the Disk Cleanup tool or uninstall any programs that you don’t use. For directions, see Help and Support on your computer.

Problem: Automatic Updates is currently installing updates
Solution: Please wait until Automatic Updates is complete and then check your update history. At that time, if the update has failed to install, you can try installing it from the website.
Note: To view Automatic Updates progress, click the updating icon in your System Tray.

Problem: Please check your update history for a description.

Problem: A problem on your computer is preventing updates from being downloaded or installed
Solution: To fix the problem, try installing the updates again. If that doesn't work, use the Troubleshooter to try solve the problem.

Microsoft Windows XP
Windows XP Service PACK 3 (KB936929)


--------------------------------------------------------------------------------


Remaining High-Priority Updates
Your computer might be at risk until you install all high-priority updates. These updates help protect against security threats and performance problems.


Microsoft Windows XP
Critical Update for Office XP on Windows XP Service Pack 2 (KB885884)
Security Update for Windows XP (KB901190)
Security Update for Internet Explorer 7 for Windows XP (KB938127)
Security Update for Windows XP (KB950749)
Update for Windows XP (KB932823)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Cumulative Security Update for ActiveX Killbits for Windows XP (KB953839)
Windows Malicious Software Removal Tool - August 2008 (KB890830)
Security Update for Outlook Express for Windows XP (KB951066)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB952954)
Cumulative Security Update for Internet Explorer 7 for Windows XP (KB953838)
Security Update for Windows XP (KB950974)
Update for Windows XP (KB951072)
Update for Windows XP (KB952287)

Microsoft Office 2002/XP
Office XP Service Pack 3

Please go HERE<< and do Step 4: Malwarebytes' Anti-Malware (MBAM) and Step 6: HijackThis.

Post the two LOGS when complete.Hi. the logs are as attached. Thanks!

[recovering disk space -- attachment deleted by admin]Open HijackThis and SELECT Do a system scan only.

Place a check mark next to the following entries: (if there)

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis and restart the computer.

----------

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
When FINISHED ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFixAttached are the logs.

[recovering disk space -- attachment deleted by admin]Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.

• Click Start , then Run
  
• Type notepad.exe in the Run Box.
  

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Quote

New bug found in Browsers - Berth of In-session PHISHING

Am having problems with computer. We know there's a hardware problem (whatever "senses" the CPU and system temperature is very nutty...one second it says the system is 200 degrees (F) and shuts off the computer; the next it says it's 32 degrees (F) and shuts down again). Sometimes it works fine; other times not. Am looking to see if there are any software issues which aren't causing a problem with the system, too. (Like, why does this darn thing SHUT down almost every time I look at myspace?) Can anyone analyze the HijackThis log and make any suggestions? I'm on Win XP with Service Pack 3. (Computer is a Compaq PRESARIO desktop, if that makes a difference.)

Many thanks to everyone...

AmbrosiaSigh...I guess it helps if I actually post the log here? LOL!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:34:18 PM, on 1/13/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: NormalRunning processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IPOD\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet SETTINGS,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231711913437
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Hello,

My computer is acting up and i have run my Malwarebytes and Superantispy and the reports are as follows but still acting up... The report logs were run in safemode... Any thoughts?

Malwarebytes' Anti-Malware 1.20
Database version: 957
Windows 5.1.2600 Service Pack 3

11:54:52 AM 1/9/2009
mbam-log-1-9-2009 (11-54-52).txt

Scan type: Full Scan (C:\|)
OBJECTS scanned: 90725
Time elapsed: 20 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



And the other

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/09/2009 at 12:30 PM

Application Version : 4.15.1000

Core RULES Database Version : 3469
Trace Rules Database Version: 1460

Scan type : Complete Scan
Total Scan Time : 00:33:58

Memory items scanned : 229
Memory threats detected : 0
Registry items scanned : 5899
Registry threats detected : 0
File items scanned : 19228
File threats detected : 10

Adware.Tracking Cookie
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][2].txt
C:\Documents and Settings\Administrator\Cookies\[emailprotected][1].txt



my compter goes to the blue screen and white writing sayin gi need to reload software... Any ideas on how to fix?

thanks for your time...not in safe mode:

Hijack this report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:58:22 PM, on 1/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\PROGRAM Files\Common Files\Virtual Token\vtserver.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
C:\Program Files\ThinkVantage\AMSG\Amsg.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\IBM ThinkVantage\Client SECURITY Solution\cssauth.exe
C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcMurocHlpr.exe
C:\Program Files\IBM ThinkVantage\Common\Logger\logmon.exe
C:\Program Files\IBM ThinkVantage\Client Security Solution\pwmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [ControlCenter] "C:\Program Files\ThinkVantage Fingerprint Software\ctlcntr.exe" /startup
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER
O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe
O4 - HKLM\..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [cssauth] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauth.exe" silent
O4 - HKLM\..\Run: [PDService.exe] "C:\Program Files\IBM ThinkVantage\SafeGuard PrivateDisk\pdservice.exe"
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks\osCheck.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [amsg] C:\Program Files\ThinkVantage\AMSG\Amsg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206561896640
O18 - Filter hijack: text/html - {1438f0e7-f9aa-4e1d-9189-cffc7e8e63b8} - (no file)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IPS Core Service (IPSSVC) - Lenovo Ltd. - C:\WINDOWS\system32\IPSSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate NOTICE - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe
O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe
O23 - Service: Protector Suite Virtual Token (vtserver) - UPEK Inc. - C:\Program Files\Common Files\Virtual Token\vtserver.exe

--
End of file - 13470 bytes
anyone?help please?As you can tell, the reason people aren't responding is because if you bump your own thread, it takes LONGER for them to come and help you.Quote from: BatchRocks on January 13, 2009, 12:44:02 PM

As you can tell, the reason people aren't responding is because if you bump your own thread, it takes LONGER for them to come and help you.

Hi,

I see a process called bgsvcgen.exe in the task manager and it's labelled as a system process.

It's supposedly B's Recorder GOLD LIBRARY General Service file associated with B.H.A. Corporation, which seems to be a legitimate program, but the fact is, I have NEVER installed anything by B.H.A. Corporation and this process can be terminated manually but appears on normal reboot.

And I have seen reports of a virus of same name. What should I do? I can post HJT log if needed.

I have Sophos Antivirus, Windows Defender and PC Tools Spyware Doctor Starter Edition actively checking my computer and so far, they're not picking up anything serious.

Any input? Thanks!!B's Recorder GOLD Library General Service (bgsvcgen) http://www.systemlookup.com/O23/377-bgsvcgen_exe.html

Program FAQ page. http://www.bha.co.jp/en/support/index.htmlI read bgsvcgen.exe is installed in conjunction with TMPGEnc DVD Author 3 with DivX Authoring. I have that program installed and I use it. So hpefully that's the case and not a virus It looks to be safe. I couldn't find anything bad on it.thanks!When you find suspicious files you can easily check them to see if they are malicious or not.

How to scan suspicious filesThanks. Well, I got virustotal to use. They've got the program that you can send file to so they can do the scanning. It's like their website but straight from wndows.

Anyhow, I have sophos antivirus provided by school and school network is protected by it and I trust it's good.VirusTotal is an excellent resource! Besides being informative if you scan a file that isn't yet been identified then they will alert all of the VENDORS who participate. Therefore getting the bad files included in the next updates to the antivirus software. Good stuff!the thing I like about virustotal is that it gives multiple opinions so if majority opinions say it's a virus, it's most likely a virus and not a false positive. so that's GOOD!!

Ok, about a week ago my laptop was running like crap and then I posted on here about it. I followed the malware thread and did this and taht and my laptop boots up a little FASTER than before.

Now my problem is when I try and do the start and shut down my laptop just sits there thinking about shuting down, so I get to the point of doin a hard boot which I hate to do.

Now about the antivirus, I have symantic and it is updated and then when doing malware removal I got the superantispyware, but now I am reading a froum talking about Dr. Webb CURE IT. I am hopeless AROUND the whole thing and need to find out the best way and the best antivirus avaliable so that I dont have diffrent programs fighting each other to TAKE over.

Thanks for the help in advance.Dr. Webb CURE IT is a stand alone antivirus scanner. It does not offer real-time protection. You can update and run it any time with no problems.

Superantispyware will work fine alongside any antivirus.

Quote from: CBMatt on January 05, 2009, 04:59:38 PM

I don't see anymore infections. How are things running now?

The COMPUTER is STILL running good. I want to thank you for the help you given me to CLEAN everything off.

