Inactive Firefox redirecting to Ask or Qbyrd

graceg · 2010/12/28

[Inactive] Firefox redirecting to Ask or Qbyrd

Hi all,

My browser is randomly redirecting to ask.com or qbyrd when I click on links. Not all links, but there doesn't seem to be a pattern as to which are affected. Any help appreciated. Thanks! Logs attached.

Grace

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5409

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/28/2010 3:08:43 PM
mbam-log-2010-12-28 (15-08-43).txt

Scan type: Quick scan
Objects scanned: 142461
Time elapsed: 6 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-28 15:52:18
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 FUJITSU_MHY2120BH rev.0084000D
Running: ujmjy2qz.exe; Driver: C:\Users\Amanda\AppData\Local\Temp\ugldapow.sys

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82881599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 828A5F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\System32\rundll32.exe[2856] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [750E5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2856] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [750E5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2856] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [750E5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2856] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [750E5E25] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \Driver\ACPI_HAL \Device\00000050 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\BTHUSB \Device\00000077 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000079 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001e4cd85ed7
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001e4cd85ed7 (not active ControlSet)

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: LENOVO
BIOS Manufacturer: LENOVO
System Manufacturer: LENOVO
System Product Name: 77328AU
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 165):
0x8283E000 \SystemRoot\system32\ntkrnlpa.exe
0x82807000 \SystemRoot\system32\halmacpi.dll
0x80BA3000 \SystemRoot\system32\kdcom.dll
0x82E11000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x82E89000 \SystemRoot\system32\PSHED.dll
0x82E9A000 \SystemRoot\system32\BOOTVID.dll
0x82EA2000 \SystemRoot\system32\CLFS.SYS
0x82EE4000 \SystemRoot\system32\CI.dll
0x82F8F000 \SystemRoot\system32\drivers\Wdf01000.sys
0x82E00000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x86A36000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x86A7E000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x86A87000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x86A8F000 \SystemRoot\system32\DRIVERS\pci.sys
0x86AB9000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x86AC4000 \SystemRoot\System32\drivers\partmgr.sys
0x86AD5000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x86ADD000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x86AE8000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x86AF8000 \SystemRoot\System32\drivers\volmgrx.sys
0x86B43000 \SystemRoot\system32\DRIVERS\intelide.sys
0x86B4A000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x86B58000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0x86B86000 \SystemRoot\System32\drivers\mountmgr.sys
0x86B9C000 \SystemRoot\system32\DRIVERS\atapi.sys
0x86BA5000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x86BC8000 \SystemRoot\system32\DRIVERS\msahci.sys
0x86BD2000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x86A00000 \SystemRoot\system32\drivers\fltmgr.sys
0x86BDB000 \SystemRoot\system32\drivers\fileinfo.sys
0x86C14000 \SystemRoot\System32\Drivers\Ntfs.sys
0x86D43000 \SystemRoot\System32\Drivers\msrpc.sys
0x86D6E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x86D81000 \SystemRoot\System32\Drivers\cng.sys
0x86DDE000 \SystemRoot\System32\drivers\pcw.sys
0x86DEC000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x86E09000 \SystemRoot\system32\drivers\ndis.sys
0x86EC0000 \SystemRoot\system32\drivers\NETIO.SYS
0x86EFE000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x87029000 \SystemRoot\System32\drivers\tcpip.sys
0x87172000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x871A3000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x871AC000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x871EB000 \SystemRoot\System32\Drivers\spldr.sys
0x86F23000 \SystemRoot\System32\drivers\rdyboost.sys
0x87000000 \SystemRoot\System32\Drivers\mup.sys
0x87010000 \SystemRoot\System32\drivers\hwpolicy.sys
0x86F50000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x87018000 \SystemRoot\system32\DRIVERS\disk.sys
0x86F82000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x86FCD000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x86FEC000 \SystemRoot\System32\Drivers\Null.SYS
0x86FF3000 \SystemRoot\System32\Drivers\Beep.SYS
0x86C00000 \SystemRoot\System32\drivers\vga.sys
0x8C607000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C628000 \SystemRoot\System32\drivers\watchdog.sys
0x8C635000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C63D000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C645000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C64D000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C658000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C666000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C67D000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C688000 \SystemRoot\system32\drivers\afd.sys
0x8C6E2000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C714000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8C71B000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C73A000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8C748000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C75B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C76B000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8C771000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0x8C77F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C7C0000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C7CA000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C7D4000 \SystemRoot\System32\drivers\discache.sys
0x8C409000 \SystemRoot\system32\drivers\csc.sys
0x8C46D000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C485000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8C493000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8C4B9000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8C4DA000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8D029000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8D532000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C4EC000 \SystemRoot\System32\drivers\dxgmms1.sys
0x8C525000 \SystemRoot\system32\DRIVERS\e1e6032.sys
0x8D5E9000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C55D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8D000000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C5A8000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8D63A000 \SystemRoot\system32\DRIVERS\netw5v32.sys
0x8DA4D000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x8DA79000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8DA91000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8DA9E000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8DAAB000 \SystemRoot\system32\drivers\tpm.sys
0x8DAB7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8DABB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

DDS (Ver_10-12-12.02) - NTFSx86
Run by Amanda at 15:54:22.36 on Tue 12/28/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.998.225 [GMT -5:00]

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Hotspot Shield\bin\hsswd.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\System32\rundll32.exe
C:\Windows\explorer.exe
C:\Program Files\Hotspot Shield\bin\openvpntray.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Amanda\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
mDefault_Page_URL = hxxp://lenovo.live.com
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe "
uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\amanda\appdata\roaming\mozilla\firefox\profiles\f4qqgve0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?zx=17m840dpd3yr7&shva=1#inbox
FF - component: c:\program files\mozilla firefox\extensions\afurladvisor@anchorfree.com\components\afurladvisor.dll
FF - plugin: c:\users\amanda\appdata\roaming\mozilla\firefox\profiles\f4qqgve0.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: afurladvisor: afurladvisor@anchorfree.com - c:\program files\mozilla firefox\extensions\afurladvisor@anchorfree.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Amazon Wish List: amznUWL@amazon.com - %profile%\extensions\amznUWL@amazon.com

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-16 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-16 267944]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-16 61960]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe -product hss --> c:\program files\hotspot shield\bin\hsswd.exe -product HSS [?]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-11-17 1343400]

=============== Created Last 30 ================

2010-12-28 20:01:48 -------- d-----w- c:\users\amanda\appdata\roaming\Malwarebytes
2010-12-28 20:01:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-28 20:01:41 -------- d-----w- c:\progra~2\Malwarebytes
2010-12-28 20:01:38 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-28 20:01:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-25 01:28:55 -------- d-----w- c:\progra~2\hssff
2010-12-25 01:12:42 -------- d-----w- C:\Hotspot Shield
2010-12-25 01:12:39 506880 ----a-w- c:\program files\mozilla firefox\extensions\afurladvisor@anchorfree.com\components\afurladvisor.dll
2010-12-25 01:12:36 -------- d-----w- c:\program files\Hotspot Shield
2010-12-24 21:43:48 -------- d-----w- c:\program files\VideoLAN
2010-12-17 01:59:23 -------- d-----w- c:\program files\dnrgarmin
2010-12-17 01:49:53 -------- d-----w- c:\users\amanda\appdata\roaming\GARMIN
2010-12-17 01:49:03 -------- d-----w- C:\WebUpdater
2010-12-17 01:46:43 8320 ----a-w- c:\windows\system32\drivers\grmnusb.sys
2010-12-17 01:46:43 18432 ----a-w- c:\windows\system32\drivers\grmngen.sys
2010-12-17 01:46:42 -------- d-----w- C:\Garmin
2010-12-17 01:30:13 -------- d-----w- c:\program files\Amazon
2010-12-15 15:18:19 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 15:17:35 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 15:17:35 496128 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 15:17:35 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 15:17:35 305152 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-15 15:17:35 192000 ----a-w- c:\windows\system32\taskeng.exe
2010-12-15 15:17:35 179712 ----a-w- c:\windows\system32\schtasks.exe
2010-12-15 15:17:15 516096 ----a-w- c:\program files\windows mail\wab.exe
2010-12-15 15:11:19 101760 ----a-w- c:\windows\system32\consent.exe
2010-12-15 15:10:53 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-12-15 15:09:36 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-12-15 15:09:36 294400 ----a-w- c:\windows\system32\atmfd.dll
2010-12-15 15:09:18 314368 ----a-w- c:\windows\system32\webio.dll

==================== Find3M ====================

2010-11-15 17:22:20 0 ----a-w- c:\users\amanda\FAP1282.tmp
2010-11-04 05:52:17 978944 ----a-w- c:\windows\system32\wininet.dll
2010-11-04 05:48:36 44544 ----a-w- c:\windows\system32\licmgr10.dll
2010-11-04 04:41:26 386048 ----a-w- c:\windows\system32\html.iec
2010-11-04 04:08:54 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2010-10-19 15:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-07 17:23:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-10-07 17:23:02 75040 ----a-w- c:\windows\system32\jdns_sd.dll
2010-10-07 17:23:02 197920 ----a-w- c:\windows\system32\dnssdX.dll
2010-10-07 17:23:02 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 15:55:25.40 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 11/16/2010 12:37:35 AM
System Uptime: 12/28/2010 2:35:33 AM (13 hours ago)

Motherboard: LENOVO | | 77328AU
Processor: Intel(R) Pentium(R) Dual CPU T2330 @ 1.60GHz | None | 1600/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 105 GiB total, 24.984 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
F: is FIXED (NTFS) - 466 GiB total, 182.297 GiB free.

