Solved I think I have a virus - system is VERY slow

Bocagal1 · 2013/04/18

[Resolved] I think I have a virus - system is VERY slow

As Directed, here are the logs I've been able to create.
MBAM
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.04.11.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Rosemary :: DAN-9B587E4D6B [administrator]

4/17/2013 7:17:34 PM
mbam-log-2013-04-17 (19-17-34).txt

Scan type: Full scan (C:\|D:\|F:\|G:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 694955
Time elapsed: 2 hour(s), 38 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

aswMBR

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-18 03:31:32
-----------------------------
03:31:32.093 OS Version: Windows 5.1.2600 Service Pack 3
03:31:32.093 Number of processors: 2 586 0x170A
03:31:32.093 ComputerName: DAN-9B587E4D6B UserName: Rosemary
03:31:34.140 Initialize success
03:31:34.828 AVAST engine defs: 13041701
03:31:41.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5
03:31:41.171 Disk 0 Vendor: Hitachi_HDS721010CLA332 JP4OA3MA Size: 953869MB BusType: 3
03:31:41.250 Disk 0 MBR read successfully
03:31:41.250 Disk 0 MBR scan
03:31:41.265 Disk 0 unknown MBR code
03:31:41.265 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 478020 MB offset 2048
03:31:41.265 Disk 0 Partition - 00 05 Extended 475848 MB offset 978987008
03:31:41.281 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 424582 MB offset 978989056
03:31:41.296 Disk 0 scanning sectors +1953525168
03:31:41.312 Disk 0 scanning C:\WINDOWS\system32\drivers
03:31:47.609 Service scanning
03:31:56.421 Modules scanning
03:32:09.437 Disk 0 trace - called modules:
03:32:09.453 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
03:32:09.453 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b0b7030]
03:32:09.453 3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\0000006d[0x8b0f73b8]
03:32:09.453 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-5[0x8b0bbd98]
03:32:16.156 AVAST engine scan C:\WINDOWS
03:32:23.937 AVAST engine scan C:\WINDOWS\system32
03:34:10.765 AVAST engine scan C:\WINDOWS\system32\drivers
03:34:25.343 AVAST engine scan C:\Documents and Settings\Rosemary
03:54:50.593 AVAST engine scan C:\Documents and Settings\All Users
03:57:45.921 Scan finished successfully
04:28:44.703 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Rosemary\Desktop\MBR.dat "
04:28:44.703 The log file has been saved successfully to "C:\Documents and Settings\Rosemary\Desktop\aswMBR.txt "

Downloaded DDS, but it will not run, after 2 hours of waiting I had to power off the system to get back to make this post.

After re-starting the system a notepad window opens with this message.

CreateObject( "Scripting.FileSystemObject ").DeleteFile "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\openURL.vbs "

Thanks for any suggestions.

broni · 2013/04/18

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=====================================

Download RogueKiller on the desktop

Close all the running programs

Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator

Otherwise just double-click on RogueKiller.exe

Pre-scan will start. Let it finish.

Click on SCAN button.

Wait until the Status box shows Scan Finished

Click on Delete.

Wait until the Status box shows Deleting Finished.

Click on Report and copy/paste the content of the Notepad into your next reply.

RKreport.txt could also be found on your desktop.

If more than one log is produced post all logs.

If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.

Open the folder where the contents were unzipped and run mbar.exe

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Click on the Cleanup button to remove any threats and reboot if prompted to do so.

Wait while the system shuts down and the cleanup process is performed.

Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

Bocagal1 · 2013/04/18

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Rosemary [Admin rights]
Mode : DNSFix -- Date : 04/18/2013 19:06:12
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤
-> F:\windows\system32\config\SOFTWARE
-> F:\windows\system32\config\SYSTEM
-> F:\Documents and Settings\Administrator\NTUSER.DAT
-> F:\Documents and Settings\Default User\NTUSER.DAT
-> F:\Documents and Settings\LocalService\NTUSER.DAT
-> F:\Documents and Settings\NetworkService\NTUSER.DAT

Finished : << RKreport[4]_DN_04182013_02d1906.txt >>
RKreport[1]_S_04182013_02d1904.txt ; RKreport[2]_H_04182013_02d1906.txt ; RKreport[3]_PR_04182013_02d1906.txt ; RKreport[4]_DN_04182013_02d1906.txt

Bocagal1 · 2013/04/19

Ran MBAR, It posted,'no threats'. Can't find the logs in the MBAR folder. Still running VERY clowly.

Just got a pop-up on IE panel

"Stop tunning script in this broser Y/N Continuing this script could cause the browser to run slowly "

I agree to that so replied Y - stop script. How do I determine the rougue script?

On boot after running MBAR Notepad window contins
CreateObject( "Scripting.FileSystemObject ").DeleteFile "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\openURL.vbs "

broni · 2013/04/19

Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
- Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
- XP: http://support.microsoft.com/kb/948247

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

Bocagal1 · 2013/04/21

Combo fix doesn't work. I've re-started MS Security Essentials. When cicking on the link in bleeping computer.com to download RKill I was re-directed to
http://googleads.g.doubleclick.net/...eLaHZKQSOQurYHfgfJ1uwdDsafHtiXFC2Px7o7evmy_fA

I'm very concerned about downloading from a site when redirected to something with a new reference/

Clicking on eith Bleeping computer site redirects me to

http://www.reimageplus.com/lp/nhome...ct&lpx=LP-21&gclid=CNuq_72h3LYCFYNx4AodPA4AoA

NOT a D/L for RKILL

broni · 2013/04/21

Uploaded rKill for you here: http://www.sendspace.com/file/q4da01

Bocagal1 · 2013/04/22

Thank you for posting RKill at the alternate site.