How do I go about getting McAfee off my computer? I didn't SEE anything to uninstall it.You're welcome. If you would like to remove McAfee, they have a removal tool that works pretty well. Try following the steps on this page and see if it helps you...
HTTP://service.mcafee.com/FAQDocument.aspx?id=TS100507&lc=1033

My computer was acting very SLOW, so I tried to RUN some adaware/registry cleaner programs. Halfway through, I got bluescreened. I ran the computer again, and attempted to run anti-virus. Again, it crashed. I then tried to run the computer in SAFE mode, and ran adaware, anti-virus, etc.. before any of them completed, it crashed again. I am not sure what to do more than STARTING it in safe mode. It's a laptop, I don't know if it's still connecting to the internet wirelessly, or if that has anything to do with it even. It's running Windows Vista, and I don't know what to do short of reinstalling it, which I really don't have TIME for right now with work. Any help would be greatly appreciated!
You should never use any registry cleaners!

Go to Safe Mode (F8 method), and try and system restore to a week.

My Norton Anti-Virus EXPIRED a few weeks ago and since then I've acquired new friends. I have installed a new Norton 360 but still have all this great company. A few of my symptoms are:

-Slow system/freezing

-black desktop with malware alert

-When my browser goes to open a computer file such as uploading a PHOTO or attaching a fie IE completely SHUTS down.

-malware pop up and scan

-after scanning with the recommended programs and reboot my computer freezes upon reboot so I have to shut it down more than a few times to get it going, THUS reinstalling all the malware I just deleted.

-oddly enough my keyboard response just got really slow and I'm having to retype a lot of words.

I know there isn't much hope for my computer but I'd like to do what I can before I gut it. Here are my logs, I actually have to attach them from another computer.







[attachment deleted by admin]try throwing norton and getting avg through a jump drive like mcafee norton is junk

get these too
1
malware bytes
2
hijack this
download links
avg
http://www.download.com/3001-2239_4-10320142.html?spi=c6a00dc2c57e3d03813c92c940088fcb
malware bytes
http://www.download.com/3001-8022_4-10804572.html?spi=b1b548b4e61bf3eb026e7756c93f9f6f
hijack
http://www.download.com/3001-8022_4-10227353.html?spi=ae764de1cc0c51494aac9139b3fca9d3

ps LET one of the experts take care of hijack by posting a log

Hi all,

I am new to this site and appreciate all the help you can give me. I was attempting to remove some malware from my computer. I restarted to safe mode, but when PROMPTED for password, the correct password was not accepted. I tried "administrator" with a blank password, but that did not work either. What are my alternatives to logging back in to the computer. Also, the computer only boots up in safe mode, so I am essentially locked out for the time being. I have also tried to START windows normally through the F8 key to no avail.

Thanks in advance!well ATLEAST you can get into safe mode

ok you need to get malware bytes and hijackthis then run a scan and such and such

also post logs

p.s. they work in safe modeSorry I MAY have typed incorrectly. The computer only boots up in safe mode, but when it does not the correct password. I type in the CURRENT password only to get an error message. I have also tried the "Administrator" account to no avail.CH rules don't allow us to help with passwords.

i got an e-mail from a member ( as i thought ) of CH but it was a spam letter looking for money and to help him him with his families money

how was it possible for him to know i was a member and get my e-mail address , unless he to has joined CH

HARRYQuote from: harry 48 on January 11, 2009, 02:05:03 PM

unless he to has joined CH

could he have joined to get addresses

i'm only asking , should i remove my address from my profile

Something is weird. You did a fresh install and immediately you have 15 pups? What AV are you using. This sounds more like a problem with the SSD. Do you have the proper drivers? Can you motherboard support the SSD?And those pups appeared immediately after I turned the internet on. Av is Bit Defender.

I've had this problem for some time, changed hard drive for a ssd, reinstalled win7 from original

CD, installed drivers from CD from Dell. Everything SEEMED fine until I connected the modem

Which was the only device on line. The start button was greyed out, Security center, updates and

Now the keyboard won't work. I'm on a tablet again.







There are more problems on this computer that I can repair remotely. Someone with a LOT of computer experience will have to take a hands on approach to repair this problem. I still believe it's a hardware problem. Did you check your Device Manager to see if there are any yellow warning icons?Morning, Dave;

I finally removed the DSS and CMOS battery, cleaned the drive with factory software and reflashed the BIOS.

Reinstalled everything, OS from factory disks and nothing else, no usb drives or SD cards.

So far, all looks good. Scanners that detected IAT HOOKS, no longer find anything. We may

have , finally cleaned this machine!

Thanks for all your time and effort, Dave. I'll let you know how it GOES.

That is good news. I'll leave this thread open and you can let me know how it goes.

You can check the spec. on that computer but it looks like it's running hot. Can you tell if the fan is running?
You may be able to test your hard drive with Speedfan. Just click the SMART button.Hi. I was able to do the smart button on speedfan. I don't see how to get this info to you so I will type what I see. It shows 38C on the HD 0 with a blue downward arrow. The next box shows 40C Temp1 with a green check. The next box shows 50C CORE ) with the flame. The next box is HD 0 97%..The next 2 boxes show CPU at 15% Then it jumps to 25% then31% then 8%. That changes really fast.
The fan does run alot. In fact most of the time. I did some work on the services but I need to go back and do more there. ThanksDid you try cleaning the notepad?I am sorry but I don't understand what you mean Something is causing you NOTEBOOK to overheat. Did you try cleaning the vents?Yes, i have USED canned air on it. Nothing came out and I don't think it has helped anything. I click on the program speed fan to automatic run the fan. It now shuts off and then later comes on. It doesn't run when I am not using the netbook. But the temp has not changed. Or should I not keep it on auto? Would adding more memory HELP? Thanks
You should have this heating problem looked at by a computer tech. Installing more RAM won't help with this problem.ok. I will do that. Thanks so much for helping me. The computer is running better than when i FIRST came here so you helped me a bunch. Thanks again. I will take this netbook and have it looked at. You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.

Ill start by letting you know im a super-beginer, so please bear with me.

My PC froze and shutdown on its own. Upon restart, it got to the part where the green bar moves across and says MICROSOFT, on a black screen background, but never goes any further. I can (and am doing this) in safe mode with networking. This issue has OCCURED before, but the pc usually just starts normally if i reboot enough times. And it wont happen again for many months. This time, many reboots has not fixed the problem.

Here are the 4 files requested:
Please note, that the eventviewer has around 6000 entries in it since 2009, around 20 errors from this recent reboot.

Thanks!

Mike.

-------------------------------------------------------------------------------

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.03.14.03

Windows Vista Service Pack 2 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Administrator :: MIKE-PC [administrator]