==== Disabled Device Manager Items =============

Class GUID:
Description:
Device ID: ACPI\IBM0068\5&2890D699&0
Manufacturer:
Name:
PNP Device ID: ACPI\IBM0068\5&2890D699&0
Service:

Class GUID:
Description: Biometric Coprocessor
Device ID: USB\VID_0483&PID_2016\5&295BD535&0&2
Manufacturer:
Name: Biometric Coprocessor
PNP Device ID: USB\VID_0483&PID_2016\5&295BD535&0&2
Service:

==== System Restore Points ===================

RP19: 12/16/2010 8:58:55 PM - Installed DNRGarmin
RP20: 12/18/2010 5:20:35 AM - Windows Update
RP21: 12/24/2010 8:13:16 PM - Device Driver Package Install: Hotspot Shield Network Service
RP22: 12/24/2010 8:14:36 PM - Device Driver Package Install: Anchorfree HSS Adapter Network adapters

==== Installed Programs ======================

µTorrent
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.0
Amazon MP3 Downloader 1.0.10
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Bonjour
Conduit Engine
DNRGarmin
Garmin Trip and Waypoint Manager v5
Hotspot Shield 1.56
Intel(R) Graphics Media Accelerator Driver
Intel(R) TV Wizard
iTunes
Malwarebytes' Anti-Malware
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.13)
PeerBlock 1.1 (r518)
PowerISO
QuickTime
Rosetta Stone Version 3
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2289158)
Security Update for 2007 Microsoft Office System (KB2344875)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft Office Excel 2007 (KB2345035)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office OneNote 2007 (KB980729)
uTorrentBar Toolbar
VLC media player 1.1.5
WinRAR archiver

==== Event Viewer Messages From Past Week ========

12/28/2010 9:03:18 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.
12/28/2010 7:26:49 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
12/28/2010 3:37:51 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume Main.
12/24/2010 8:15:06 PM, Error: Service Control Manager [7030] - The Hotspot Shield Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/23/2010 5:31:56 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

==== End Of File ===========================

Admin. · 2010/12/28

I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc…) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are here, and here.

I would strongly recommend that you uninstall them, and read the links above for educational value!

Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at WindowsBBS Malware and Virus removal.

A Malware expert will have a look at your log in due course.

broni · 2010/12/28

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================================

MBRCheck log is incomplete.
Please, repost it.

graceg · 2010/12/30

Here's the full MBR scan:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: LENOVO
BIOS Manufacturer: LENOVO
System Manufacturer: LENOVO
System Product Name: 77328AU
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 166):
0x8283E000 \SystemRoot\system32\ntkrnlpa.exe
0x82807000 \SystemRoot\system32\halmacpi.dll
0x80BA3000 \SystemRoot\system32\kdcom.dll
0x82E11000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x82E89000 \SystemRoot\system32\PSHED.dll
0x82E9A000 \SystemRoot\system32\BOOTVID.dll
0x82EA2000 \SystemRoot\system32\CLFS.SYS
0x82EE4000 \SystemRoot\system32\CI.dll
0x82F8F000 \SystemRoot\system32\drivers\Wdf01000.sys
0x82E00000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x86A36000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x86A7E000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x86A87000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x86A8F000 \SystemRoot\system32\DRIVERS\pci.sys
0x86AB9000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x86AC4000 \SystemRoot\System32\drivers\partmgr.sys
0x86AD5000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x86ADD000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x86AE8000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x86AF8000 \SystemRoot\System32\drivers\volmgrx.sys
0x86B43000 \SystemRoot\system32\DRIVERS\intelide.sys
0x86B4A000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x86B58000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0x86B86000 \SystemRoot\System32\drivers\mountmgr.sys
0x86B9C000 \SystemRoot\system32\DRIVERS\atapi.sys
0x86BA5000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x86BC8000 \SystemRoot\system32\DRIVERS\msahci.sys
0x86BD2000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x86A00000 \SystemRoot\system32\drivers\fltmgr.sys
0x86BDB000 \SystemRoot\system32\drivers\fileinfo.sys
0x86C14000 \SystemRoot\System32\Drivers\Ntfs.sys
0x86D43000 \SystemRoot\System32\Drivers\msrpc.sys
0x86D6E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x86D81000 \SystemRoot\System32\Drivers\cng.sys
0x86DDE000 \SystemRoot\System32\drivers\pcw.sys
0x86DEC000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x86E09000 \SystemRoot\system32\drivers\ndis.sys
0x86EC0000 \SystemRoot\system32\drivers\NETIO.SYS
0x86EFE000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x87029000 \SystemRoot\System32\drivers\tcpip.sys
0x87172000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x871A3000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x871AC000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x871EB000 \SystemRoot\System32\Drivers\spldr.sys
0x86F23000 \SystemRoot\System32\drivers\rdyboost.sys
0x87000000 \SystemRoot\System32\Drivers\mup.sys
0x87010000 \SystemRoot\System32\drivers\hwpolicy.sys
0x86F50000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x87018000 \SystemRoot\system32\DRIVERS\disk.sys
0x86F82000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x86FCD000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x86FEC000 \SystemRoot\System32\Drivers\Null.SYS
0x86FF3000 \SystemRoot\System32\Drivers\Beep.SYS
0x86C00000 \SystemRoot\System32\drivers\vga.sys
0x8C607000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C628000 \SystemRoot\System32\drivers\watchdog.sys
0x8C635000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C63D000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C645000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C64D000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C658000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C666000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C67D000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C688000 \SystemRoot\system32\drivers\afd.sys
0x8C6E2000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C714000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8C71B000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C73A000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8C748000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C75B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C76B000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8C771000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0x8C77F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C7C0000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C7CA000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C7D4000 \SystemRoot\System32\drivers\discache.sys
0x8C409000 \SystemRoot\system32\drivers\csc.sys
0x8C46D000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C485000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8C493000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8C4B9000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8C4DA000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8D029000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8D532000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C4EC000 \SystemRoot\System32\drivers\dxgmms1.sys
0x8C525000 \SystemRoot\system32\DRIVERS\e1e6032.sys
0x8D5E9000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C55D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8D000000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C5A8000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8D63A000 \SystemRoot\system32\DRIVERS\netw5v32.sys
0x8DA4D000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x8DA79000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8DA91000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8DA9E000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8DAAB000 \SystemRoot\system32\drivers\tpm.sys
0x8DAB7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8DABB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8DAC1000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8DACA000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x8DAD7000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x8DAE9000 \SystemRoot\system32\DRIVERS\HssDrv.sys
0x8DAF9000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8DB11000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8DB1C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8DB3E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8DB56000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8DB6D000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8DB84000 \SystemRoot\system32\DRIVERS\taphss.sys
0x8DB8B000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x8DB95000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8DB97000 \SystemRoot\system32\DRIVERS\ks.sys
0x8DBCB000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C833000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8C877000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C888000 \SystemRoot\system32\drivers\HdAudio.sys
0x8C8D8000 \SystemRoot\system32\drivers\portcls.sys
0x8C907000 \SystemRoot\system32\drivers\drmk.sys
0x8C920000 \SystemRoot\system32\DRIVERS\VSTAZL3.SYS
0x8E00E000 \SystemRoot\system32\DRIVERS\VSTDPV3.SYS
0x8E110000 \SystemRoot\system32\DRIVERS\VSTCNXT3.SYS
0x8E1C5000 \SystemRoot\system32\drivers\modem.sys
0x8E1D2000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x8C95D000 \SystemRoot\System32\Drivers\bthport.sys
0x8E1E4000 \SystemRoot\System32\Drivers\USBD.SYS
0x82190000 \SystemRoot\System32\win32k.sys
0x8E000000 \SystemRoot\System32\drivers\Dxapi.sys
0x8C9C1000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x8C9E5000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x8C800000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x8C81B000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x8C9F2000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8DBD9000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8DBE4000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x8DBEE000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x823F0000 \SystemRoot\System32\TSDDD.dll
0x82020000 \SystemRoot\System32\cdd.dll
0x8D60B000 \SystemRoot\system32\drivers\luafv.sys
0x8D00F000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x8C5C7000 \SystemRoot\system32\drivers\WudfPf.sys
0x8D626000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9383A000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x93880000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x93890000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x938A3000 \SystemRoot\system32\drivers\HTTP.sys
0x93928000 \SystemRoot\system32\DRIVERS\bowser.sys
0x93941000 \SystemRoot\System32\drivers\mpsdrv.sys
0x93953000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x93976000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x939B1000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9400E000 \SystemRoot\system32\drivers\peauth.sys
0x940A5000 \SystemRoot\System32\Drivers\secdrv.SYS
0x940AF000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x940D0000 \SystemRoot\System32\drivers\tcpipreg.sys
0x940DD000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9412C000 \SystemRoot\System32\DRIVERS\srv.sys
0x9417D000 \SystemRoot\System32\Drivers\fastfat.SYS
0x84C92000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x84CB2000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x84D3B000 \??\C:\Users\Amanda\AppData\Local\Temp\ugldapow.sys
0x84D53000 \??\C:\Users\Amanda\AppData\Local\Temp\mbr.sys
0x84D80000 \SystemRoot\system32\DRIVERS\monitor.sys
0x77040000 \Windows\System32\ntdll.dll
0x48240000 \Windows\System32\smss.exe
0x77280000 \Windows\System32\apisetschema.dll
0x008F0000 \Windows\System32\autochk.exe