RKILL log posted here. Combofix renamed Rosemary.exe still freezes machine. Need to power off then power on to make this post.

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/21/2013 09:40:05 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* AFD (AFD) is not Running.
Startup Type set to: System

* DHCP Client (Dhcp) is not Running.
Startup Type set to: Automatic

* DNS Client (Dnscache) is not Running.
Startup Type set to: Automatic

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Manual

* Network Connections (Netman) is not Running.
Startup Type set to: Manual

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic

* Automatic Updates (wuauserv) is not Running.
Startup Type set to: Automatic

* AFD (AFD) is not Running.
Startup Type set to: System

* IPSEC driver (IPSec) is not Running.
Startup Type set to: System

* NetBios over Tcpip (NetBT) is not Running.
Startup Type set to: System

* TCP/IP Protocol Driver (Tcpip) is not Running.
Startup Type set to: System

* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\sfcfiles.dll [NoSig]

* C:\WINDOWS\System32\winlogon.exe [NoSig]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 04/21/2013 09:41:18 PM
Execution time: 0 hours(s), 1 minute(s), and 12 seconds(s)

broni · 2013/04/22

Combofix?

Bocagal1 · 2013/04/23

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

I renamed Combofix.exe to Rosemary.exe as it wouldn't run under combofix.exe.

Rosemary.exe still did not run. It froze and I needed to turn the machine off using the power button, and then used power button to turn back on, so I could enter this post.

Sorry, but this 'thing' seems very stubborn.

broni · 2013/04/23

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.[/*]

Press Scan button.[/*]

It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.[/*]

The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.[/*]

Bocagal1 · 2013/04/24

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-04-2013 03
Ran by Rosemary (administrator) on 24-04-2013 01:58:57
Running from C:\Documents and Settings\Rosemary\Desktop
Microsoft Windows XP Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================

(Microsoft Corporation) [1080] C:\Program Files\Microsoft Security Client\MsMpEng.exe
(SEIKO EPSON CORPORATION) [1288] C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
(SEIKO EPSON CORPORATION) [1308] C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
(Intuit Inc.) [1392] C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
(Intuit Inc.) [1472] C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(NVIDIA Corporation) [1208] C:\WINDOWS\system32\nvsvc32.exe
(Intuit) [184] C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Intuit Inc.) [556] C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
(Carbonite, Inc. (www.carbonite.com)) [2408] C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
(Carbonite, Inc.) [3316] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
(Microsoft Corporation) [3348] C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) [3456] C:\Program Files\Messenger\msmsgs.exe
(Dropbox, Inc.) [3540] C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) [3064] C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) [3356] C:\Program Files\Internet Explorer\iexplore.exe
(Intuit Inc.) [2164] C:\Program Files\Intuit\QuickBooks 2012\qbw32.exe
(Microsoft Corporation) [2124] C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Intel Corporation) [4972] C:\WINDOWS\system32\igfxsrvc.exe
(Microsoft Corporation) [5804] C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) [5400] C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) [500] C:\Program Files\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) [6084] C:\Program Files\Windows Live\Contacts\wlcomm.exe
(Farbar) [3448] C:\Documents and Settings\Rosemary\Desktop\FRST.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe [1065480 2013-02-05] (Carbonite, Inc.)
HKLM\...\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exeXXX startup [2643320 2012-10-26] (Intuit Inc. All rights reserved.)
HKLM\...\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exeXXX /autorun [606208 2009-12-09] ()
HKLM\...\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exeXXX 1 [40983152 2010-08-11] (VIA Technologies, Inc.)
HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [15517984 2013-03-21] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] RUNDLL32.EXEXXX C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [108832 2013-03-21] (NVIDIA Corporation)
HKLM\...\Winlogon: [System]
Winlogon\Notify\WgaLogon: WgaLogon.dll (Microsoft Corporation)
HKCU\...\Run: [Auto EPSON Stylus Photo R280 Series (Copy 1) on PREFERRE-901505] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S68.tmp" /EF "HKCU" [x]
HKCU\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [1695232 2008-04-14] (Microsoft Corporation)
HKU\Administrator\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [x]
HKU\Dan\...\Run: [EPSON Stylus Photo R280 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S8E.tmp" /EF "HKCU" [x]
HKU\Dan\...\Run: [Auto EPSON Stylus Photo R280 Series on PREFERRE-901505] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S6FE.tmp" /EF "HKCU" [x]
HKU\Dan\...\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [ 2008-04-14] (Microsoft Corporation)
HKU\Dan\...\Run: [EPSON WorkForce 600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEKA.EXE /FU "C:\WINDOWS\TEMP\E_S83.tmp" /EF "HKCU" [x]
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" [x]
HKU\UpdatusUser\...\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" [x]
Startup: C:\Documents and Settings\Rosemary\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: No Name - {5EB1D2B1-45DC-48B3-852D-E575B405B851} - No File
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
PDF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab
PDF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
PDF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
PDF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
Handler: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Rosemary\Application Data\Mozilla\Firefox\Profiles\m34ymj1u.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.0.0\\npsitesafety.dll No File
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========================== Services (Whitelisted) =================

R2 CarboniteService; C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe [5007880 2013-02-05] (Carbonite, Inc. (www.carbonite.com))
R2 EPSON_EB_RPCV4_01; C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE [143872 2007-12-17] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_01; C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S2 PEVSystemStart; C:\Rosemary11905R\SWREG.3XE [518144 2000-08-30] (SteelWerX)
R2 QBVSS; C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2011-08-19] (Intuit Inc.)