3/14/2013 12:15:35 AM
mbam-log-2013-03-14 (00-15-35).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232588
Time elapsed: 3 minute(s), 1 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
----------------------------------
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 5/8/2009 5:25:39 PM
System Uptime: 3/14/2013 7:46:42 PM (1 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P6T
Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz | LGA1366 | 2672/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 466 GiB total, 223.639 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 466 GiB total, 437.876 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
µTorrent
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 8.3.1
Adobe Shockwave Player 11.6
AMD APP SDK Runtime
AMD Catalyst Install Manager
Apple Software Update
ATI AVIVO64 Codecs
ATI Catalyst Registration
avast! Free Antivirus
Batman: Arkham City™
Battlefield: Bad Company 2
BearShare
BioShock 2
BitTorrent
Borderlands
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
Compatibility Pack for the 2007 Office system
Counter-Strike
Creative Audio Control Panel
Creative Software AutoUpdate
Creative Sound BLASTER Properties x64 Edition
CrossLoop 2.60
D3DX10
Day of Defeat
Dual-Core Optimizer
EA Download Manager
F.E.A.R. 2: Project Origin
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Half-Life 2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HydraVision
Java Auto Updater
Java(TM) 6 Update 37
Junk Mail filter update
Malwarebytes Anti-Malware version 1.70.0.1100
Media Player Codec Pack 4.0.0
Mesh Runtime
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Easy Assist v2
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Mozilla Firefox 4.0.1 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 4.0 SP3 Parser (KB973685)
NirSoft BlueScreenView
NVIDIA PhysX
PhotoScape
PMB
PMB Updater
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Segoe UI
Sound Blaster Audigy
SpywareBlaster 4.2
Steam
swMSM
System Requirements Lab CYRI
Team Fortress 2
Team Fortress Classic
Trillian
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VLC media player 1.0.3
Windows 7 Upgrade Advisor
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Wise Registry Cleaner 5.9.4
WMI Tools
Wolfenstein(TM) 1.1 Patch
Wolfenstein(TM) 1.1 Patch
Xvid 1.1.3 final uninstall
YTD YouTube Downloader & Converter 3.6
.
==== End Of File ===========================
DDS (Ver_2012-11-20.01) - NTFS_AMD64 NETWORK
Internet Explorer: 9.0.8112.16464 BrowserJavaVersion: 1.6.0_37
Run by Administrator at 20:15:06 on 2013-03-14
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6133.5068 [GMT -4:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\mmc.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://mail.live.com/
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SBAudigy\Volume Panel\VolPanlu.exe" /r
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
mRun: [ATICustomerCare] "c:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
mRun: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRunOnce: [aswAhAScr.dll] "C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe" "C:\Program Files\Alwil Software\Avast5\AhAScr.dll"
mRunOnce: [aswasOutExt.dll] "C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe" "C:\Program Files\Alwil Software\Avast5\asOutExt.dll"
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Open Client to monitor &1 - C:\Windows\web\AOpenClient.htm
IE: Open Client to monitor &2 - C:\Windows\web\AOpenClient.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.5.1.0.cab
TCP: NameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{205CC84C-1B7D-41F6-984D-FBA196BAF95E} : DHCPNameServer = 209.18.47.61 209.18.47.62
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [Windows Defender] C:\Program Files (x86)\Windows Defender\MSASCui.exe -hide
x64-mPolicies-Explorer: NoActiveDesktop = dword:1
x64-mPolicies-Explorer: NoActiveDesktopChanges = dword:1
x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
x64-mPolicies-System: EnableUIADesktopToggle = dword:0
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-3-13 65336]
R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-3-13 178624]
R3 AmdLLD64;AMD Low Level Device Driver;C:\Windows\System32\drivers\AmdLLD64.sys [2012-5-19 39424]
S1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-6-28 1025808]
S1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2009-5-15 377920]
S2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-4-5 236544]
S2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2009-5-15 33400]
S2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2009-5-15 80816]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-6-20 45248]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]
S2 gupdate1c9d65375957529;Google Update Service (gupdate1c9d65375957529);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-5-16 133104]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2011-3-15 428384]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdLH6.sys [2012-2-23 92176]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-2-5 79360]
S3 PerfHost;Performance Counter DLL HOST;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-9-24 89920]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== File Associations ===============
.
FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
2013-03-14 01:46:1173432----a-w-C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-14 01:46:11693976----a-w-C:\Windows\SysWow64\FlashPlayerApp.exe
2013-03-06 22:33:2168920----a-w-C:\Windows\System32\drivers\aswTdi.sys
2013-03-06 22:33:2165336----a-w-C:\Windows\System32\drivers\aswRvrt.sys
2013-03-06 22:33:21377920----a-w-C:\Windows\System32\drivers\aswSP.sys
2013-03-06 22:33:21178624----a-w-C:\Windows\System32\drivers\aswVmm.sys
2013-03-06 22:33:211025808----a-w-C:\Windows\System32\drivers\aswSnx.sys
2013-03-06 22:33:2080816----a-w-C:\Windows\System32\drivers\aswMonFlt.sys
2013-03-06 22:33:2059144----a-w-C:\Windows\System32\drivers\aswRdr.sys
2013-03-06 22:33:2033400----a-w-C:\Windows\System32\drivers\aswFsBlk.sys
2013-03-06 22:32:5141664----a-w-C:\Windows\avastSS.scr
2013-03-06 22:32:22287840----a-w-C:\Windows\System32\aswBoot.exe
2013-03-02 20:42:57215128----a-w-C:\Windows\SysWow64\PnkBstrB.xtr
2013-03-02 20:42:57215128----a-w-C:\Windows\SysWow64\PnkBstrB.exe
2013-02-21 05:40:5470004024----a-w-C:\Windows\System32\mrt.exe
2013-01-17 06:28:58273840------w-C:\Windows\System32\MpSigStub.exe
2013-01-09 01:48:5517812992----a-w-C:\Windows\System32\mshtml.dll
2013-01-09 01:22:2610925568----a-w-C:\Windows\System32\ieframe.dll
2013-01-09 01:19:092312704----a-w-C:\Windows\System32\jscript9.dll
2013-01-09 01:12:291346048----a-w-C:\Windows\System32\urlmon.dll
2013-01-09 01:12:031392128----a-w-C:\Windows\System32\wininet.dll
2013-01-09 01:11:061494528----a-w-C:\Windows\System32\inetcpl.cpl
2013-01-09 01:10:26237056----a-w-C:\Windows\System32\url.dll
2013-01-09 01:09:1085504----a-w-C:\Windows\System32\jsproxy.dll
2013-01-09 01:07:51173056----a-w-C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:50816640----a-w-C:\Windows\System32\jscript.dll
2013-01-09 01:07:47599040----a-w-C:\Windows\System32\vbscript.dll
2013-01-09 01:06:39729088----a-w-C:\Windows\System32\msfeeds.dll
2013-01-09 01:05:452147840----a-w-C:\Windows\System32\iertutil.dll
2013-01-09 01:04:5896768----a-w-C:\Windows\System32\mshtmled.dll
2013-01-09 01:04:422382848----a-w-C:\Windows\System32\mshtml.tlb
2013-01-09 01:00:48248320----a-w-C:\Windows\System32\ieui.dll
2013-01-08 22:23:2512321280----a-w-C:\Windows\SysWow64\mshtml.dll
2013-01-08 22:11:211800704----a-w-C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:09:189738240----a-w-C:\Windows\SysWow64\ieframe.dll
2013-01-08 22:03:571103872----a-w-C:\Windows\SysWow64\urlmon.dll
2013-01-08 22:03:201129472----a-w-C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:121427968----a-w-C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 22:01:48231936----a-w-C:\Windows\SysWow64\url.dll
2013-01-08 22:00:1465024----a-w-C:\Windows\SysWow64\jsproxy.dll
2013-01-08 21:59:02142848----a-w-C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:43717824----a-w-C:\Windows\SysWow64\jscript.dll
2013-01-08 21:58:29420864----a-w-C:\Windows\SysWow64\vbscript.dll
2013-01-08 21:57:49607744----a-w-C:\Windows\SysWow64\msfeeds.dll
2013-01-08 21:56:511796096----a-w-C:\Windows\SysWow64\iertutil.dll
2013-01-08 21:56:3773216----a-w-C:\Windows\SysWow64\mshtmled.dll
2013-01-08 21:56:232382848----a-w-C:\Windows\SysWow64\mshtml.tlb
2013-01-08 21:53:13176640----a-w-C:\Windows\SysWow64\ieui.dll
2013-01-05 05:37:504695400----a-w-C:\Windows\System32\ntoskrnl.exe
2013-01-04 11:31:101423720----a-w-C:\Windows\System32\drivers\tcpip.sys
2013-01-04 01:59:242773504----a-w-C:\Windows\System32\win32k.sys
2012-12-16 13:31:2048128----a-w-C:\Windows\System32\atmlib.dll
2012-12-16 13:12:5434304----a-w-C:\Windows\SysWow64\atmlib.dll
2012-12-16 11:08:21368128----a-w-C:\Windows\System32\atmfd.dll
2012-12-16 10:50:29293376----a-w-C:\Windows\SysWow64\atmfd.dll
.
============= FINISH: 20:17:05.29 ===============
# AdwCleaner v2.114 - Logfile created 03/14/2013 at 20:10:53
# Updated 05/03/2013 by Xplode
# Operating system : Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
# User : Administrator - MIKE-PC
# Boot Mode : Safe mode with networking
# Running from : C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HM7UNEPR\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Program Files (x86)\Free Offers from Freeze.com

***** [Registry] *****

Key Found : HKCU\Software\GreenTree Applications
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}
Key Found : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}
Key Found : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Found : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Found : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Key Found : HKLM\SOFTWARE\Classes\AppID\DiscoveryHelper.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\GIFAnimator.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\IMTrProgress.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\IMWeb.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Key Found : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery
Key Found : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery.1
Key Found : HKLM\SOFTWARE\Classes\imweb.imwebcontrol
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}
Key Found : HKLM\Software\Freeze.com
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Registry is clean.

-\\ Mozilla Firefox v4.0.1 (en-US)

File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\vwh8u60q.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v25.0.1364.172

File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5833 octets] - [14/03/2013 20:10:54]

########## EOF - C:\AdwCleaner[R1].txt - [5893 octets] ##########
Hello and welcome to GeekPolice.Net My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*****************************************************************
Remove the Adware:

• Please close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
  
• Click on Delete.
  
• Confirm each time with OK
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.
  

So i just now ran sfc /scannow as you suggested and it says "the system file repair changes will take effect after the next reboot".

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

• Download RogueKiller on the desktop
  
• Close all the running programs
• Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
  
• Otherwise just double-click on RogueKiller.exe
  
• Pre-scan will start. Let it finish.
• Click on SCAN button.
  