Processes (total 47):
0 System Idle Process
4 System
356 C:\Windows\System32\smss.exe
444 csrss.exe
496 C:\Windows\System32\wininit.exe
504 csrss.exe
548 C:\Windows\System32\services.exe
568 C:\Windows\System32\lsass.exe
576 C:\Windows\System32\lsm.exe
644 C:\Windows\System32\winlogon.exe
728 C:\Windows\System32\svchost.exe
832 C:\Windows\System32\svchost.exe
936 C:\Windows\System32\svchost.exe
980 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
1164 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\svchost.exe
1484 C:\Windows\System32\spoolsv.exe
1512 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1532 C:\Windows\System32\svchost.exe
1636 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1664 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1700 C:\Program Files\Bonjour\mDNSResponder.exe
1752 C:\Windows\System32\svchost.exe
1772 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
1788 C:\Windows\System32\conhost.exe
1832 C:\Program Files\Hotspot Shield\bin\openvpnas.exe
1928 C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
1972 C:\Program Files\Hotspot Shield\bin\hsswd.exe
2008 C:\Windows\System32\svchost.exe
488 C:\Windows\System32\svchost.exe
2356 C:\Windows\System32\dwm.exe
2696 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3092 C:\Windows\System32\SearchIndexer.exe
3248 C:\Program Files\iPod\bin\iPodService.exe
3184 C:\Windows\System32\wuauclt.exe
3656 C:\Windows\System32\svchost.exe
2856 C:\Windows\System32\rundll32.exe
3172 C:\Windows\explorer.exe
2292 C:\Program Files\Hotspot Shield\bin\openvpntray.exe
5764 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
5116 C:\Program Files\uTorrent\uTorrent.exe
4668 C:\Windows\System32\SearchProtocolHost.exe
5144 C:\Windows\System32\SearchFilterHost.exe
4628 C:\Users\Amanda\Desktop\MBRCheck.exe
3060 C:\Windows\System32\conhost.exe
5492 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHY2120BH, Rev: 0084000D

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

broni · 2010/12/30

Looks good

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

graceg · 2011/01/10

Thanks! ComboFix log below.

ComboFix 11-01-07.01 - Amanda 01/08/2011 8:13.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.998.367 [GMT -5:00]
Running from: c:\users\Amanda\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 )))))))))))))))))))))))))))))))
.

2011-01-08 13:09 . 2011-01-08 13:10 -------- d-----w- C:\32788R22FWJFW
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\users\Amanda\AppData\Roaming\Malwarebytes
2010-12-28 20:01 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\programdata\Malwarebytes
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-28 20:01 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-25 01:28 . 2010-12-25 01:28 -------- d-----w- c:\programdata\hssff
2010-12-25 01:12 . 2010-12-25 01:15 -------- d-----w- C:\Hotspot Shield
2010-12-25 01:12 . 2010-11-04 18:43 506880 ----a-w- c:\program files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com\components\afurladvisor.dll
2010-12-25 01:12 . 2010-12-25 01:15 -------- d-----w- c:\program files\Hotspot Shield
2010-12-24 21:44 . 2010-12-24 21:48 -------- d-----w- c:\users\Amanda\AppData\Roaming\vlc
2010-12-24 21:43 . 2010-12-24 21:43 -------- d-----w- c:\program files\VideoLAN
2010-12-17 01:59 . 2010-12-17 01:59 -------- d-----w- c:\program files\dnrgarmin
2010-12-17 01:49 . 2010-12-17 03:56 -------- d-----w- c:\users\Amanda\AppData\Roaming\GARMIN
2010-12-17 01:49 . 2010-12-17 01:49 -------- d-----w- C:\WebUpdater
2010-12-17 01:46 . 2007-03-08 22:18 8320 ----a-w- c:\windows\system32\drivers\grmnusb.sys
2010-12-17 01:46 . 2007-03-08 22:18 18432 ----a-w- c:\windows\system32\drivers\grmngen.sys
2010-12-17 01:46 . 2010-12-17 01:49 -------- d-----w- C:\Garmin
2010-12-17 01:30 . 2010-12-17 01:30 -------- d-----w- c:\program files\Amazon
2010-12-15 15:18 . 2010-10-27 04:32 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 15:17 . 2010-11-02 04:41 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 15:17 . 2010-11-02 04:40 496128 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 15:17 . 2010-11-02 04:40 305152 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-15 15:17 . 2010-11-02 04:39 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 15:17 . 2010-11-02 04:34 192000 ----a-w- c:\windows\system32\taskeng.exe
2010-12-15 15:17 . 2010-11-02 04:34 179712 ----a-w- c:\windows\system32\schtasks.exe
2010-12-15 15:17 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-15 15:11 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2010-12-15 15:10 . 2010-10-20 03:00 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-12-15 15:09 . 2010-10-20 04:54 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-12-15 15:09 . 2010-10-20 02:58 294400 ----a-w- c:\windows\system32\atmfd.dll
2010-12-15 15:09 . 2010-10-16 04:36 314368 ----a-w- c:\windows\system32\webio.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 13:59 . 2010-11-16 15:09 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-23 02:19 . 2010-11-16 15:09 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-15 17:22 . 2010-11-15 17:22 0 ----a-w- c:\users\Amanda\FAP1282.tmp
2010-10-19 15:41 . 2010-11-16 14:55 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 13:41 . 2010-11-16 14:55 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{223C5DD5-E733-4A43-A1F4-29CA8D3D119E}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 17:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-10-18 17:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe" [2010-11-27 395128]
"RESTART_STICKY_NOTES "= "c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"PWRISOVM.EXE "= "c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-17 1343400]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6522
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?zx=17m840dpd3yr7&shva=1#inbox
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: afurladvisor: afurladvisor@anchorfree.com - c:\program files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Amazon Wish List: amznUWL@amazon.com - %profile%\extensions\amznUWL@amazon.com
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-01-08 08:22:58
ComboFix-quarantined-files.txt 2011-01-08 13:22

Pre-Run: 27,128,590,336 bytes free
Post-Run: 26,910,904,320 bytes free

- - End Of File - - 5659CD8815DB65C43F7C80421F8E1B2B

broni · 2011/01/10

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\users\Amanda\FAP1282.tmp

DDS::
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:6522
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

graceg · 2011/01/10

Okay, done!

ComboFix 11-01-10.04 - Amanda 01/10/2011 19:41:58.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.998.494 [GMT -5:00]
Running from: c:\users\Amanda\Desktop\ComboFix.exe
Command switches used :: c:\users\Amanda\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point

FILE ::
"c:\users\Amanda\FAP1282.tmp "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Amanda\FAP1282.tmp

.
((((((((((((((((((((((((( Files Created from 2010-12-11 to 2011-01-11 )))))))))))))))))))))))))))))))
.

2011-01-11 00:49 . 2011-01-11 00:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-11 00:49 . 2011-01-11 00:49 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-01-11 00:39 . 2011-01-11 00:40 -------- d-----w- C:\32788R22FWJFW
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\users\Amanda\AppData\Roaming\Malwarebytes
2010-12-28 20:01 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\programdata\Malwarebytes
2010-12-28 20:01 . 2010-12-28 20:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-28 20:01 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-25 01:28 . 2010-12-25 01:28 -------- d-----w- c:\programdata\hssff
2010-12-25 01:12 . 2010-12-25 01:15 -------- d-----w- C:\Hotspot Shield
2010-12-25 01:12 . 2010-11-04 18:43 506880 ----a-w- c:\program files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com\components\afurladvisor.dll
2010-12-25 01:12 . 2010-12-25 01:15 -------- d-----w- c:\program files\Hotspot Shield
2010-12-24 21:44 . 2010-12-24 21:48 -------- d-----w- c:\users\Amanda\AppData\Roaming\vlc
2010-12-24 21:43 . 2010-12-24 21:43 -------- d-----w- c:\program files\VideoLAN
2010-12-17 01:59 . 2010-12-17 01:59 -------- d-----w- c:\program files\dnrgarmin
2010-12-17 01:49 . 2010-12-17 03:56 -------- d-----w- c:\users\Amanda\AppData\Roaming\GARMIN
2010-12-17 01:49 . 2010-12-17 01:49 -------- d-----w- C:\WebUpdater
2010-12-17 01:46 . 2007-03-08 22:18 8320 ----a-w- c:\windows\system32\drivers\grmnusb.sys
2010-12-17 01:46 . 2007-03-08 22:18 18432 ----a-w- c:\windows\system32\drivers\grmngen.sys
2010-12-17 01:46 . 2010-12-17 01:49 -------- d-----w- C:\Garmin
2010-12-17 01:30 . 2010-12-17 01:30 -------- d-----w- c:\program files\Amazon
2010-12-15 15:18 . 2010-10-27 04:32 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 15:17 . 2010-11-02 04:41 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 15:17 . 2010-11-02 04:40 496128 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 15:17 . 2010-11-02 04:40 305152 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-15 15:17 . 2010-11-02 04:39 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 15:17 . 2010-11-02 04:34 192000 ----a-w- c:\windows\system32\taskeng.exe
2010-12-15 15:17 . 2010-11-02 04:34 179712 ----a-w- c:\windows\system32\schtasks.exe
2010-12-15 15:17 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-15 15:11 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2010-12-15 15:10 . 2010-10-20 03:00 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-12-15 15:09 . 2010-10-20 04:54 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-12-15 15:09 . 2010-10-20 02:58 294400 ----a-w- c:\windows\system32\atmfd.dll
2010-12-15 15:09 . 2010-10-16 04:36 314368 ----a-w- c:\windows\system32\webio.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 13:59 . 2010-11-16 15:09 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-23 02:19 . 2010-11-16 15:09 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-10-19 15:41 . 2010-11-16 14:55 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 13:41 . 2010-11-16 14:55 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{223C5DD5-E733-4A43-A1F4-29CA8D3D119E}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 17:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-10-18 17:26 3908192 ----a-w- c:\program files\uTorrentBar\tbuTor.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]
"{30F9B915-B755-4826-820B-08FBA6BD249D} "= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} "= "c:\program files\uTorrentBar\tbuTor.dll" [2010-10-18 3908192]