==================== Drivers (Whitelisted) ====================

R1 BANTExt; C:\Windows\System32\Drivers\BANTExt.sys [3840 2011-08-09] ()
R3 dvd43llh; C:\Windows\System32\DRIVERS\dvd43llh.sys [18816 2012-03-14] (RIF)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-14] (Windows (R) Server 2003 DDK provider)
R3 L1c; C:\Windows\System32\DRIVERS\l1c51x86.sys [50176 2009-11-30] (Atheros Communications, Inc.)
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [35144 2013-04-18] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
R3 NVHDA; C:\Windows\System32\drivers\nvhda32.sys [128440 2012-12-19] (NVIDIA Corporation)
S3 RTL8023xp; C:\Windows\System32\DRIVERS\Rtnicxp.sys [118656 2009-02-24] (TRENDware International, Inc )
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [12984 2012-06-01] ()
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [2127728 2010-08-04] (VIA Technologies, Inc.)
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl [87536 2010-04-02] (CyberLink Corp.)
S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 adpu160m; No ImagePath
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 AliIde; No ImagePath
S4 amsint; No ImagePath
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 catchme; \??\C:\DOCUME~1\Rosemary\LOCALS~1\Temp\catchme.sys [x]
S4 cd20xrnt; No ImagePath
S1 Changer; No ImagePath
S4 CmdIde; No ImagePath
S4 Cpqarray; No ImagePath
U4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S2 DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys [x]
S4 dpti2o; No ImagePath
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S4 ini910u; No ImagePath
S4 IntelIde; No ImagePath
S1 lbrtfdc; No ImagePath
S4 mraid35x; No ImagePath
S3 MSICDSetup; \??\D:\CDriver.sys [x]
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S4 Simbad; No ImagePath
S4 Sparrow; No ImagePath
S2 SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys [x]
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S4 TosIde; No ImagePath
S4 ultra; No ImagePath
S4 ViaIde; No ImagePath
S3 WDICA; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-04-24 01:58 - 2013-04-24 01:58 - 00000000 ____D C:\FRST
2013-04-24 01:57 - 2013-04-24 01:58 - 01147871 ____A (Farbar) C:\Documents and Settings\Rosemary\Desktop\FRST.exe
2013-04-24 01:55 - 2013-04-24 01:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\APN
2013-04-21 21:43 - 2013-04-21 21:44 - 00000000 ___SD C:\Rosemary11905R
2013-04-21 21:40 - 2013-04-21 21:41 - 00004084 ____A C:\Documents and Settings\Rosemary\Desktop\Rkill.txt
2013-04-21 21:31 - 2013-04-21 21:31 - 01752992 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Rosemary\Desktop\rkill.exe
2013-04-21 12:14 - 2013-04-21 12:14 - 05057323 ____R (Swearware) C:\Documents and Settings\Rosemary\Desktop\Rosemary.exe
2013-04-20 10:29 - 2013-04-20 10:29 - 00000000 ____D C:\Intuit
2013-04-20 09:53 - 2013-04-20 09:53 - 00001767 ____A C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
2013-04-20 09:53 - 2013-04-20 09:53 - 00000000 ____D C:\Program Files\Belarc
2013-04-20 09:53 - 2011-08-09 17:33 - 00003840 ____A C:\Windows\System32\Drivers\BANTExt.sys
2013-04-20 09:33 - 2013-04-20 09:34 - 00000000 ____D C:\Program Files\Speccy
2013-04-20 09:23 - 2013-03-21 18:30 - 00335872 ____A (NVIDIA Corporation) C:\Windows\System32\nvrshe.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00335872 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsar.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00286720 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsfr.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00282624 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsit.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00282624 ____A (NVIDIA Corporation) C:\Windows\System32\nvrses.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00282624 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsel.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00278528 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsde.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00274432 ____A (NVIDIA Corporation) C:\Windows\System32\nvrspt.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00274432 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsnl.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00274432 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsja.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00274432 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsesm.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00270336 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsru.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00270336 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsptb.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00266240 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsko.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00262144 ____A (NVIDIA Corporation) C:\Windows\System32\nvrshu.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00258048 ____A (NVIDIA Corporation) C:\Windows\System32\nvrstr.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00258048 ____A (NVIDIA Corporation) C:\Windows\System32\nvrssl.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00258048 ____A (NVIDIA Corporation) C:\Windows\System32\nvrssk.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00258048 ____A (NVIDIA Corporation) C:\Windows\System32\nvrspl.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00253952 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsth.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00253952 ____A (NVIDIA Corporation) C:\Windows\System32\nvrssv.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00253952 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsno.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00253952 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsda.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00249856 ____A (NVIDIA Corporation) C:\Windows\System32\nvrsfi.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00249856 ____A (NVIDIA Corporation) C:\Windows\System32\nvrseng.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00249856 ____A (NVIDIA Corporation) C:\Windows\System32\nvrscs.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00229376 ____A (NVIDIA Corporation) C:\Windows\System32\nvrszhc.dll