• A report (RKreport.txt) should open. Post its content in your next reply. (RKreport could also be found on your desktop)
  
• If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
  

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Leave the check mark next to Remove found threats.
  

Luckily my pc is running smoothly now, and i may not have a problem for months.

One last question...should i uninstall Java?
I have a request for an update i've been ignoring for weeks...because ive heard java could be trouble.

A scam email was sent to all my contacts in Yahoo Mail. It requested money. I was advised of this by some of my contacts. I sent an email to some contacts saying the email was bogus. I later learned it had been sent to all my contacts. I found the bogus email in my Send box. I the TRIED to send a message to all my contacts, only to learn that the contacts file had been emptied. I also found my draft file had been emptied. T have been trying to change my Yahoo password and use their help services to restore the Draft and Contacts files, with any success. No emails have COME into my Inbox since yesterday. It appears that my Yahoo Mail has been corrupted. Can it be restored?I would say that you should be dealing with Yahoo about this problem.I have now been able to change my Yahoo Mail password. Yahoo Customer Care restored my Contacts list but not the Drafts. I have been able to restore the version of Yahoo Mail that I was using before the NIGERIAN gremlin sent the bogus message and changed the version of Yahoo Mail. "Should I Change My Password" site found that hackers had divulged my Yahoo Mail in December 11 so the gremlin has used that. I have RESUMED normal emailing but with a new password.The problem has occurred again with my Inbox going back two years and Contact, Sent, Draft folders emptied and old version of Yahoo Mail installed. Yahoo Customer Service has been asked to restore the Yahoo Mail that was operating some DAYS ago. I have tried to change my Yahoo Mail password again but that does not work.

Quote

I was using Avast free edition to fight off viruses. HOWEVER, I had nothing installed to fight off malwares.

Good, let's do some cleanup.

Click Start> Computer> right click the C Drive and choose Properties> enter
Click Disk Cleanup from there.



Click OK on the Disk Cleanup Screen.
Click Yes on the Confirmation screen.



This runs the Disk Cleanup UTILITY along with other selections if you have chosen any. (if you had a lot System Restore points, you will see a significant change in the free space in C drive)
**********************************************
This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll MAKE some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create Registry backup
• Purge System Restore Points
• Re-set system settings

I picked this up on my HP laptop at a hotrodding website. I may not have had any protection running but I assume I did. I think it's a phishing tool. It keeps popping up asking to get the full version of AVAsoft to remove the threats. You have to click on 'proceed unprotected' then your website will come up. One post at Microsoft said to boot in protected mode and search for AVAsoft. Then right click for file location and then delete all the items. I did this. It doesn't work. AVA blocks MalwareBytes and Ccleaner. I ran Malwarebytes in safe mode but this did nothing. It did find 10 threats that were removed but not the AVAsoft trojan.I'm not a MALWARE removal specialist. So, you may want to wait for advise from one of this forum's malware removal specialists. However, I will mention some info I found from a search on how to remove AVAsoft trojan. See http://www.slideshare.net/justinmabel/how-to-remove-ava-soft-antivirus-professional and http://malware-protection-steps.blogspot.com/2013/03/how-to-remove-avasoft-antivirus.htmlThanks I'll take a look but from my experience most of these don't work. They sound like they know what they're talking about but when you try it-zero!Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
  
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.
• Hidden Startup Objects
  
• System Memory
  
• Disk Boot Sectors.
  
• My Computer.
  
• Also any other drives (Removable that you may have)
  

I saved the log but now it won't open for some reason and I haven't seen the AVAsoft since then.

• Double click on AdwCleaner.exe to run the tool.
  
• Click on Search.
  
• A logfile will automatically open after the scan has finished.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

• Leave the check mark next to Remove found threats.
  

No can do. I keep just getting the spinny wheel when I click on your link and I went to C net downloads with the same result.

I've been trying to remove this virus with no avail.

The problem: RCMP Ukash virus. When XP (32BIT) attempts to start up, the desktop background appears and nothing else except this fake page telling me to send money to have my PC unlocked (looks like this http://tinyurl.com/cdyb567). There is a SHORT period in which the taskbar and icons do load (during this time I can open up task manager, my computer, etc., this is for about half a minute and then the virus takes over and locks the PC). I am not able to start safe mode.

What I've tried: I've ran the bootable Windows Defender Offline which found a LOT of things and apparently removed them. I've removed the HDD and scanned it with Malwarebytes and Avast which didn't help either. I used the Kaspersky Rescue Disc 10 (bootable) to run a scan (still didn't fix the problem). I used the AVG rescue disc, didn't fix the problem. I used the Anvi Rescue disc and ran a scan... virus still starts up.

All of these scans have detected problems and reported FIXING them but the virus still starts up every-time on reboot (how, I don't know).

Any help would be APPRECIATED!Edit: I've removed the virusQuote from: ARK on April 10, 2013, 08:43:42 PM

Edit: I've removed the virus

Not sure where ELSE this should go, but its the most likely option....

My computer won't let me on any video streaming SITES or video CHATS that I tend to go on FREQUENTLY. (Specifically, watchcartoonsonline.com, gayforum.org, and tinychat), it either gives me a white screen where the page is supposed to be, or a white box where the video box is supposed to be. But it plays YouTube well enough.

I've checked both my JAVA and Adobe systems - they're all up to date.

any help appreciated. Never mind, I found the problem

I didn't do the cables but Firefox does work-if you OPEN the google search and type in whatever. I tried yahoo mail and youtube and it went right there. And with FF I can't use any desktop or toolbar icon as the result is the same lock up or partial page loading. I have to type in using a search box. I should add that once I type in yahoo and go there then it seems like the computer is working normally in that I can click on a LINK and it comes up normally. Please download and run MS Fix-it from here. Click on the Internet Explorer buttonIt seems normal now! A smart screen filter was turned off and other security settings were changed. Now however I get the WARNING that the protected mode for internet is off and the computer is at risk. I tried turning it on but then the same slow and partial page loading recurres. Also I don't get the Realplayer downloader tab pop up at youtube. I went to 'manage add ons' and enabled it but I'm still not seeing it. Maybe I need to restart?Quote

Now however I get the warning that the protected mode for internet is off and the computer is at risk.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

I was trying to. You have to put it on another site somewhere? you can't just paste it from paint?

Quote

If not, who do you like for antivirus...?

• Activate UAC (optional; some users prefer to keep it off)
• Remove disinfection tools
• Create Registry backup
• Purge System Restore Points
• Re-set system settings

Dave, which two AVs are running?Quote from: bluecountry on November 21, 2014, 03:26:26 PM

Dave, which two AVs are running?

McAfee Anti-Virus and Anti-Spyware and Windows Defender

SAS was deleted from the PC two days ago

# AdwCleaner v4.102 - Report created 24/11/2014 at 20:32:57
# Updated 23/11/2014 by Xplode
# Database : 2014-11-24.1 [Live]
# Operating System : Windows 8.1 (64 BITS)
# Username : trent_000 - BERGER-FAMILYPC
# Running from : C:\Users\trent_000\Downloads\adwcleaner_4.102.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\AnyProtectEx
Folder Deleted : C:\Program Files (x86)\globalUpdate
Folder Deleted : C:\Program Files (x86)\predm
Folder Deleted : C:\Users\Sally\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Sally\AppData\Roaming\AnyProtectEx
Folder Deleted : C:\Users\Sally\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
FILE Deleted : C:\END
File Deleted : C:\windows\System32\drivers\netfilter64.sys
File Deleted : C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\user.js

***** [ SCHEDULED TASKS ] *****

Task Deleted : APSnotifierPP1
Task Deleted : APSnotifierPP2
Task Deleted : Optimum_Daily
Task Deleted : Optimum_LogOn

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Deleted : HKCU\Software\Vosteran Browser
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\Tutorials
Key Deleted : HKLM\SOFTWARE\ORBTR
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Salus

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v33.1.1 (x86 en-US)