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent "= "c:\program files\uTorrent\uTorrent.exe" [2010-11-27 395128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"PWRISOVM.EXE "= "c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-17 1343400]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-08-02 135336]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?zx=17m840dpd3yr7&shva=1#inbox
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: afurladvisor: afurladvisor@anchorfree.com - c:\program files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Amazon Wish List: amznUWL@amazon.com - %profile%\extensions\amznUWL@amazon.com
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-01-10 19:52:14
ComboFix-quarantined-files.txt 2011-01-11 00:52
ComboFix2.txt 2011-01-08 13:22

Pre-Run: 26,705,743,872 bytes free
Post-Run: 26,490,122,240 bytes free

- - End Of File - - D7F92ADAA3713AA9987021F05487CD29

broni · 2011/01/10

Good

How is computer doing?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

graceg · 2011/01/10

Okay. Computer situation is still the same - Firefox redirects to weird search engines for some websites but not others.

OTL.txt:
OTL logfile created on: 1/10/2011 8:20:15 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Amanda\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

998.00 Mb Total Physical Memory | 401.00 Mb Available Physical Memory | 40.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.08 Gb Total Space | 24.70 Gb Free Space | 23.51% Space Free | Partition Type: NTFS
Drive D: | 91.99 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: LAPTOP | User Name: Amanda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
PRC - [2010/12/08 22:36:27 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/11/30 15:20:46 | 000,107,568 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpntray.exe
PRC - [2010/11/30 15:19:06 | 000,268,848 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/10/15 13:42:14 | 000,326,704 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2010/10/15 13:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/08/02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/04/12 03:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 20:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

========== Modules (SafeList) ==========

MOD - [2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 20:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 20:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll
MOD - [2009/07/13 20:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\samcli.dll
MOD - [2009/07/13 20:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll
MOD - [2009/07/13 20:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netutils.dll
MOD - [2009/07/13 20:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 20:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 20:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll
MOD - [2009/07/13 20:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 20:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/12/08 22:36:27 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/11/30 15:20:50 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2010/11/30 15:19:06 | 000,268,848 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010/11/17 21:51:04 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/11/17 08:44:54 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/10/15 13:42:14 | 000,326,704 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010/10/15 13:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/07/13 20:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)
SRV - [2009/07/13 20:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)
SRV - [2009/07/13 20:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)
SRV - [2009/07/13 20:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2009/07/13 20:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)
SRV - [2009/07/13 20:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)
SRV - [2009/07/13 20:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)
SRV - [2009/07/13 20:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/07/13 20:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)
SRV - [2009/07/13 20:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/07/13 20:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2009/07/13 20:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)
SRV - [2009/07/13 20:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)
SRV - [2009/07/13 20:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 20:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)
SRV - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)

========== Driver Services (SafeList) ==========

DRV - [2010/12/20 08:59:04 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/11/22 21:19:15 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/22 14:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2010/09/22 14:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/06/17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/04/12 03:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2009/12/11 02:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg)
DRV - [2009/09/23 19:18:14 | 004,808,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2009/07/13 20:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide)
DRV - [2009/07/13 20:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci)
DRV - [2009/07/13 20:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx)
DRV - [2009/07/13 20:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs)
DRV - [2009/07/13 20:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320)
DRV - [2009/07/13 20:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas)
DRV - [2009/07/13 20:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata)
DRV - [2009/07/13 20:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc)
DRV - [2009/07/13 20:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata)
DRV - [2009/07/13 20:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide)
DRV - [2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor)
DRV - [2009/07/13 20:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid)
DRV - [2009/07/13 20:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960)
DRV - [2009/07/13 20:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS)
DRV - [2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV)
DRV - [2009/07/13 20:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR)
DRV - [2009/07/13 20:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2009/07/13 20:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC)
DRV - [2009/07/13 20:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2)
DRV - [2009/07/13 20:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp)
DRV - [2009/07/13 20:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas)
DRV - [2009/07/13 20:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy)
DRV - [2009/07/13 20:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor)
DRV - [2009/07/13 20:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx)
DRV - [2009/07/13 20:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD)
DRV - [2009/07/13 20:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends)
DRV - [2009/07/13 20:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid)
DRV - [2009/07/13 20:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009/07/13 20:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp)
DRV - [2009/07/13 20:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 20:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot)
DRV - [2009/07/13 20:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/07/13 20:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide)
DRV - [2009/07/13 20:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300)
DRV - [2009/07/13 20:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost)
DRV - [2009/07/13 20:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx)
DRV - [2009/07/13 20:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4)
DRV - [2009/07/13 20:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw)
DRV - [2009/07/13 20:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2)
DRV - [2009/07/13 20:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor)
DRV - [2009/07/13 20:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG)
DRV - [2009/07/13 19:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 19:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus)
DRV - [2009/07/13 19:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP)
DRV - [2009/07/13 18:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 18:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf)
DRV - [2009/07/13 18:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap)
DRV - [2009/07/13 18:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus)
DRV - [2009/07/13 18:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\1394ohci.sys -- (1394ohci)
DRV - [2009/07/13 18:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass)
DRV - [2009/07/13 18:51:23 | 000,080,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/07/13 18:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 18:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf)
DRV - [2009/07/13 18:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig)
DRV - [2009/07/13 18:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus)
DRV - [2009/07/13 18:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID)
DRV - [2009/07/13 18:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter)
DRV - [2009/07/13 18:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 18:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/13 18:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache)
DRV - [2009/07/13 18:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi)
DRV - [2009/07/13 18:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009/07/13 18:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM)
DRV - [2009/07/13 17:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 17:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2009/07/13 17:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer)
DRV - [2009/07/13 17:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm)
DRV - [2009/07/13 17:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo)
DRV - [2009/07/13 17:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp)
DRV - [2009/07/13 17:13:46 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (SrvHsfV92)
DRV - [2009/07/13 17:13:45 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (SrvHsfWinac)
DRV - [2009/07/13 17:13:45 | 000,207,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (SrvHsfHDA)
DRV - [2009/07/13 17:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009/07/13 17:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009/07/13 17:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2009/07/13 17:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv)
DRV - [2009/07/13 17:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2786678
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms} "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://mail.google.com/mail/?zx=17m840dpd3yr7&shva=1#inbox "
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:1.1
FF - prefs.js..extensions.enabledItems: afurladvisor@anchorfree.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/19 10:04:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/19 10:04:19 | 000,000,000 | ---D | M]

[2010/11/16 09:53:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Extensions
[2011/01/10 18:48:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/01 13:57:59 | 000,000,000 | ---D | M] (Amazon Wish List) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\amznUWL@amazon.com
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\firefox@tvunetworks.com
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\personas@christopher.beard
[2009/07/04 12:17:18 | 000,001,765 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\amazon-search.xml
[2010/01/27 11:00:56 | 000,001,606 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\amazondotcom.xml
[2010/11/27 09:43:08 | 000,000,863 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\conduit.xml
[2009/05/06 21:28:58 | 000,001,595 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\ebay.xml
[2010/07/26 20:18:21 | 000,004,153 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\youtube.xml
[2010/12/29 15:20:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/12/24 20:12:39 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com