2013-04-20 09:23 - 2013-03-21 18:30 - 00126976 ____A (NVIDIA Corporation) C:\Windows\System32\nvrszht.dll
2013-04-19 21:41 - 2013-04-19 21:42 - 00000000 ____D C:\Program Files\Dropbox
2013-04-19 21:33 - 2013-04-19 21:34 - 00016422 ____A C:\Windows\KB2817183-IE8.log
2013-04-19 21:32 - 2013-04-19 21:32 - 00000000 __HDC C:\Windows\$NtUninstallKB2808735$
2013-04-19 21:29 - 2013-04-19 21:29 - 00000000 __HDC C:\Windows\$NtUninstallKB2820917$
2013-04-19 21:23 - 2013-04-19 21:23 - 00000000 __HDC C:\Windows\$NtUninstallKB2813345$
2013-04-19 21:22 - 2013-04-19 21:22 - 00000000 __HDC C:\Windows\$NtUninstallKB2813170$
2013-04-19 21:14 - 2013-04-19 21:32 - 00012581 ____A C:\Windows\KB2808735.log
2013-04-19 21:14 - 2013-04-19 21:30 - 00011596 ____A C:\Windows\KB2820917.log
2013-04-19 21:13 - 2013-04-19 21:23 - 00012044 ____A C:\Windows\KB2813345.log
2013-04-19 21:12 - 2013-04-22 07:39 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-04-19 21:01 - 2013-04-19 21:02 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-04-19 00:44 - 2013-04-19 00:44 - 00074703 ____A C:\Windows\System32\mfc45.dat
2013-04-18 21:14 - 2013-04-18 21:14 - 00035144 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-04-17 18:57 - 2013-04-17 18:57 - 00003874 ____A C:\Windows\System32\jupdate-1.7.0_21-b11.log
2013-04-17 18:51 - 2013-04-17 18:51 - 00000000 ____D C:\Documents and Settings\Dan\Application Data\Malwarebytes
2013-04-17 13:31 - 2013-04-02 05:33 - 00445930 ___RA C:\Windows\System32\Drivers\etc\hosts.20130417-133112.backup
2013-04-17 06:20 - 2013-04-19 18:50 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\Google
2013-04-17 06:20 - 2013-03-06 18:32 - 00228600 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe
2013-04-17 06:17 - 2013-04-19 20:52 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVAST Software
2013-04-15 09:17 - 2013-04-15 09:17 - 00000000 RASHD C:\cmdcons
2013-04-15 09:17 - 2011-04-13 21:02 - 00000211 ____A C:\Boot.bak
2013-04-15 09:17 - 2004-08-03 23:00 - 00260272 _RASH C:\cmldr
2013-04-15 08:30 - 2011-06-26 02:45 - 00256000 ____A C:\Windows\PEV.exe
2013-04-15 08:30 - 2010-11-07 13:20 - 00208896 ____A C:\Windows\MBR.exe
2013-04-15 08:30 - 2009-04-20 00:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00212480 ____A (SteelWerX) C:\Windows\SWXCACLS.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00098816 ____A C:\Windows\sed.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00080412 ____A C:\Windows\grep.exe
2013-04-15 08:30 - 2000-08-30 20:00 - 00068096 ____A C:\Windows\zip.exe
2013-04-15 08:29 - 2013-04-15 08:30 - 00000000 ____D C:\Qoobox
2013-04-15 08:27 - 2013-04-15 08:27 - 00000000 ____D C:\Windows\erdnt
2013-04-12 15:27 - 2013-04-12 15:27 - 00000000 ____D C:\Documents and Settings\Dan\Local Settings\Application Data\AVG Secure Search
2013-04-12 08:30 - 2013-04-14 06:49 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-04-11 17:40 - 2013-04-11 17:41 - 00014414 ____A C:\AdwCleaner[S1].txt
2013-04-11 17:40 - 2013-04-11 17:40 - 00014332 ____A C:\AdwCleaner[R1].txt
2013-04-11 17:21 - 2013-04-11 17:21 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\Apple
2013-04-11 11:21 - 2013-04-11 11:21 - 00334728 ____A C:\Documents and Settings\Rosemary\My Documents\12 Gardner.tax2012
2013-04-04 10:49 - 2013-04-04 10:49 - 00098304 ____A C:\Windows\Minidump\Mini040413-01.dmp
2013-04-04 10:49 - 2013-04-04 10:49 - 00000000 ____D C:\Windows\Minidump
2013-04-04 08:51 - 2013-04-11 17:23 - 00000790 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-04 08:51 - 2013-04-11 17:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-04-04 08:51 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-04 08:51 - 2013-04-04 08:51 - 00000000 ____D C:\Documents and Settings\Rosemary\Application Data\Malwarebytes
2013-04-04 08:51 - 2013-04-04 08:51 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-04-04 08:43 - 2013-04-04 08:43 - 00000000 __SHD C:\Documents and Settings\Rosemary\IECompatCache
2013-04-04 08:31 - 2013-04-04 08:31 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Intuit
2013-04-02 07:45 - 2013-04-02 07:45 - 00000631 ____A C:\Documents and Settings\Rosemary\Desktop\April '13 ours.lnk
2013-04-02 05:33 - 2013-04-02 05:27 - 00445930 ___RA C:\Windows\System32\Drivers\etc\hosts.20130402-053310.backup
2013-04-02 05:32 - 2013-04-02 05:33 - 06589347 ____A C:\immudebug.log
2013-04-02 05:27 - 2010-03-07 22:57 - 00445930 ___RA C:\Windows\System32\Drivers\etc\hosts.20130402-052737.backup
2013-04-02 05:26 - 2013-04-02 05:26 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\iolo
2013-04-01 14:12 - 2013-04-01 14:12 - 00000000 __SHD C:\Documents and Settings\UpdatusUser\IETldCache
2013-03-30 10:26 - 2013-03-30 10:26 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\AVG SafeGuard toolbar
2013-03-30 10:25 - 2013-03-30 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-03-29 17:34 - 2013-03-29 17:34 - 00000000 ____D C:\Documents and Settings\Dan\Local Settings\Application Data\AVG SafeGuard toolbar
2013-03-29 09:23 - 2013-03-29 09:23 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
2013-03-29 09:17 - 2013-03-29 09:17 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\MFAData
2013-03-27 13:48 - 2013-03-27 13:48 - 01167536 ____A C:\Windows\isRS-000.tmp
2013-03-25 00:28 - 2013-04-01 07:13 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\LogMeIn Rescue Applet