[hdlorvbn.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[1i5hf411.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[ki1yg8u5.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("FirstSearch.aol_toolbar.search.hasDoneF irst", 2);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.address", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.count", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.id", "value");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.imagelist.layout", "empty");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.popup.autoclose", "true");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.user", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278041900_141676 8702526.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278041900_141676 8702526.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278063195_141676 8734279.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278371845_141676 8736600.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278440671_141668 2304929.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278440671_141668 2304929.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278444534_141676 8729745.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278762192_141676 8751493.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363279015922_141676 8971815.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363279015922_141676 8971815.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363280845986_141676 8767900.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363281565569_141676 8730682.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363282786485_141676 8784760.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363283356442_141676 8795279.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363286610777_141676 8875910.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363286755271_141676 8887541.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363287094576_141676 8840188.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363289304926_141676 8817972.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363375926821_141676 8826738.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368037435872_141676 8744187.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368038170032_141676 8796803.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368553686828_141676 8795785.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376671574068_141676 8782032.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672727443_141676 8810394.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672884370_141676 8809304.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376673250405_141676 8872890.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376674154806_141676 8804564.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376674230239_141676 8775563.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1379079356382_141676 8727920.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1392234206091_141676 8728731.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1416768721742_141676 8723170.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1416768721742_141676 8723170.view", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1416768907947_141676 8908911.view", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1416768935075_141676 8936242.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1416768935075_141676 8936242.view", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.aol_bookmark_button_ 1416683739010.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.defaultview", 1);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.layout", "1363279015922_1416768971815;1416768935075_1416768936242;1416768907947_1416768908911;1363286755271_1416768887541;1363286610777_1416768875910;1376673250405_14167[...]
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.date", "{system.date.timestamp}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.displaydate", "{system.date.locale}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.timestamp", "1416859110992");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.homepage", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.newtab", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.search", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.congrats", "curtain");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.debug", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.historybutton.num", "4");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.protection", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000015&tb_uuid=74C7E95B4EDB41A226C273A79D645826");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid=74C7E95B4EDB41A226C273A79D645826");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.label", "AOL Search");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.url", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=74C7E95B4EDB41A226C273A79D645826&tb_oid=22-11-2014&tb_mrud=22-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.firsttime.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.guid", "{74C7E95B-4EDB-41A2-26C2-73A79D645826}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.active", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.ignoreids", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.homepageprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.homepageprotection.set", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.distroid", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.homepage", "hxxp://www.aol.com/?mtmhp={mtmhp}&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.homepage.label", "AOL.com");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lastTbVersion", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lid", "hyplognew00000010");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.mtmhp", "hyplogusaolp00000015");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.ncid", "download");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.newtab", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.sethomepage", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setnewtab", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setsearch", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.type", "new");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampdate", "24");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampmonth", "10");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampyear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalDate", "22");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalHours", "5");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMinutes", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMonth", "11");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalSeconds", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalYear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presethomepage", "branding");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetnewtab", "about:newtab");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetsearch", "Google");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.relatednews.enabled", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote..xml", "1416859110968");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.config.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.historyconfig.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.publish.xml", "1416773179013");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.searchterm.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.reset.flag", "2");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.reset.style", "A");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.daily.num", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.daily.timestamp", "Sun Nov 23 2014 15:30:47 GMT-0500 (Eastern Standard Time)");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.delay", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.display.limit", "5");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.skip", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.rtw.active", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.button", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.cid", "22-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.focusnewtab", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.instd", "74C7E95B4EDB41A226C273A79D645826");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.newtab", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.oid", "22-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.placement", "right");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.populateoncomplete", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.savehistory", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.searchtype", "web");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.source", "aolrt-ff");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.searchengine.label", "AOL Search");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.searchprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.skin.custom", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.langlocale", "en-US");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.name", "AOL Toolbar");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.uninstallreset", "3");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.upgrade.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.condition", "34");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degc", "22");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degf", "72");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degrees", "F");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.lastupdate", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.locationid", "USDC0001");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.zipcode", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.welcome.new.display", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.layout", "aolmail,calendar,weather");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.timestamp", "1416773184479");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.version", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.winamp.volume", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=74C7E95B4EDB41A226C273A79D645826&tb_oid=22-11-2014&tb_mrud=22-11-2014");
[v12v2egn.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");

-\\ Google Chrome v

[C:\Users\Sally\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Sally\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [35795 octets] - [16/11/2014 14:51:35]
AdwCleaner[R1].txt - [6409 octets] - [16/11/2014 16:27:17]
AdwCleaner[R2].txt - [14201 octets] - [17/11/2014 11:16:11]
AdwCleaner[R3].txt - [18664 octets] - [20/11/2014 12:48:32]
AdwCleaner[R4].txt - [21564 octets] - [24/11/2014 20:28:50]
AdwCleaner[S0].txt - [37789 octets] - [16/11/2014 14:52:56]
AdwCleaner[S1].txt - [6128 octets] - [16/11/2014 16:29:58]
AdwCleaner[S2].txt - [15452 octets] - [17/11/2014 11:20:44]
AdwCleaner[S3].txt - [20282 octets] - [20/11/2014 12:55:00]
AdwCleaner[S4].txt - [23121 octets] - [24/11/2014 20:32:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [23182 octets] ##########

# AdwCleaner v4.102 - Report created 25/11/2014 at 15:27:43
# Updated 23/11/2014 by Xplode
# Database : 2014-11-23.7 [Local]
# Operating System : Windows 8.1 (64 bits)
# Username : trent_000 - BERGER-FAMILYPC
# Running from : C:\Users\trent_000\Downloads\adwcleaner_4.102(1).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v33.1.1 (x86 en-US)

[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.address", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.count", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.id", "value");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.imagelist.layout", "empty");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.popup.autoclose", "true");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.user", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278041900_141694 0021763.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278219404_141694 0025728.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278391072_141694 0020029.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278407974_141694 0022787.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278444534_141694 0025063.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278778581_141694 0027112.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363283356442_141694 0042820.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363283376537_141694 0046830.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363283394411_141694 0044281.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368038170032_141694 0053643.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368553686828_141694 0050580.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368561776583_141694 0043623.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672727443_141694 0059188.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672884370_141694 0060137.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376674154806_141694 0045527.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1382540936208_141694 0032873.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.defaultview", 1);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.layout", "1376672884370_1416940060137;1376672727443_1416940059188;1368038170032_1416940053643;1368553686828_1416940050580;1363283376537_1416940046830;1376674154806_14169[...]
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.date", "{system.date.timestamp}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.displaydate", "{system.date.locale}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.timestamp", "1416946207504");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.homepage", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.newtab", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.cookie.search", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.congrats", "curtain");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.debug", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.historybutton.num", "4");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000015&tb_uuid=B88A84BC399C4AD7BCCA2C048E1C1982");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid=B88A84BC399C4AD7BCCA2C048E1C1982");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.label", "AOL Search");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.url", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=B88A84BC399C4AD7BCCA2C048E1C1982&tb_oid=25-11-2014&tb_mrud=25-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.firsttime.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.guid", "{B88A84BC-399C-4AD7-BCCA-2C048E1C1982}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.active", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.ignoreids", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.homepageprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.distroid", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.homepage", "hxxp://www.aol.com/?mtmhp={mtmhp}&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lastTbVersion", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lid", "hyplognew00000010");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.mtmhp", "hyplogusaolp00000015");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.ncid", "download");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.newtab", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.sethomepage", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setnewtab", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setsearch", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.type", "new");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampdate", "25");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampmonth", "10");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampyear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalDate", "25");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalHours", "5");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMinutes", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMonth", "11");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalSeconds", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalYear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presethomepage", "aol.com");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetnewtab", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid=921C1E4BA31E886176DC289D94DAD466");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetsearch", "Google");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.relatednews.enabled", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote..xml", "1416946207468");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.config.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.historyconfig.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.publish.xml", "1416940003554");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.searchterm.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.skip", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.rtw.active", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.button", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.cid", "25-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.instd", "B88A84BC399C4AD7BCCA2C048E1C1982");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.oid", "25-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.placement", "right");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.populateoncomplete", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.savehistory", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.searchtype", "web");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.source", "aolrt-ff");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.searchprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.skin.custom", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.langlocale", "en-US");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.name", "AOL Toolbar");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.uninstallreset", "3");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.upgrade.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.condition", "34");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degc", "13");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degf", "55");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degrees", "F");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.lastupdate", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.locationid", "USDC0001");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.zipcode", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.welcome.new.display", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.layout", "aolmail,calendar,weather");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.timestamp", "1416940009247");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.version", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=B88A84BC399C4AD7BCCA2C048E1C1982&tb_oid=25-11-2014&tb_mrud=25-11-2014");

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [35795 octets] - [16/11/2014 14:51:35]
AdwCleaner[R1].txt - [6409 octets] - [16/11/2014 16:27:17]
AdwCleaner[R2].txt - [14201 octets] - [17/11/2014 11:16:11]
AdwCleaner[R3].txt - [18664 octets] - [20/11/2014 12:48:32]
AdwCleaner[R4].txt - [21564 octets] - [24/11/2014 20:28:50]
AdwCleaner[R5].txt - [13294 octets] - [25/11/2014 15:12:33]
AdwCleaner[S0].txt - [37789 octets] - [16/11/2014 14:52:56]
AdwCleaner[S1].txt - [6128 octets] - [16/11/2014 16:29:58]
AdwCleaner[S2].txt - [15452 octets] - [17/11/2014 11:20:44]
AdwCleaner[S3].txt - [20282 octets] - [20/11/2014 12:55:00]
AdwCleaner[S4].txt - [23263 octets] - [24/11/2014 20:32:57]
AdwCleaner[S5].txt - [14380 octets] - [25/11/2014 15:27:43]

########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [14441 octets] ##########

I'm wondering too, big picture, at this stage, what do you think is wrong and might this beyond the scope of CH and require an outside technician or do you think we can get get this cleared?