O1 HOSTS File: ([2011/01/10 19:49:57 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.77.134 68.87.72.134
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/02/14 12:37:30 | 000,000,043 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/10 20:18:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
[2011/01/10 19:52:19 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/01/10 19:40:09 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/01/10 19:40:09 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/01/10 19:40:09 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/01/10 19:40:02 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/01/10 19:39:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/01/10 19:39:30 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/01/08 08:10:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/28 15:01:48 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\Malwarebytes
[2010/12/28 15:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2010/12/28 15:01:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/28 15:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/12/28 15:01:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/28 15:01:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/28 15:00:12 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Amanda\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/28 14:57:34 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Amanda\Desktop\TFC.exe
[2010/12/26 20:22:09 | 001,912,872 | ---- | C] (Trend Micro Inc.) -- C:\Users\Amanda\Desktop\HousecallLauncher.exe
[2010/12/24 20:28:55 | 000,000,000 | ---D | C] -- C:\ProgramData\hssff
[2010/12/24 20:12:42 | 000,000,000 | ---D | C] -- C:\Hotspot Shield
[2010/12/24 20:12:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
[2010/12/24 20:12:36 | 000,000,000 | ---D | C] -- C:\Program Files\Hotspot Shield
[2010/12/24 16:44:48 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\vlc
[2010/12/24 16:44:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2010/12/24 16:43:48 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2010/12/22 20:35:59 | 000,000,000 | ---D | C] -- C:\Users\Amanda\Desktop\picstoframe
[2010/12/16 20:59:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DNRGarmin
[2010/12/16 20:59:23 | 000,000,000 | ---D | C] -- C:\Program Files\dnrgarmin
[2010/12/16 20:57:38 | 008,908,595 | ---- | C] (GIS Section, Minnesota Department of Natural Resources ) -- C:\Users\Amanda\Desktop\dnrgarminsetup54.exe
[2010/12/16 20:49:54 | 000,000,000 | ---D | C] -- C:\Users\Amanda\Documents\My Garmin
[2010/12/16 20:49:53 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\GARMIN
[2010/12/16 20:49:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2010/12/16 20:49:03 | 000,000,000 | ---D | C] -- C:\WebUpdater
[2010/12/16 20:46:43 | 000,018,432 | ---- | C] (GARMIN Corp.) -- C:\Windows\System32\drivers\grmngen.sys
[2010/12/16 20:46:42 | 000,000,000 | ---D | C] -- C:\Garmin
[2010/12/16 20:30:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2010/12/16 20:30:13 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon
[1 C:\Users\Amanda\Documents\*.tmp files -> C:\Users\Amanda\Documents\*.tmp -> ]
[1 C:\Users\Amanda\Desktop\*.tmp files -> C:\Users\Amanda\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
[2011/01/10 19:49:57 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/01/10 19:39:12 | 004,151,804 | R--- | M] () -- C:\Users\Amanda\Desktop\ComboFix.exe
[2011/01/10 18:45:01 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/10 18:45:01 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/10 18:42:08 | 000,615,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/10 18:42:08 | 000,103,702 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/10 18:37:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/01/10 18:37:39 | 785,092,608 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/07 16:43:34 | 001,107,262 | ---- | M] () -- C:\Users\Amanda\Documents\gradcare.pdf
[2010/12/28 15:54:12 | 000,624,128 | ---- | M] () -- C:\Users\Amanda\Desktop\dds.scr
[2010/12/28 15:53:35 | 000,080,384 | ---- | M] () -- C:\Users\Amanda\Desktop\MBRCheck.exe
[2010/12/28 15:35:04 | 000,296,448 | ---- | M] () -- C:\Users\Amanda\Desktop\ujmjy2qz.exe
[2010/12/28 15:00:46 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Amanda\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/28 14:57:37 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\TFC.exe
[2010/12/26 20:24:40 | 000,000,036 | ---- | M] () -- C:\Users\Amanda\AppData\Local\housecall.guid.cache
[2010/12/26 20:22:14 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Amanda\Desktop\HousecallLauncher.exe
[2010/12/26 16:47:50 | 000,043,792 | ---- | M] () -- C:\Users\Amanda\Desktop\sorry-overshadowed-holiday-season-birthday-ecard-someecards.jpg
[2010/12/24 20:11:44 | 006,014,000 | ---- | M] () -- C:\Users\Amanda\Desktop\HSS-1.56-install-anchorfree-238-conduit2.exe
[2010/12/24 20:10:57 | 000,266,696 | ---- | M] () -- C:\Users\Amanda\Desktop\DM-238.exe
[2010/12/24 16:44:15 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/12/24 16:42:09 | 019,985,265 | ---- | M] () -- C:\Users\Amanda\Desktop\vlc-1.1.5-win32.exe
[2010/12/21 18:36:45 | 000,001,684 | ---- | M] () -- C:\Users\Amanda\Desktop\grid_Clip.shx
[2010/12/21 18:04:15 | 000,024,868 | ---- | M] () -- C:\Users\Amanda\Desktop\gridtubes_point.shx
[2010/12/21 09:16:10 | 000,606,555 | ---- | M] () -- C:\Users\Amanda\Documents\Eat__Pray__Love__One_Woman_s_Search_for_-_Elizabeth_Gilbert.pdf
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/20 08:59:04 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010/12/20 07:22:50 | 001,145,338 | ---- | M] () -- C:\Users\Amanda\Desktop\IMGP0054.JPG
[2010/12/18 05:40:29 | 000,308,496 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/12/17 14:49:50 | 001,794,485 | ---- | M] () -- C:\Users\Amanda\Documents\534final.docx
[2010/12/17 14:19:10 | 000,453,541 | ---- | M] () -- C:\Users\Amanda\Desktop\demsquare.tif
[2010/12/17 14:19:08 | 000,453,541 | ---- | M] () -- C:\Users\Amanda\Desktop\demuntrans.tif
[2010/12/16 21:35:13 | 000,000,676 | ---- | M] () -- C:\Users\Amanda\Desktop\forgarmin_Project.shx
[2010/12/16 20:59:27 | 000,001,867 | ---- | M] () -- C:\Users\Public\Desktop\DNR Garmin.lnk
[2010/12/16 19:03:01 | 000,026,636 | ---- | M] () -- C:\Users\Amanda\Desktop\models.docx
[2010/12/13 15:13:24 | 000,004,036 | ---- | M] () -- C:\Users\Amanda\Desktop\paystub.pdf
[1 C:\Users\Amanda\Documents\*.tmp files -> C:\Users\Amanda\Documents\*.tmp -> ]
[1 C:\Users\Amanda\Desktop\*.tmp files -> C:\Users\Amanda\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/10 19:40:09 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/01/10 19:40:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/01/10 19:40:09 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/01/10 19:40:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/01/10 19:40:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/01/10 19:37:54 | 004,151,804 | R--- | C] () -- C:\Users\Amanda\Desktop\ComboFix.exe
[2011/01/07 16:43:34 | 001,107,262 | ---- | C] () -- C:\Users\Amanda\Documents\gradcare.pdf
[2011/01/07 10:20:13 | 001,145,338 | ---- | C] () -- C:\Users\Amanda\Desktop\IMGP0054.JPG
[2010/12/28 15:54:12 | 000,624,128 | ---- | C] () -- C:\Users\Amanda\Desktop\dds.scr
[2010/12/28 15:53:35 | 000,080,384 | ---- | C] () -- C:\Users\Amanda\Desktop\MBRCheck.exe
[2010/12/28 15:35:03 | 000,296,448 | ---- | C] () -- C:\Users\Amanda\Desktop\ujmjy2qz.exe
[2010/12/26 20:24:40 | 000,000,036 | ---- | C] () -- C:\Users\Amanda\AppData\Local\housecall.guid.cache
[2010/12/26 16:45:40 | 000,043,792 | ---- | C] () -- C:\Users\Amanda\Desktop\sorry-overshadowed-holiday-season-birthday-ecard-someecards.jpg
[2010/12/24 20:11:18 | 006,014,000 | ---- | C] () -- C:\Users\Amanda\Desktop\HSS-1.56-install-anchorfree-238-conduit2.exe
[2010/12/24 20:10:57 | 000,266,696 | ---- | C] () -- C:\Users\Amanda\Desktop\DM-238.exe
[2010/12/24 16:44:15 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/12/24 16:40:48 | 019,985,265 | ---- | C] () -- C:\Users\Amanda\Desktop\vlc-1.1.5-win32.exe
[2010/12/21 18:36:44 | 000,001,684 | ---- | C] () -- C:\Users\Amanda\Desktop\grid_Clip.shx
[2010/12/21 18:04:14 | 000,024,868 | ---- | C] () -- C:\Users\Amanda\Desktop\gridtubes_point.shx
[2010/12/21 09:16:10 | 000,606,555 | ---- | C] () -- C:\Users\Amanda\Documents\Eat__Pray__Love__One_Woman_s_Search_for_-_Elizabeth_Gilbert.pdf
[2010/12/17 14:19:07 | 000,453,541 | ---- | C] () -- C:\Users\Amanda\Desktop\demsquare.tif
[2010/12/17 14:19:00 | 000,453,541 | ---- | C] () -- C:\Users\Amanda\Desktop\demuntrans.tif
[2010/12/16 21:35:13 | 000,000,676 | ---- | C] () -- C:\Users\Amanda\Desktop\forgarmin_Project.shx
[2010/12/16 20:59:27 | 000,001,867 | ---- | C] () -- C:\Users\Public\Desktop\DNR Garmin.lnk
[2010/12/16 18:10:14 | 000,026,636 | ---- | C] () -- C:\Users\Amanda\Desktop\models.docx
[2010/12/13 15:13:24 | 000,004,036 | ---- | C] () -- C:\Users\Amanda\Desktop\paystub.pdf
[2010/11/16 00:46:46 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2010/12/16 22:56:35 | 000,000,000 | ---D | M] -- C:\Users\Amanda\AppData\Roaming\GARMIN
[2011/01/10 18:38:20 | 000,000,000 | ---D | M] -- C:\Users\Amanda\AppData\Roaming\uTorrent
[2009/07/13 23:53:46 | 000,008,430 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/01/02 13:59:48 | 000,000,354 | ---- | M] () -- C:\atwdltest.log
[2009/06/10 16:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2008/03/19 07:34:43 | 000,000,211 | -H-- | M] () -- C:\Boot.BAK
[2010/11/16 03:10:36 | 000,000,355 | RHS- | M] () -- C:\Boot.ini.saved
[2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2010/11/16 03:10:38 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2011/01/10 19:52:14 | 000,009,554 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 16:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008/03/09 23:12:17 | 000,002,291 | ---- | M] () -- C:\drivez.log
[2006/04/14 00:55:44 | 000,000,529 | ---- | M] () -- C:\dsbHSM.inf
[2011/01/10 18:37:39 | 785,092,608 | -HS- | M] () -- C:\hiberfil.sys
[2006/04/30 02:13:35 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2006/04/30 02:13:35 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/30 21:16:17 | 000,250,048 | RHS- | M] () -- C:\NTLDR
[2011/01/10 18:37:44 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys
[2010/08/25 16:40:37 | 000,000,371 | ---- | M] () -- C:\rkill.log
[2008/03/09 22:45:09 | 000,000,083 | ---- | M] () -- C:\syslevel.lgl
[2010/11/15 16:29:26 | 000,008,268 | ---- | M] () -- C:\TPHKLOCK (1).TXT
[2010/11/15 23:32:17 | 000,008,292 | ---- | M] () -- C:\TPHKLOCK.TXT
[2009/12/30 18:55:47 | 000,001,120 | ---- | M] () -- C:\WirelessDiagLog.csv