==================== One Month Modified Files and Folders ========

2013-04-24 01:58 - 2013-04-24 01:58 - 00000000 ____D C:\FRST
2013-04-24 01:58 - 2013-04-24 01:57 - 01147871 ____A (Farbar) C:\Documents and Settings\Rosemary\Desktop\FRST.exe
2013-04-24 01:55 - 2013-04-24 01:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\APN
2013-04-24 01:18 - 2012-04-10 17:23 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-04-23 23:50 - 2011-04-13 21:06 - 01507161 ____A C:\Windows\WindowsUpdate.log
2013-04-23 21:06 - 2012-03-02 17:28 - 00000000 ____D C:\Windows\System32\NtmsData
2013-04-23 11:18 - 2011-04-13 21:10 - 00032418 ____A C:\Windows\SchedLgU.Txt
2013-04-22 07:46 - 2011-04-13 21:04 - 00000000 ____D C:\Windows\Registration
2013-04-22 07:39 - 2013-04-19 21:12 - 00000384 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-04-22 07:32 - 2013-03-08 22:21 - 00000000 ___RD C:\Documents and Settings\Rosemary\My Documents\Dropbox
2013-04-22 07:32 - 2013-03-08 22:13 - 00000000 ____D C:\Documents and Settings\Rosemary\Application Data\Dropbox
2013-04-22 07:30 - 2011-04-13 16:58 - 00000159 ____A C:\Windows\wiadebug.log
2013-04-22 07:30 - 2011-04-13 16:58 - 00000049 ____A C:\Windows\wiaservc.log
2013-04-22 07:30 - 2008-04-14 08:00 - 00002278 ____A C:\Windows\System32\wpa.dbl
2013-04-22 07:29 - 2011-11-22 10:03 - 00000062 __ASH C:\Documents and Settings\Rosemary\Local Settings\desktop.ini
2013-04-22 07:29 - 2011-04-13 21:10 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-22 07:28 - 2011-04-13 21:10 - 00000062 __ASH C:\Documents and Settings\LocalService\Local Settings\desktop.ini
2013-04-22 07:28 - 2011-04-13 21:09 - 00000062 __ASH C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
2013-04-21 21:44 - 2013-04-21 21:43 - 00000000 ___SD C:\Rosemary11905R
2013-04-21 21:41 - 2013-04-21 21:40 - 00004084 ____A C:\Documents and Settings\Rosemary\Desktop\Rkill.txt
2013-04-21 21:37 - 2011-11-22 10:04 - 00000178 ___SH C:\Documents and Settings\Rosemary\ntuser.ini
2013-04-21 21:33 - 2012-01-07 12:49 - 00311318 ___AC C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2013-04-21 21:33 - 2010-03-07 13:45 - 04546224 ____A C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1993962763-1383384898-1801674531-1008-0.dat
2013-04-21 21:33 - 2010-03-07 13:45 - 02189304 ____A C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2013-04-21 21:31 - 2013-04-21 21:31 - 01752992 ____A (Bleeping Computer, LLC) C:\Documents and Settings\Rosemary\Desktop\rkill.exe
2013-04-21 15:35 - 2013-03-09 18:42 - 00000089 ____A C:\Windows\QBChanUtil_Trigger.ini
2013-04-21 15:29 - 2011-11-22 10:50 - 00000060 ____A C:\Windows\wpd99.drv
2013-04-21 15:29 - 2011-11-22 10:50 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\pdf995
2013-04-21 15:14 - 2010-03-07 14:02 - 00000000 ____D C:\Documents and Settings\Rosemary\Desktop\Tax letters
2013-04-21 13:18 - 2010-03-08 00:12 - 00002399 ____A C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk
2013-04-21 12:14 - 2013-04-21 12:14 - 05057323 ____R (Swearware) C:\Documents and Settings\Rosemary\Desktop\Rosemary.exe
2013-04-20 18:25 - 2010-03-07 22:57 - 00000000 ____D C:\Documents and Settings\Rosemary\Desktop\System Utilities
2013-04-20 18:17 - 2011-04-13 16:54 - 00186191 ____A C:\Windows\setupact.log
2013-04-20 11:16 - 2011-09-22 14:09 - 00000000 ____D C:\Windows\Microsoft.NET
2013-04-20 10:29 - 2013-04-20 10:29 - 00000000 ____D C:\Intuit
2013-04-20 10:01 - 2011-04-13 16:47 - 00000000 ____D C:\Windows\security
2013-04-20 09:53 - 2013-04-20 09:53 - 00001767 ____A C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
2013-04-20 09:53 - 2013-04-20 09:53 - 00000000 ____D C:\Program Files\Belarc
2013-04-20 09:47 - 2013-02-12 20:04 - 00619604 ____A C:\Windows\setupapi.log
2013-04-20 09:39 - 2011-04-13 21:51 - 00000000 ____D C:\Program Files\WinRAR
2013-04-20 09:37 - 2010-03-07 13:48 - 00007942 ____A C:\Windows\System32\nvAppTimestamps
2013-04-20 09:34 - 2013-04-20 09:33 - 00000000 ____D C:\Program Files\Speccy
2013-04-20 09:23 - 2011-04-13 16:47 - 00000000 ____D C:\Windows\Help
2013-04-20 09:22 - 2010-03-07 13:38 - 01072544 ____A C:\Windows\System32\nvdrsdb0.bin
2013-04-20 09:22 - 2010-03-07 13:38 - 00000001 ____A C:\Windows\System32\nvdrssel.bin
2013-04-20 09:17 - 2010-03-07 13:38 - 01072544 ____A C:\Windows\System32\nvdrsdb1.bin
2013-04-20 09:16 - 2010-03-07 13:37 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-04-20 09:14 - 2011-04-13 21:17 - 00000000 ____D C:\Windows\System32\ReinstallBackups
2013-04-20 09:12 - 2011-04-13 16:55 - 00581796 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-20 08:09 - 2011-04-14 05:26 - 00000000 ____D C:\Software
2013-04-20 02:30 - 2011-09-22 09:36 - 00000000 ____D C:\D
2013-04-20 02:01 - 2010-03-07 14:03 - 00000000 ____D C:\Download
2013-04-19 21:56 - 2011-04-13 16:54 - 00348200 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-19 21:42 - 2013-04-19 21:41 - 00000000 ____D C:\Program Files\Dropbox