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/25/2014
Scan Time: 7:58:03 PM
Logfile: 11-25bMBAM.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.25.17
Rootkit Database: v2014.11.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: trent_000

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 584340
Time Elapsed: 10 min, 55 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/25/2014
Scan Time: 2:34:04 PM
Logfile: 11-25aMBAM.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.25.12
Rootkit Database: v2014.11.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Sally

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 584472
Time Elapsed: 12 min, 45 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/23/2014
Scan Time: 3:41:43 PM
Logfile: 11-23-MBAM.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.23.09
Rootkit Database: v2014.11.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Sally

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 584335
Time Elapsed: 12 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 4
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1444, Delete-on-Reboot, [40f5dc633844f5416a8d343c39c88b75]
PUP.Optional.SearchProtect, C:\Program Files (x86)\SupTab\Loader64.exe, 5000, Delete-on-Reboot, [c3721e211963ed49dd0100dfe41df60a]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, 4968, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f]
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, 5008, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f]

Modules: 18
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],

Registry Keys: 75
PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, Quarantined, [40f5dc633844f5416a8d343c39c88b75],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\CLSID\{CF0F43AB-9C23-4D7B-8040-201B82844854}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\CLSID\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.IEModule, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.IEModule, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CF0F43AB-9C23-4D7B-8040-201B82844854}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.SWLIEToolbar, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.SWLIEToolbar, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\CLSID\{E4EF8A64-0A30-48F5-B3FE-5FDA978DA775}\INPROCSERVER32, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{917CAAE9-DD47-4025-936E-1414F07DF5B8}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, Quarantined, [b481c17e1d5fa591a29e9f1f19e9b44c],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.IEModule+IECustomCommands, Quarantined, [0530f748f686a88eb8dcbf9925de6799],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.IEModule+IECustomContextMenuCommands, Quarantined, [8fa6a798a3d9270f197b7bddd52ed828],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.PopupForm, Quarantined, [072e51ee106cfd39c9cbaaaef80ba060],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.PopupForm+AltActionClickedEventArgs, Quarantined, [c66fc07f7606e25451433127bf446e92],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.PopupForm+SmileyClickedEventArgs, Quarantined, [989daf907efedd59256f5503f2119c64],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.SWLSettings, Quarantined, [2a0b96a9205c6ec81a7a3d1b4db69868],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\CLASSES\SmileysWeLoveToolbar.WatermarkTextBox, Quarantined, [fb3ad768adcf1b1bfc989abe14efc739],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [bd78c47b7ffdfd391befd7c41fe59070],
PUP.Optional.OneSoftPerDay.A, HKLM\SOFTWARE\WOW6432NODE\ONESOFTPERDAY, Quarantined, [4de81c23483476c050841b2a010232ce],
PUP.Optional.Salus.A, HKLM\SOFTWARE\WOW6432NODE\Salus, Quarantined, [56dff44b7705e84e504f52f71ee53cc4],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, Quarantined, [ad884bf4b7c58ea8666e6cdd3fc4926e],
PUP.Optional.WordProser.A, HKLM\SOFTWARE\WOW6432NODE\WordProser_1.10.0.2, Quarantined, [3ff6fd428def3df94b7a82bd39ca58a8],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.IEModule+IECustomCommands, Quarantined, [bb7a9ea1710b67cf6a2afe5ad132de22],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.IEModule+IECustomContextMenuCommands, Quarantined, [0332d16e7efe4aec3e5674e458abf40c],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.PopupForm, Quarantined, [2015f649bdbf67cf7f15c5939c6733cd],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.PopupForm+AltActionClickedEventArgs, Quarantined, [52e374cb1b6171c53b59d28632d1a759],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.PopupForm+SmileyClickedEventArgs, Quarantined, [a194a49b097392a4fb99e375cd36b050],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.SWLSettings, Quarantined, [60d5b48b4636f244781c3820946f728e],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\SmileysWeLoveToolbar.WatermarkTextBox, Quarantined, [40f5ba85cbb1ae88ddb75afe31d2d42c],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, Quarantined, [df56ea55ea9257df9e7aea68b35025db],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\fjbbjfdilbioabojmcplalojlmdngbjl, Quarantined, [cd687ec14e2e9b9ba915005806fd9e62],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [1124c778037959dd3ad089129d67da26],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, Quarantined, [84b1dd621a621c1a9bd8a111e0245ca4],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, Quarantined, [84b10c33522a62d4e98ba60c2adabd43],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP, Quarantined, [55e056e9b9c3c86e049eb9903fc4dd23],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, Quarantined, [5dd85ce3e19b1a1c3b9890b938cb659b],
PUP.Optional.V9.A, HKLM\SOFTWARE\WOW6432NODE\V9SOFTWARE\v9hp, Quarantined, [082dd8678eee1b1bf1a783f2aa59f30d],
PUP.Optional.WordProser.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\wpnfd_1_10_0_2, Quarantined, [1223a798bbc1ce68547092ada95a7e82],
PUP.Optional.IEPluginServices.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\IePluginServices, Quarantined, [50e5132c1d5f06307d5ffc427f84f60a],
PUP.Optional.CinemaPlus.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\CinPlus-2.4cV23.11, Quarantined, [1d18fb44e8940135490c82c357ac1ae6],
PUP.Optional.SmileysWeLove.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SmileysWeLove, Quarantined, [7fb6cb747705d75f0a8df76142c1bb45],
PUP.Optional.WebSearches.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SupHpUISoft, Quarantined, [3df8251a67152313483c400bbb488a76],
PUP.Optional.Tuto4PC.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\TutoTag, Quarantined, [f54063dca3d90234386e1d958e767090],
PUP.Optional.BlockAndSurf.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\BlockAndSurf, Quarantined, [b67f3c03b7c53ff7a655d6781de6b947],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [c273cf703844290dcbe3a20148bc6f91],
PUP.Optional.Qone8, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, Quarantined, [6bcaee51512ba6907b8e1a8163a1a858],
PUP.Optional.FastStart.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, Quarantined, [d4613f000a726ccaecf6093dbc477e82],
PUP.Optional.SmileysWeLove.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\POPAJAR\SWL, Quarantined, [2c0977c8c1bbed49aaec9eba5fa48a76],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],

Registry Values: 13
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{CF0F43AB-9C23-4D7B-8040-201B82844854}, SmileysWeLoveToolbar.IEModule, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76]
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{CF0F43AB-9C23-4D7B-8040-201B82844854}, SmileysWeLoveToolbar.IEModule, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76]
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{CF0F43AB-9C23-4D7B-8040-201B82844854}, Quarantined, [8ea787b896e63df945a2a94f729017e9],
PUP.Optional.SmileysWeLove.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{CF0F43AB-9C23-4D7B-8040-201B82844854}, Quarantined, [9d9873cc215b00366b7c4cac41c19868],
PUP.Optional.V9.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}, Quarantined, [dc59bd82df9de1550a0f1742f70cf30d]
PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [df56ea55ea9257df9e7aea68b35025db]
PUP.Optional.V9.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}, Quarantined, [340178c7c4b8d165cc4d92c77291b050]
PUP.Optional.OneSoftPerDay.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|ospd_us_370, Quarantined, [e74eca754f2dcf676e6849fc18ebba46],
PUP.Optional.WordProser.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{d9a96531-b093-4d07-9e4c-9704a365c441}, C:\Program Files (x86)\Mozilla Firefox\extensions\{d9a96531-b093-4d07-9e4c-9704a365c441}, Quarantined, [de57bd82d7a5da5c98562b108a7905fb]
PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|[emailprotected], C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\extensions\[emailprotected], Quarantined, [f0458eb19fdd7db96f18ac02ac58dd23]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPDP|dir, C:\Program Files (x86)\SupTab, Quarantined, [55e056e9b9c3c86e049eb9903fc4dd23]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, pjr, Quarantined, [5dd85ce3e19b1a1c3b9890b938cb659b]
PUP.Optional.FastStart.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, [emailprotected], Quarantined, [d4613f000a726ccaecf6093dbc477e82]