< %systemroot%\Fonts\*.com >
[2009/07/13 23:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 20:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2009/07/13 20:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/11/16 09:43:36 | 000,000,221 | -HS- | M] () -- C:\Users\Amanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/01/10 19:39:12 | 004,151,804 | R--- | M] () -- C:\Users\Amanda\Desktop\ComboFix.exe
[2010/12/24 20:10:57 | 000,266,696 | ---- | M] () -- C:\Users\Amanda\Desktop\DM-238.exe
[2008/09/23 08:29:28 | 008,908,595 | ---- | M] (GIS Section, Minnesota Department of Natural Resources ) -- C:\Users\Amanda\Desktop\dnrgarminsetup54.exe
[2010/12/26 20:22:14 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Amanda\Desktop\HousecallLauncher.exe
[2010/12/24 20:11:44 | 006,014,000 | ---- | M] () -- C:\Users\Amanda\Desktop\HSS-1.56-install-anchorfree-238-conduit2.exe
[2004/11/28 09:53:54 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Users\Amanda\Desktop\instmsia.exe
[2004/11/28 09:53:54 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Amanda\Desktop\instmsiw.exe
[2010/12/28 15:00:46 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Amanda\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/28 15:53:35 | 000,080,384 | ---- | M] () -- C:\Users\Amanda\Desktop\MBRCheck.exe
[2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
[2010/12/28 14:57:37 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\TFC.exe
[2010/12/28 15:35:04 | 000,296,448 | ---- | M] () -- C:\Users\Amanda\Desktop\ujmjy2qz.exe
[2010/12/24 16:42:09 | 019,985,265 | ---- | M] () -- C:\Users\Amanda\Desktop\vlc-1.1.5-win32.exe
[1 C:\Users\Amanda\Desktop\*.tmp files -> C:\Users\Amanda\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/03/19 07:35:33 | 000,000,122 | -HS- | M] () -- C:\Users\Amanda\Favorites\Desktop (1).ini
[2010/11/17 09:22:31 | 000,000,402 | -HS- | M] () -- C:\Users\Amanda\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

graceg · 2011/01/10

Extras.txt:

OTL Extras logfile created on: 1/10/2011 8:20:15 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Amanda\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

998.00 Mb Total Physical Memory | 401.00 Mb Available Physical Memory | 40.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.08 Gb Total Space | 24.70 Gb Free Space | 23.51% Space Free | Partition Type: NTFS
Drive D: | 91.99 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: LAPTOP | User Name: Amanda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{082FA29F-143B-47ED-B66A-A11F0E6EA4A9}" = DNRGarmin
"{17424F35-8B77-4ADF-BC63-BF9B81418539}" = Apple Application Support
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{414A373B-59DF-4102-94CA-9FE9A74CBDDA}" = Garmin Trip and Waypoint Manager v5
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{99011A6E-5200-11DE-BDB8-7ACD56D89593}" = Rosetta Stone Version 3
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E8843212-F0FC-4C3B-BFF3-D51829CB4F19}" = iTunes
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"conduitEngine" = Conduit Engine
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HotspotShield" = Hotspot Shield 1.56
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"PowerISO" = PowerISO
"TVWiz" = Intel(R) TV Wizard
"uTorrent" = µTorrent
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"VLC media player" = VLC media player 1.1.5
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/8/2011 12:56:20 PM | Computer Name = Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/8/2011 12:56:20 PM | Computer Name = Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5187673

Error - 1/8/2011 12:56:20 PM | Computer Name = Laptop | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5187673

Error - 1/8/2011 12:56:34 PM | Computer Name = Laptop | Source = Bonjour Service | ID = 100
Description = WSARecvMsg failed (10022)

Error - 1/10/2011 12:16:13 AM | Computer Name = Laptop | Source = Windows Backup | ID = 4103
Description =

Error - 1/10/2011 7:37:53 PM | Computer Name = Laptop | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 1/10/2011 7:37:53 PM | Computer Name = Laptop | Source = Avira AntiVir | ID = 4117
Description = The keyfile contains no valid license. The service will be stopped!

Error - 1/10/2011 7:47:57 PM | Computer Name = Laptop | Source = Windows Backup | ID = 4103
Description =

Error - 1/10/2011 8:53:25 PM | Computer Name = Laptop | Source = Avira AntiVir | ID = 4110
Description = An unknown error occurred during init of the engine! Returned error
code: 0x35

Error - 1/10/2011 8:53:25 PM | Computer Name = Laptop | Source = Avira AntiVir | ID = 4117
Description = The keyfile contains no valid license. The service will be stopped!

[ System Events ]
Error - 12/30/2010 8:52:30 AM | Computer Name = Laptop | Source = DCOM | ID = 10010
Description =

Error - 1/3/2011 8:03:14 AM | Computer Name = Laptop | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 1/7/2011 1:19:41 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the lmhosts service.

Error - 1/8/2011 8:27:49 AM | Computer Name = Laptop | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 1/8/2011 9:10:32 AM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 1/8/2011 9:13:05 AM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 1/8/2011 9:20:51 AM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 1/10/2011 8:39:51 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 1/10/2011 8:41:26 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 1/10/2011 8:50:00 PM | Computer Name = Laptop | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

< End of report >

broni · 2011/01/10

Please, stop pasting very same log over an over.
If you're getting message to wait for a moderator approval, just do so - wait.\
Hold on there...

broni · 2011/01/10

First, I want you to check, if you're having same issue with Internet Explorer.

graceg · 2011/01/10

No, I don't seem to be having the same issue with Explorer.

broni · 2011/01/10

Please download [color= "#FF0000"]GooredFix[/color] from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Ensure all Firefox windows are closed.

To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).

When prompted to run the scan, click Yes.

GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

graceg · 2011/01/10

GooredFix log

GooredFix by jpshortstuff (03.07.10.1)
Log created at 20:55 on 10/01/2011 (Amanda)
Firefox version 3.6.13 (en-US)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
afurladvisor@anchorfree.com [01:12 25/12/2010]
{972ce4c6-7e08-4474-a285-3208198ce6fd} [14:53 16/11/2010]

C:\Users\Amanda\Application Data\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\
amznUWL@amazon.com [18:57 01/12/2010]
firefox@tvunetworks.com [05:39 09/01/2010]
personas@christopher.beard [05:39 09/01/2010]
{20a82645-c095-46ed-80e3-08825760534b} [18:48 05/09/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
(none)

---------- Old Logs ----------

-=E.O.F=-

broni · 2011/01/10

That's clean.
Let's clean some stuff with OTL and we'll go from there...
Hold on...

broni · 2011/01/10

Run OTL

Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

Code:

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSour...ctid=CT2786678
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = <local>;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyServer" = http=127.0.0.1:6522
FF - prefs.js..browser.search.defaultthis.engineName: "  "
FF - prefs.js..browser.search.defaulturl:  "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms} "
[2010/11/27 09:43:08 | 000,000,863 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\conduit.xml
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[1 C:\Users\Amanda\Documents\*.tmp files -> C:\Users\Amanda\Documents\*.tmp -> ]
[1 C:\Users\Amanda\Desktop\*.tmp files -> C:\Users\Amanda\Desktop\*.tmp -> ]

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]

Then click the [color= "#FF0000"]Run Fix[/color] button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply. Only one log will be created.