2013-04-19 21:41 - 2013-03-08 22:21 - 00001033 ____A C:\Documents and Settings\Rosemary\Desktop\Dropbox.lnk
2013-04-19 21:34 - 2013-04-19 21:33 - 00016422 ____A C:\Windows\KB2817183-IE8.log
2013-04-19 21:34 - 2013-03-15 09:50 - 00021639 ____A C:\Windows\comsetup.log
2013-04-19 21:34 - 2011-04-13 22:14 - 00123744 ___AC C:\Windows\updspapi.log
2013-04-19 21:34 - 2011-04-13 16:55 - 01645906 ____A C:\Windows\iis6.log
2013-04-19 21:34 - 2011-04-13 16:55 - 01388128 ____A C:\Windows\FaxSetup.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00758572 ____A C:\Windows\ocgen.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00652759 ____A C:\Windows\tsoc.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00448746 ____A C:\Windows\msmqinst.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00293889 ____A C:\Windows\ntdtcsetup.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00245811 ____A C:\Windows\netfxocm.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00098226 ____A C:\Windows\MedCtrOC.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00078281 ____A C:\Windows\ocmsn.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00071065 ____A C:\Windows\msgsocm.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00069714 ____A C:\Windows\tabletoc.log
2013-04-19 21:34 - 2011-04-13 16:55 - 00001374 ____A C:\Windows\imsins.log
2013-04-19 21:33 - 2011-04-13 21:55 - 00000000 ___HD C:\Windows\$hf_mig$
2013-04-19 21:32 - 2013-04-19 21:32 - 00000000 __HDC C:\Windows\$NtUninstallKB2808735$
2013-04-19 21:32 - 2013-04-19 21:14 - 00012581 ____A C:\Windows\KB2808735.log
2013-04-19 21:32 - 2011-04-13 16:55 - 00001374 ____A C:\Windows\imsins.BAK
2013-04-19 21:30 - 2013-04-19 21:14 - 00011596 ____A C:\Windows\KB2820917.log
2013-04-19 21:29 - 2013-04-19 21:29 - 00000000 __HDC C:\Windows\$NtUninstallKB2820917$
2013-04-19 21:24 - 2011-04-13 22:28 - 70490256 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-04-19 21:23 - 2013-04-19 21:23 - 00000000 __HDC C:\Windows\$NtUninstallKB2813345$
2013-04-19 21:23 - 2013-04-19 21:13 - 00012044 ____A C:\Windows\KB2813345.log
2013-04-19 21:22 - 2013-04-19 21:22 - 00000000 __HDC C:\Windows\$NtUninstallKB2813170$
2013-04-19 21:02 - 2013-04-19 21:01 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-04-19 21:02 - 2011-04-14 06:55 - 00001945 ___AC C:\Windows\epplauncher.mif
2013-04-19 20:52 - 2013-04-17 06:17 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVAST Software
2013-04-19 20:49 - 2011-04-13 21:27 - 00000000 ____D C:\Program Files\VIA
2013-04-19 20:13 - 2012-04-10 17:23 - 00691592 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-04-19 20:13 - 2011-10-16 14:02 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-04-19 19:56 - 2011-04-13 21:33 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Adobe
2013-04-19 19:54 - 2008-04-14 08:00 - 00000603 ____A C:\Windows\win.ini
2013-04-19 19:50 - 2011-04-13 16:55 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-04-19 19:42 - 2011-09-22 13:52 - 00000000 ____D C:\Program Files\Microsoft Office
2013-04-19 19:24 - 2011-04-13 22:14 - 00000000 __HDC C:\Windows\$NtUninstallKB946648$
2013-04-19 18:50 - 2013-04-17 06:20 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\Google
2013-04-19 18:50 - 2011-09-07 06:36 - 00000000 ____D C:\Program Files\Google
2013-04-19 18:47 - 2011-09-22 14:13 - 00000000 ____D C:\Program Files\RegScrubXP
2013-04-19 08:03 - 2010-03-08 18:17 - 00002393 ____A C:\Documents and Settings\Rosemary\Desktop\TurboTax 2012.lnk
2013-04-19 06:32 - 2011-09-22 16:41 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\iolo
2013-04-19 00:44 - 2013-04-19 00:44 - 00074703 ____A C:\Windows\System32\mfc45.dat
2013-04-18 21:14 - 2013-04-18 21:14 - 00035144 ____A C:\Windows\System32\Drivers\mbamchameleon.sys
2013-04-18 16:04 - 2010-03-03 03:50 - 00000000 ____D C:\Documents and Settings\Rosemary\My Documents\TurboTax
2013-04-18 15:38 - 2010-03-08 18:18 - 00002393 ____A C:\Documents and Settings\Rosemary\Desktop\TurboTax 2011.lnk
2013-04-18 09:49 - 2013-01-14 17:07 - 00866720 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-04-18 09:49 - 2011-09-06 23:43 - 00788896 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-04-18 06:51 - 2011-04-14 06:05 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple Computer
2013-04-18 06:47 - 2013-02-04 08:52 - 00016384 ____A C:\Documents and Settings\Rosemary\Desktop\13 Dashboard.xls
2013-04-17 18:59 - 2012-01-07 12:49 - 01249678 ___AC C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1993962763-1383384898-1801674531-1003-0.dat
2013-04-17 18:59 - 2011-09-22 09:43 - 00000178 __ASH C:\Documents and Settings\Dan\ntuser.ini
2013-04-17 18:57 - 2013-04-17 18:57 - 00003874 ____A C:\Windows\System32\jupdate-1.7.0_21-b11.log
2013-04-17 18:51 - 2013-04-17 18:51 - 00000000 ____D C:\Documents and Settings\Dan\Application Data\Malwarebytes
2013-04-17 18:41 - 2011-10-13 12:42 - 00000000 ____D C:\Documents and Settings\Dan\Application Data\Intuit