Registry Data: 7
PUP.Optional.V9.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}, Good: (www.google.com), Bad: (http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}),Replaced,[88ad90af5923ea4cccd9b79158ad8977]
PUP.Optional.V9.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9, Good: (www.google.com), Bad: (http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9),Replaced,[58ddd46b057761d59e0688c0b451a65a]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[80b559e63844a096a5434909877ef30d]
PUP.Optional.V9.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}, Good: (www.google.com), Bad: (http://search.v9.com/web/?type=ds&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9&q={searchTerms}),Replaced,[43f2ac93374501351590bf89b451fe02]
PUP.Optional.V9.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9, Good: (www.google.com), Bad: (http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9),Replaced,[fe37c679b9c3b086a20227211beac53b]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Replaced,[b1841b240775c1751bcda8aa7a8b8c74]
PUP.Optional.V9.A, HKU\S-1-5-21-1235032525-1032305245-2823617851-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9, Good: (www.google.com), Bad: (http://www.v9.com/?type=hp&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9),Replaced,[57de1c230b71d2643864a4a4050013ed]

Folders: 42
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmileysWeLove for IE, Quarantined, [75c08bb4e4983df9b740f4a10ef69c64],
Rogue.Multiple, C:\ProgramData\2355320829, Quarantined, [1f1685ba0f6daf87c8d4fefde2206e92],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, Delete-on-Reboot, [38fd1f204e2e8ea85066ed33937037c9],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, Quarantined, [38fd1f204e2e8ea85066ed33937037c9],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\jetpack\[emailprotected], Quarantined, [7cb9ad920d6f4de9f645ab764cb753ad],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\jetpack\[emailprotected]\simple-storage, Quarantined, [7cb9ad920d6f4de9f645ab764cb753ad],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\x86, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{F553893C-AE99-4E9E-AA6C-E9EE4E1D2A54}, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW, Quarantined, [f3422d12314bbd795acf2ffab94a619f],

Files: 132
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, Delete-on-Reboot, [40f5dc633844f5416a8d343c39c88b75],
PUP.Optional.SearchProtect, C:\Program Files (x86)\SupTab\Loader64.exe, Delete-on-Reboot, [c3721e211963ed49dd0100dfe41df60a],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader64.dll, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader.dll, Quarantined, [7bba55ea6e0eff379d4a0eeabe448a76],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\SupTab.dll, Quarantined, [f93c2f106814fc3a99fb0bb758aacd33],
PUP.Optional.ClientConnect, C:\ProgramData\Optimizer\program\windows_firefoxupdateperion.exe, Quarantined, [ea4bde61a2dad0664c083f7b1fe27a86],
PUP.Optional.CinemaPlus.A, C:\Users\Sally\AppData\Roaming\PXBM.exe, Quarantined, [e253102f126a43f3e029e1a43fc657a9],
PUP.Optional.CinemaPlus.A, C:\Users\Sally\AppData\Roaming\UU.exe, Quarantined, [3bfae45b7efea294ee1bfe87c63f05fb],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface32.dll, Quarantined, [73c278c76f0df24415b1425e0cf5bc44],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\DpInterface64.dll, Quarantined, [ed487ac58def67cf04c2bfe1bf42926e],
PUP.Optional.IEPluginService.A, C:\Program Files (x86)\SupTab\RSHP.exe, Quarantined, [e15496a91468de58259c85fef20ffd03],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect32.dll, Quarantined, [6dc87cc38eeede58f2d4b4ec5ca508f8],
PUP.Optional.Skytech.A, C:\Program Files (x86)\SupTab\SearchProtect64.dll, Quarantined, [d95c73cc2a52c76f7155693741c09c64],
PUP.Optional.IePluginService.A, C:\Program Files (x86)\SupTab\SupIePluginServiceUpdate.exe, Quarantined, [003593acc2ba9d99ac4bdd93bd44c739],
PUP.Optional.CrossRider.A, C:\Users\Sally\AppData\Local\Temp\setup_424.exe, Quarantined, [fa3b96a99be12610104d2bb0976a6799],
PUP.Optional.SilentInstaller.A, C:\Users\Sally\AppData\Local\Temp\setup_ra.exe, Quarantined, [e550122ddf9df4425f71307348bada26],
PUP.Optional.AddLyrics, C:\Users\Sally\AppData\Local\Temp\2F658057-A565-F64A-D98A-1AE05C625B6D.exe, Quarantined, [092cdb642a5293a32bda2dba6f9250b0],
PUP.Optional.AddLyrics, C:\Users\Sally\AppData\Local\Temp\321D0B64-DA79-1F48-57D5-F28ACE24334D.exe, Quarantined, [5fd6ec53bebee056a46113d460a1827e],
PUP.Optional.ClientConnect, C:\Users\Sally\AppData\Local\Temp\nsa76FA.tmp\FDMClient.dll, Quarantined, [75c0c877403c87af78dc9d1d17eaf808],
PUP.Optional.ClientConnect, C:\Users\Sally\AppData\Local\Temp\nsa76FA.tmp\webapphost.dll, Quarantined, [4ee7231ccdafbf77b89c4a7053aea55b],
PUP.Optional.WordProser.A, C:\Users\Sally\AppData\Local\Temp\ZOG\Setup.exe, Quarantined, [92a3310ee39959dd8b37fbdecd3446ba],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\extensions\[emailprotected], Quarantined, [5ed73f004c308da9700961f3bb48b749],
PUP.Optional.V9.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\v9.xml, Quarantined, [c66fff4019630432b9ddd99c0af9d030],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SmileysWeLove.ico, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\AddinExpress.IE.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\AddinExpress.IE.tlb, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader.dll.manifest, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader.exe, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader64.exe, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxregistrator.exe, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\HtmlAgilityPack.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\Interop.SHDocVw.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\Microsoft.mshtml.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SmileysWeLoveToolbar.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SWLCustomInstaller.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SWLCustomInstaller.InstallState, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SWLHelperLibrary.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SWLSettingsApp.exe, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\SWLSettingsApp.exe.config, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\Program Files (x86)\Smileys We Love Toolbar for IE\System.Net.Json.dll, Quarantined, [e253310ec6b679bd6591f3a239cb6c94],
PUP.Optional.SmileysWeLove.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmileysWeLove for IE\SmileysWeLove Settings for IE.lnk, Quarantined, [75c08bb4e4983df9b740f4a10ef69c64],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, Quarantined, [b0855be4bbc1f541b968b3fd13f1867a],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, Quarantined, [1322251a0b714ceae939d9d7739151af],
PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, Quarantined, [df561d22720abf7746dd7838c14304fc],
PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, Quarantined, [0c29a996ea927cba49db4a663dc7bc44],
Rogue.Multiple, C:\ProgramData\2355320829\BIT908E.tmp, Quarantined, [1f1685ba0f6daf87c8d4fefde2206e92],
PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, Quarantined, [38fd1f204e2e8ea85066ed33937037c9],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\jetpack\[emailprotected]\simple-storage\store.json, Quarantined, [7cb9ad920d6f4de9f645ab764cb753ad],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\BrowserHelper.exe.config, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\BrowserHelper.pdb, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\channel_generic.json.old, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\smileyswelove.xpi, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\smileyswelovetoolbar.crx, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.SmileysWeLove.A, C:\Users\Sally\AppData\Local\Temp\swlfiles\x86\SQLite.Interop.dll, Quarantined, [fe3782bd26560630f7451a0755aeac54],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, Quarantined, [60d5e05fdf9de15504e7b17352b107f9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\GoogleCrashHandler.exe, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\GoogleUpdate.exe, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\GoogleUpdateBroker.exe, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\GoogleUpdateHelper.msi, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\GoogleUpdateOnDemand.exe, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\goopdate.dll, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\goopdateres_en.dll, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\npGoogleUpdate4.dll, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\psmachine.dll, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.GlobalUpdate.A, C:\Users\Sally\AppData\Local\Temp\comh.262967\psuser.dll, Quarantined, [4ce944fbacd03303fd0a3bea57ac17e9],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\HpUI.exe, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\ient.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\install.data, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\Loader32.exe, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcp110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\msvcr110.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\uninstall.exe, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll, Delete-on-Reboot, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\bk_shadow.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\btn.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\close.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\main.xml.bak, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_box.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\ck_check.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_bk.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\skin\image\radio_check.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\data.html, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE.html, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\indexIE8.html, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\main.css, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\ver.txt, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\google_trends.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon128.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon16.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\icon48.png, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\loading.gif, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\img\logo32.ico, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\common.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\ga.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery-1.11.0.min.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\jquery.autocomplete.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\js.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\library.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit-ie8.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\js\xagainit2.0.js, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\en-US\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-419\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\es-ES\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-BE\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CA\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-CH\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-FR\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\fr-LU\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-CH\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\it-IT\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pl\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\pt-BR\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\ru-MO\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\tr-TR\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\vi-VI\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-CN\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.SupTab.A, C:\Program Files (x86)\SupTab\web\_locales\zh-TW\messages.json, Quarantined, [f3422d12314bbd795acf2ffab94a619f],
PUP.Optional.V9.A, C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "http://www.v9.com/newtab/?type=nt&ts=1416773341&from=pjr&uid=WDCXWD10EZEX-60ZF5A0_WD-WMC1S737954079540&i=psd&t=34c7674a9"), Replaced,[6cc9aa95ec9086b05f35adddd82dfe02]