Let me know about redirection aftwerwards.

graceg · 2011/01/10

Post-reboot log:

All processes killed
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: " " removed from browser.search.defaultthis.engineName
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\conduit.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files\ConduitEngine\ConduitEngine.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
C:\Users\Amanda\Documents\~WRL0003.tmp deleted successfully.
C:\Users\Amanda\Desktop\~WRL0874.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Amanda
->Temp folder emptied: 139321 bytes
->Temporary Internet Files folder emptied: 9381813 bytes
->FireFox cache emptied: 77994681 bytes
->Flash cache emptied: 21749 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
RecycleBin emptied: 1406 bytes

Total Files Cleaned = 83.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Amanda
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.20.1 log created on 01102011_211859

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

graceg · 2011/01/10

And here's the post-quick scan log. Still redirects as before after running the fix.

OTL logfile created on: 1/10/2011 9:25:25 PM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Amanda\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

998.00 Mb Total Physical Memory | 467.00 Mb Available Physical Memory | 47.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 65.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.08 Gb Total Space | 24.64 Gb Free Space | 23.45% Space Free | Partition Type: NTFS
Drive D: | 91.99 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: LAPTOP | User Name: Amanda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
PRC - [2010/12/08 22:36:27 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/11/30 15:20:46 | 000,107,568 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpntray.exe
PRC - [2010/11/30 15:19:06 | 000,268,848 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/10/15 13:42:14 | 000,326,704 | ---- | M] () -- C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2010/10/15 13:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/08/02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/04/12 03:40:16 | 000,180,224 | ---- | M] (PowerISO Computing, Inc.) -- C:\Program Files\PowerISO\PWRISOVM.EXE
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sppsvc.exe
PRC - [2009/07/13 20:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

========== Modules (SafeList) ==========

MOD - [2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 20:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 20:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll
MOD - [2009/07/13 20:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\samcli.dll
MOD - [2009/07/13 20:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll
MOD - [2009/07/13 20:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netutils.dll
MOD - [2009/07/13 20:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 20:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 20:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll
MOD - [2009/07/13 20:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 20:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/12/08 22:36:27 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/11/30 15:20:50 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2010/11/30 15:19:06 | 000,268,848 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010/11/17 21:51:04 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/11/17 08:44:54 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/10/15 13:42:14 | 000,326,704 | ---- | M] () [Auto | Running] -- C:\Program Files\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010/10/15 13:35:30 | 000,352,304 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/07/13 20:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)
SRV - [2009/07/13 20:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)
SRV - [2009/07/13 20:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)
SRV - [2009/07/13 20:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2009/07/13 20:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)
SRV - [2009/07/13 20:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)
SRV - [2009/07/13 20:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)
SRV - [2009/07/13 20:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/07/13 20:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)
SRV - [2009/07/13 20:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/07/13 20:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2009/07/13 20:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)
SRV - [2009/07/13 20:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)
SRV - [2009/07/13 20:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 20:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)
SRV - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Amanda\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2010/12/20 08:59:04 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/11/22 21:19:15 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/22 14:19:02 | 000,037,376 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HssDrv.sys -- (HssDrv)
DRV - [2010/09/22 14:19:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2010/06/17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/04/12 03:44:34 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2009/12/11 02:44:02 | 000,133,720 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg)
DRV - [2009/09/23 19:18:14 | 004,808,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2009/07/13 20:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide)
DRV - [2009/07/13 20:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci)
DRV - [2009/07/13 20:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx)
DRV - [2009/07/13 20:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs)
DRV - [2009/07/13 20:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320)
DRV - [2009/07/13 20:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas)
DRV - [2009/07/13 20:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata)
DRV - [2009/07/13 20:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc)
DRV - [2009/07/13 20:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata)
DRV - [2009/07/13 20:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide)
DRV - [2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor)
DRV - [2009/07/13 20:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid)
DRV - [2009/07/13 20:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960)
DRV - [2009/07/13 20:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS)
DRV - [2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV)
DRV - [2009/07/13 20:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR)
DRV - [2009/07/13 20:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2009/07/13 20:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC)
DRV - [2009/07/13 20:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2)
DRV - [2009/07/13 20:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp)
DRV - [2009/07/13 20:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas)
DRV - [2009/07/13 20:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy)
DRV - [2009/07/13 20:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor)
DRV - [2009/07/13 20:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx)
DRV - [2009/07/13 20:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD)
DRV - [2009/07/13 20:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends)
DRV - [2009/07/13 20:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid)
DRV - [2009/07/13 20:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009/07/13 20:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp)
DRV - [2009/07/13 20:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 20:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot)
DRV - [2009/07/13 20:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/07/13 20:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide)
DRV - [2009/07/13 20:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300)
DRV - [2009/07/13 20:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost)
DRV - [2009/07/13 20:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx)
DRV - [2009/07/13 20:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4)
DRV - [2009/07/13 20:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw)
DRV - [2009/07/13 20:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2)
DRV - [2009/07/13 20:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor)
DRV - [2009/07/13 20:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG)
DRV - [2009/07/13 19:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 19:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus)
DRV - [2009/07/13 19:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP)
DRV - [2009/07/13 18:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 18:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf)
DRV - [2009/07/13 18:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap)
DRV - [2009/07/13 18:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus)
DRV - [2009/07/13 18:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\1394ohci.sys -- (1394ohci)
DRV - [2009/07/13 18:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass)
DRV - [2009/07/13 18:51:23 | 000,080,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2009/07/13 18:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 18:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf)
DRV - [2009/07/13 18:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig)
DRV - [2009/07/13 18:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus)
DRV - [2009/07/13 18:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID)
DRV - [2009/07/13 18:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter)
DRV - [2009/07/13 18:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 18:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009/07/13 18:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache)
DRV - [2009/07/13 18:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi)
DRV - [2009/07/13 18:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV - [2009/07/13 18:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdppm.sys -- (AmdPPM)
DRV - [2009/07/13 17:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 17:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm)
DRV - [2009/07/13 17:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer)
DRV - [2009/07/13 17:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm)
DRV - [2009/07/13 17:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo)
DRV - [2009/07/13 17:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp)
DRV - [2009/07/13 17:13:46 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTDPV3.SYS -- (SrvHsfV92)
DRV - [2009/07/13 17:13:45 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTCNXT3.SYS -- (SrvHsfWinac)
DRV - [2009/07/13 17:13:45 | 000,207,360 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (SrvHsfHDA)
DRV - [2009/07/13 17:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009/07/13 17:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009/07/13 17:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2009/07/13 17:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv)
DRV - [2009/07/13 17:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: " "
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm "
FF - prefs.js..browser.search.param.yahoo-type: "${8} "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://mail.google.com/mail/?zx=17m840dpd3yr7&shva=1#inbox "
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:1.1
FF - prefs.js..extensions.enabledItems: afurladvisor@anchorfree.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/19 10:04:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/19 10:04:19 | 000,000,000 | ---D | M]

[2010/11/16 09:53:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Extensions
[2011/01/10 18:48:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/01 13:57:59 | 000,000,000 | ---D | M] (Amazon Wish List) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\amznUWL@amazon.com
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\firefox@tvunetworks.com
[2010/11/16 08:54:29 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\extensions\personas@christopher.beard
[2009/07/04 12:17:18 | 000,001,765 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\amazon-search.xml
[2010/01/27 11:00:56 | 000,001,606 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\amazondotcom.xml
[2009/05/06 21:28:58 | 000,001,595 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\ebay.xml
[2010/07/26 20:18:21 | 000,004,153 | ---- | M] () -- C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\f4qqgve0.default\searchplugins\youtube.xml
[2010/12/29 15:20:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/12/24 20:12:39 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com

O1 HOSTS File: ([2011/01/10 19:49:57 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTo1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.77.134 68.87.72.134
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/02/14 12:37:30 | 000,000,043 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/10 21:20:42 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/01/10 21:18:59 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/01/10 20:53:57 | 000,000,000 | ---D | C] -- C:\Users\Amanda\Desktop\GooredFix Backups
[2011/01/10 20:53:38 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Amanda\Desktop\GooredFix.exe
[2011/01/10 20:18:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
[2011/01/10 19:52:19 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/01/10 19:40:09 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/01/10 19:40:09 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/01/10 19:40:09 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/01/10 19:40:02 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/01/10 19:39:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/01/10 19:39:30 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/01/08 08:10:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/12/28 15:01:48 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\Malwarebytes
[2010/12/28 15:01:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2010/12/28 15:01:42 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/28 15:01:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/12/28 15:01:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/28 15:01:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/28 15:00:12 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Amanda\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/28 14:57:34 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Amanda\Desktop\TFC.exe
[2010/12/26 20:22:09 | 001,912,872 | ---- | C] (Trend Micro Inc.) -- C:\Users\Amanda\Desktop\HousecallLauncher.exe
[2010/12/24 20:28:55 | 000,000,000 | ---D | C] -- C:\ProgramData\hssff
[2010/12/24 20:12:42 | 000,000,000 | ---D | C] -- C:\Hotspot Shield
[2010/12/24 20:12:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
[2010/12/24 20:12:36 | 000,000,000 | ---D | C] -- C:\Program Files\Hotspot Shield
[2010/12/24 16:44:48 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\vlc
[2010/12/24 16:44:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2010/12/24 16:43:48 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN
[2010/12/22 20:35:59 | 000,000,000 | ---D | C] -- C:\Users\Amanda\Desktop\picstoframe
[2010/12/16 20:59:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DNRGarmin
[2010/12/16 20:59:23 | 000,000,000 | ---D | C] -- C:\Program Files\dnrgarmin
[2010/12/16 20:57:38 | 008,908,595 | ---- | C] (GIS Section, Minnesota Department of Natural Resources ) -- C:\Users\Amanda\Desktop\dnrgarminsetup54.exe
[2010/12/16 20:49:54 | 000,000,000 | ---D | C] -- C:\Users\Amanda\Documents\My Garmin
[2010/12/16 20:49:53 | 000,000,000 | ---D | C] -- C:\Users\Amanda\AppData\Roaming\GARMIN
[2010/12/16 20:49:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2010/12/16 20:49:03 | 000,000,000 | ---D | C] -- C:\WebUpdater
[2010/12/16 20:46:43 | 000,018,432 | ---- | C] (GARMIN Corp.) -- C:\Windows\System32\drivers\grmngen.sys
[2010/12/16 20:46:42 | 000,000,000 | ---D | C] -- C:\Garmin
[2010/12/16 20:30:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2010/12/16 20:30:13 | 000,000,000 | ---D | C] -- C:\Program Files\Amazon