2013-04-17 14:09 - 2011-09-22 16:49 - 00000000 ____D C:\Windows\System32\config\SM Registry Backup
2013-04-17 12:04 - 2011-09-22 09:43 - 00000062 __ASH C:\Documents and Settings\Dan\Local Settings\desktop.ini
2013-04-17 06:42 - 2011-10-11 16:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2013-04-17 06:20 - 2011-04-13 21:07 - 00002577 ___AC C:\Windows\System32\CONFIG.NT
2013-04-16 12:59 - 2012-03-06 11:58 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\1click dvd copy pro
2013-04-16 12:53 - 2012-03-09 16:27 - 00000000 ____D C:\Documents and Settings\Dan\Local Settings\Application Data\1Click DVD Copy Pro
2013-04-15 09:35 - 2012-05-01 13:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-04-15 09:17 - 2013-04-15 09:17 - 00000000 RASHD C:\cmdcons
2013-04-15 09:17 - 2011-04-13 16:53 - 00000327 _RASH C:\boot.ini
2013-04-15 08:30 - 2013-04-15 08:29 - 00000000 ____D C:\Qoobox
2013-04-15 08:27 - 2013-04-15 08:27 - 00000000 ____D C:\Windows\erdnt
2013-04-15 08:22 - 2013-03-10 19:05 - 00175104 ____A C:\Documents and Settings\Rosemary\Desktop\Tax clients '11 (1-7-12).xls
2013-04-14 17:33 - 2010-03-03 02:55 - 00001324 ____A C:\Windows\System32\d3d9caps.dat
2013-04-14 06:49 - 2013-04-12 08:30 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-04-13 02:06 - 2013-03-17 18:55 - 00000000 ____D C:\Documents and Settings\Rosemary\Application Data\TaxCut
2013-04-12 15:27 - 2013-04-12 15:27 - 00000000 ____D C:\Documents and Settings\Dan\Local Settings\Application Data\AVG Secure Search
2013-04-11 17:41 - 2013-04-11 17:40 - 00014414 ____A C:\AdwCleaner[S1].txt
2013-04-11 17:40 - 2013-04-11 17:40 - 00014332 ____A C:\AdwCleaner[R1].txt
2013-04-11 17:23 - 2013-04-04 08:51 - 00000790 ____A C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-11 17:23 - 2013-04-04 08:51 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-04-11 17:21 - 2013-04-11 17:21 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\Apple
2013-04-11 11:21 - 2013-04-11 11:21 - 00334728 ____A C:\Documents and Settings\Rosemary\My Documents\12 Gardner.tax2012
2013-04-10 07:29 - 2010-03-03 03:51 - 00002393 ____A C:\Documents and Settings\All Users\Desktop\TurboTax 2009.lnk
2013-04-04 14:50 - 2013-04-04 08:51 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-04 10:49 - 2013-04-04 10:49 - 00098304 ____A C:\Windows\Minidump\Mini040413-01.dmp
2013-04-04 10:49 - 2013-04-04 10:49 - 00000000 ____D C:\Windows\Minidump
2013-04-04 09:34 - 2011-04-13 22:15 - 00000000 __HDC C:\Windows\$NtUninstallKB954459$
2013-04-04 08:51 - 2013-04-04 08:51 - 00000000 ____D C:\Documents and Settings\Rosemary\Application Data\Malwarebytes
2013-04-04 08:51 - 2013-04-04 08:51 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-04-04 08:43 - 2013-04-04 08:43 - 00000000 __SHD C:\Documents and Settings\Rosemary\IECompatCache
2013-04-04 08:31 - 2013-04-04 08:31 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Intuit
2013-04-03 09:39 - 2013-03-10 17:37 - 00000000 ____D C:\Program Files\HRBlock2012
2013-04-02 07:45 - 2013-04-02 07:45 - 00000631 ____A C:\Documents and Settings\Rosemary\Desktop\April '13 ours.lnk
2013-04-02 06:33 - 2011-04-14 06:56 - 00237088 ____C (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-04-02 05:33 - 2013-04-17 13:31 - 00445930 ___RA C:\Windows\System32\Drivers\etc\hosts.20130417-133112.backup
2013-04-02 05:33 - 2013-04-02 05:32 - 06589347 ____A C:\immudebug.log
2013-04-02 05:28 - 2010-03-07 13:39 - 00000178 __ASH C:\Documents and Settings\UpdatusUser\ntuser.ini
2013-04-02 05:27 - 2013-04-02 05:33 - 00445930 ___RA C:\Windows\System32\Drivers\etc\hosts.20130402-053310.backup
2013-04-02 05:26 - 2013-04-02 05:26 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\iolo
2013-04-01 14:12 - 2013-04-01 14:12 - 00000000 __SHD C:\Documents and Settings\UpdatusUser\IETldCache
2013-04-01 07:13 - 2013-03-25 00:28 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\LogMeIn Rescue Applet
2013-04-01 07:13 - 2013-03-19 23:28 - 00000000 ____D C:\Program Files\SamsungPrinterLiveUpdate
2013-04-01 07:12 - 2010-03-07 13:39 - 00000062 __ASH C:\Documents and Settings\UpdatusUser\Local Settings\desktop.ini
2013-03-30 10:26 - 2013-03-30 10:26 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\AVG SafeGuard toolbar
2013-03-30 10:25 - 2013-03-30 10:25 - 00000000 ____D C:\Windows\System32\cache
2013-03-29 17:34 - 2013-03-29 17:34 - 00000000 ____D C:\Documents and Settings\Dan\Local Settings\Application Data\AVG SafeGuard toolbar
2013-03-29 09:26 - 2011-10-11 16:17 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVG2012
2013-03-29 09:23 - 2013-03-29 09:23 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
2013-03-29 09:17 - 2013-03-29 09:17 - 00000000 ____D C:\Documents and Settings\Rosemary\Local Settings\Application Data\MFAData
2013-03-27 13:48 - 2013-03-27 13:48 - 01167536 ____A C:\Windows\isRS-000.tmp
2013-03-25 00:57 - 2011-04-13 22:25 - 00012453 ___AC C:\Windows\spupdsvc.log