Physical Sectors: 0
(No malicious items detected)


(end)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/22/2014
Scan Time: 3:10:07 PM
Logfile: 11-22-MBAM.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.22.13
Rootkit Database: v2014.11.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Sally

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 580420
Time Elapsed: 12 min, 9 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

# AdwCleaner v4.102 - Report created 27/11/2014 at 11:41:17
# Updated 23/11/2014 by Xplode
# Database : 2014-11-27.1 [Live]
# Operating System : Windows 8.1 (64 bits)
# Username : trent_000 - BERGER-FAMILYPC
# Running from : C:\Users\trent_000\Downloads\adwcleaner_4.102(2).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\trent_000\AppData\Roaming\WSE_Vosteran
File Deleted : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\hdlorvbn.default\user.js
File Deleted : C:\Users\New Trent\AppData\Roaming\Mozilla\Firefox\Profiles\1i5hf411.default\user.js
File Deleted : C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\ki1yg8u5.default\user.js
File Deleted : C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\user.js
File Deleted : C:\Users\Trent.Berger-FamilyPC\AppData\Roaming\Mozilla\Firefox\Profiles\v12v2egn.default\user.js
File Deleted : C:\Users\trent_000\AppData\Roaming\Mozilla\Firefox\Profiles\e4x39m0u.default\user.js
File Deleted : C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\hdlorvbn.default\searchplugins\Vosteran.xml
File Deleted : C:\Users\New Trent\AppData\Roaming\Mozilla\Firefox\Profiles\1i5hf411.default\searchplugins\Vosteran.xml
File Deleted : C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\ki1yg8u5.default\searchplugins\Vosteran.xml
File Deleted : C:\Users\Sally\AppData\Roaming\Mozilla\Firefox\Profiles\kc2u83z7.default-1416682149450\searchplugins\Vosteran.xml
File Deleted : C:\Users\Trent.Berger-FamilyPC\AppData\Roaming\Mozilla\Firefox\Profiles\v12v2egn.default\searchplugins\Vosteran.xml
File Deleted : C:\Users\trent_000\AppData\Roaming\Mozilla\Firefox\Profiles\e4x39m0u.default\searchplugins\Vosteran.xml

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v33.1.1 (x86 en-US)

[hdlorvbn.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[hdlorvbn.default\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1St[...]
[1i5hf411.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[1i5hf411.default\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1St[...]
[ki1yg8u5.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[ki1yg8u5.default\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1St[...]
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.address", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.count", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.id", "value");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.imagelist.layout", "empty");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.popup.autoclose", "true");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.aolmail.user", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278041900_141702 0028263.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278041900_141702 0028263.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278063195_141702 0031512.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278219404_141702 0038037.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278371845_141702 0034409.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278391072_141702 0029764.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278407974_141702 0039284.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278407974_141702 0039284.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278440671_141702 0041385.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278712874_141702 0045023.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363278778581_141702 0050191.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1363283356442_141702 0100566.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368037499649_141702 0045964.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368038170032_141702 0099906.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1368553686828_141702 0112881.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376671520598_141702 0089279.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672727443_141702 0067919.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1376672884370_141702 0068899.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1379078884915_141702 0086153.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1379078962678_141702 0087884.click", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1379078962678_141702 0087884.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.button.1379079356382_141702 0047107.view", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.defaultview", 1);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.buttons.layout", "aol_bookmark_button_1417021404001;aol_bookmark_button_1417021030617;1368553686828_1417020112881;1363283356442_1417020100566;1368038170032_1417020099906;1376671[...]
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.date", "{system.date.timestamp}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.displaydate", "{system.date.locale}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.calendar.timestamp", "1417022611559");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.congrats", "curtain");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.curtain.debug", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.historybutton.num", "4");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.homepage.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000015&tb_uuid=F124B47A38AF3527C50C3A39E148174E");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.newtab.url", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid=F124B47A38AF3527C50C3A39E148174E");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.check", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.label", "AOL Search");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.default.search.url", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=F124B47A38AF3527C50C3A39E148174E&tb_oid=26-11-2014&tb_mrud=26-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.firsttime.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.guid", "{F124B47A-38AF-3527-C50C-3A39E148174E}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.active", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.historybutton.ignoreids", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.homepageprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.distroid", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.homepage", "hxxp://www.aol.com/?mtmhp={mtmhp}&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lastTbVersion", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.lid", "hyplognew00000010");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.mtmhp", "hyplogusaolp00000015");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.ncid", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.newtab", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid={uid}");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.sethomepage", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setnewtab", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.setsearch", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.install.type", "new");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampdate", "26");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampmonth", "10");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.activestampyear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalDate", "26");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalHours", "5");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMinutes", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalMonth", "11");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalSeconds", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.metrics.originalYear", "2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presethomepage", "aol.com");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetnewtab", "hxxp://www.aol.com/?mtmhp=hyplogusaolp00000081&tb_uuid=B88A84BC399C4AD7BCCA2C048E1C1982");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.presetsearch", "AOL Search");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.relatednews.enabled", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote..xml", "1417022556161");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.config.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.historyconfig.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.publish.xml", "1417020007559");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.remote.searchterm.js", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.resetprompt.skip", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.rtw.active", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.button", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.cid", "26-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.instd", "F124B47A38AF3527C50C3A39E148174E");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.oid", "26-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.placement", "right");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.populateoncomplete", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.savehistory", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.searchtype", "web");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.search.source", "aolrt-ff");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.searchprotection.enabled", true);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.skin.custom", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.langlocale", "en-US");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.toolbar.name", "AOL Toolbar");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.uninstallreset", "3");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.upgrade.showwindow", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.condition", "26");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degc", "1");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degf", "34");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.degrees", "F");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.lastupdate", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.locationid", "USDC0001");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.weather.zipcode", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.welcome.new.display", "0");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.layout", "aolmail,calendar,weather");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.log", false);
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.timestamp", "1417020013089");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.widgets.version", "5.74.1.10068");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("aol_toolbar.winamp.volume", "");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aolrt-ff&s_qt=sb&tb_uuid=F124B47A38AF3527C50C3A39E148174E&tb_oid=26-11-2014&tb_mrud=26-11-2014");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[kc2u83z7.default-1416682149450\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1St[...]
[v12v2egn.default\prefs.js] - Line Deleted : user_pref("browser.search.selectedEngine", "Vosteran");
[v12v2egn.default\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1St[...]
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.hmpgUrl", "hxxp://Vosteran.com/?f=1&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1[...]
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.newTabUrl", "hxxp://Vosteran.com/?f=2&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDy[...]
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");
[e4x39m0u.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.tlbrSrchUrl", "hxxp://Vosteran.com/?f=3&a=vst_ggfc_14_48_ff&cd=2XzuyEtN2Y1L1QzutBzz0EtAyEyB0F0D0CyC0DyEyE0EtDyCtN0D0Tzu0StCtDyCtCtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzyt[...]

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [35795 octets] - [16/11/2014 14:51:35]
AdwCleaner[R1].txt - [6409 octets] - [16/11/2014 16:27:17]
AdwCleaner[R2].txt - [14201 octets] - [17/11/2014 11:16:11]
AdwCleaner[R3].txt - [18664 octets] - [20/11/2014 12:48:32]
AdwCleaner[R4].txt - [21564 octets] - [24/11/2014 20:28:50]
AdwCleaner[R5].txt - [13294 octets] - [25/11/2014 15:12:33]
AdwCleaner[R6].txt - [18398 octets] - [27/11/2014 11:39:58]
AdwCleaner[S0].txt - [37789 octets] - [16/11/2014 14:52:56]
AdwCleaner[S1].txt - [6128 octets] - [16/11/2014 16:29:58]
AdwCleaner[S2].txt - [15452 octets] - [17/11/2014 11:20:44]
AdwCleaner[S3].txt - [20282 octets] - [20/11/2014 12:55:00]
AdwCleaner[S4].txt - [23263 octets] - [24/11/2014 20:32:57]
AdwCleaner[S5].txt - [14522 octets] - [25/11/2014 15:27:43]
AdwCleaner[S6].txt - [19639 octets] - [27/11/2014 11:41:17]

########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [19700 octets] ##########