========== Files - Modified Within 30 Days ==========

[2011/01/10 21:28:06 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/10 21:28:06 | 000,013,440 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/10 21:25:10 | 000,615,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/10 21:25:10 | 000,103,702 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/10 21:20:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/01/10 21:20:38 | 785,092,608 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/10 20:53:38 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Amanda\Desktop\GooredFix.exe
[2011/01/10 20:18:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\OTL.exe
[2011/01/10 19:49:57 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/01/10 19:39:12 | 004,151,804 | R--- | M] () -- C:\Users\Amanda\Desktop\ComboFix.exe
[2011/01/07 16:43:34 | 001,107,262 | ---- | M] () -- C:\Users\Amanda\Documents\gradcare.pdf
[2010/12/28 15:54:12 | 000,624,128 | ---- | M] () -- C:\Users\Amanda\Desktop\dds.scr
[2010/12/28 15:53:35 | 000,080,384 | ---- | M] () -- C:\Users\Amanda\Desktop\MBRCheck.exe
[2010/12/28 15:35:04 | 000,296,448 | ---- | M] () -- C:\Users\Amanda\Desktop\ujmjy2qz.exe
[2010/12/28 15:00:46 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Amanda\Desktop\mbam-setup-1.50.1.1100.exe
[2010/12/28 14:57:37 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Amanda\Desktop\TFC.exe
[2010/12/26 20:24:40 | 000,000,036 | ---- | M] () -- C:\Users\Amanda\AppData\Local\housecall.guid.cache
[2010/12/26 20:22:14 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Amanda\Desktop\HousecallLauncher.exe
[2010/12/26 16:47:50 | 000,043,792 | ---- | M] () -- C:\Users\Amanda\Desktop\sorry-overshadowed-holiday-season-birthday-ecard-someecards.jpg
[2010/12/24 20:11:44 | 006,014,000 | ---- | M] () -- C:\Users\Amanda\Desktop\HSS-1.56-install-anchorfree-238-conduit2.exe
[2010/12/24 20:10:57 | 000,266,696 | ---- | M] () -- C:\Users\Amanda\Desktop\DM-238.exe
[2010/12/24 16:44:15 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/12/24 16:42:09 | 019,985,265 | ---- | M] () -- C:\Users\Amanda\Desktop\vlc-1.1.5-win32.exe
[2010/12/21 18:36:45 | 000,001,684 | ---- | M] () -- C:\Users\Amanda\Desktop\grid_Clip.shx
[2010/12/21 18:04:15 | 000,024,868 | ---- | M] () -- C:\Users\Amanda\Desktop\gridtubes_point.shx
[2010/12/21 09:16:10 | 000,606,555 | ---- | M] () -- C:\Users\Amanda\Documents\Eat__Pray__Love__One_Woman_s_Search_for_-_Elizabeth_Gilbert.pdf
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/20 08:59:04 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2010/12/20 07:22:50 | 001,145,338 | ---- | M] () -- C:\Users\Amanda\Desktop\IMGP0054.JPG
[2010/12/18 05:40:29 | 000,308,496 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/12/17 14:49:50 | 001,794,485 | ---- | M] () -- C:\Users\Amanda\Documents\534final.docx
[2010/12/17 14:19:10 | 000,453,541 | ---- | M] () -- C:\Users\Amanda\Desktop\demsquare.tif
[2010/12/17 14:19:08 | 000,453,541 | ---- | M] () -- C:\Users\Amanda\Desktop\demuntrans.tif
[2010/12/16 21:35:13 | 000,000,676 | ---- | M] () -- C:\Users\Amanda\Desktop\forgarmin_Project.shx
[2010/12/16 20:59:27 | 000,001,867 | ---- | M] () -- C:\Users\Public\Desktop\DNR Garmin.lnk
[2010/12/16 19:03:01 | 000,026,636 | ---- | M] () -- C:\Users\Amanda\Desktop\models.docx
[2010/12/13 15:13:24 | 000,004,036 | ---- | M] () -- C:\Users\Amanda\Desktop\paystub.pdf

========== Files Created - No Company Name ==========

[2011/01/10 19:40:09 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/01/10 19:40:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/01/10 19:40:09 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/01/10 19:40:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/01/10 19:40:09 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/01/10 19:37:54 | 004,151,804 | R--- | C] () -- C:\Users\Amanda\Desktop\ComboFix.exe
[2011/01/07 16:43:34 | 001,107,262 | ---- | C] () -- C:\Users\Amanda\Documents\gradcare.pdf
[2011/01/07 10:20:13 | 001,145,338 | ---- | C] () -- C:\Users\Amanda\Desktop\IMGP0054.JPG
[2010/12/28 15:54:12 | 000,624,128 | ---- | C] () -- C:\Users\Amanda\Desktop\dds.scr
[2010/12/28 15:53:35 | 000,080,384 | ---- | C] () -- C:\Users\Amanda\Desktop\MBRCheck.exe
[2010/12/28 15:35:03 | 000,296,448 | ---- | C] () -- C:\Users\Amanda\Desktop\ujmjy2qz.exe
[2010/12/26 20:24:40 | 000,000,036 | ---- | C] () -- C:\Users\Amanda\AppData\Local\housecall.guid.cache
[2010/12/26 16:45:40 | 000,043,792 | ---- | C] () -- C:\Users\Amanda\Desktop\sorry-overshadowed-holiday-season-birthday-ecard-someecards.jpg
[2010/12/24 20:11:18 | 006,014,000 | ---- | C] () -- C:\Users\Amanda\Desktop\HSS-1.56-install-anchorfree-238-conduit2.exe
[2010/12/24 20:10:57 | 000,266,696 | ---- | C] () -- C:\Users\Amanda\Desktop\DM-238.exe
[2010/12/24 16:44:15 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/12/24 16:40:48 | 019,985,265 | ---- | C] () -- C:\Users\Amanda\Desktop\vlc-1.1.5-win32.exe
[2010/12/21 18:36:44 | 000,001,684 | ---- | C] () -- C:\Users\Amanda\Desktop\grid_Clip.shx
[2010/12/21 18:04:14 | 000,024,868 | ---- | C] () -- C:\Users\Amanda\Desktop\gridtubes_point.shx
[2010/12/21 09:16:10 | 000,606,555 | ---- | C] () -- C:\Users\Amanda\Documents\Eat__Pray__Love__One_Woman_s_Search_for_-_Elizabeth_Gilbert.pdf
[2010/12/17 14:19:07 | 000,453,541 | ---- | C] () -- C:\Users\Amanda\Desktop\demsquare.tif
[2010/12/17 14:19:00 | 000,453,541 | ---- | C] () -- C:\Users\Amanda\Desktop\demuntrans.tif
[2010/12/16 21:35:13 | 000,000,676 | ---- | C] () -- C:\Users\Amanda\Desktop\forgarmin_Project.shx
[2010/12/16 20:59:27 | 000,001,867 | ---- | C] () -- C:\Users\Public\Desktop\DNR Garmin.lnk
[2010/12/16 18:10:14 | 000,026,636 | ---- | C] () -- C:\Users\Amanda\Desktop\models.docx
[2010/12/13 15:13:24 | 000,004,036 | ---- | C] () -- C:\Users\Amanda\Desktop\paystub.pdf
[2010/11/16 00:46:46 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2010/12/16 22:56:35 | 000,000,000 | ---D | M] -- C:\Users\Amanda\AppData\Roaming\GARMIN
[2011/01/10 21:22:14 | 000,000,000 | ---D | M] -- C:\Users\Amanda\AppData\Roaming\uTorrent
[2009/07/13 23:53:46 | 000,008,680 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

Log in or Sign up

Inactive Firefox redirecting to Ask or Qbyrd

graceg Inactive Thread Starter

Admin. Administrator Administrator Staff

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

graceg Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

graceg Inactive Thread Starter

graceg Inactive Thread Starter

Share This Page

Log in or Sign up

Inactive Firefox redirecting to Ask or Qbyrd

graceg Inactive Thread Starter

Admin. Administrator Administrator Staff

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

graceg Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

graceg Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

graceg Inactive Thread Starter

graceg Inactive Thread Starter

Share This Page

Useful Searches