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe
[2008-04-14 08:00] - [2011-09-19 14:00] - 0507904 ____A (Microsoft Corporation) 679a7259741f6a09994f02ce261b5f2e

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

Bocagal1 · 2013/04/24

Addition.txt log

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-04-2013 03
Ran by Rosemary at 2013-04-24 01:59:42 Run:
Running from C:\Documents and Settings\Rosemary\Desktop
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

1Click DVD Copy Pro 4.3.0.9
Adobe Flash Player 11 ActiveX (Version: 11.7.700.169)
Adobe Flash Player 11 Plugin (Version: 11.7.700.169)
Adobe Reader XI (11.0.02) (Version: 11.0.02)
Belarc Advisor 8.3 (Version: 8.3.2.0)
Carbonite (Version: 5.4.3 build 2834 (Feb-05-2013))
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
CyberLink PowerDVD 10 (Version: 10.0.1705)
Data Lifeguard Diagnostic for Windows 1.21
Dropbox (Version: 2.0.6)
DVD43 v4.6.0
EasyCleaner (Version: 2.0.6.380)
EasyCleaner 2.2
EPSON Printer Software
EPSON Scan
EPSON WorkForce 600 Series Printer Uninstall
H&R Block Basic + Efile 2012 (Version: 12.02.7803)
H&R Block New Jersey 2012 (Version: 1.12.6301)
Intel(R) Graphics Media Accelerator Driver
Junk Mail filter update (Version: 14.0.8117.416)
LaserJet 1020 series
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2742597)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office 2003 Primary Interop Assemblies (Version: 11.0.6553.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 2005 Tools for Office Runtime (Version: 8.0.60940.0)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
neroxml (Version: 1.0.0)
Nikon Message Center (Version: 0.91.000)
NVIDIA Control Panel 307.90 (Version: 307.90)
NVIDIA HD Audio Driver 1.3.23.1 (Version: 1.3.23.1)
NVIDIA Install Application (Version: 2.1002.118.757)
NVIDIA nView 136.53 (Version: 136.53)
NVIDIA PhysX (Version: 9.12.1031)
NVIDIA PhysX System Software 9.12.1031 (Version: 9.12.1031)
NVIDIA Update 1.12.12 (Version: 1.12.12)
NVIDIA Update Components (Version: 1.12.12)
OrchidWiz Encyclopedia (Version: 1.0)
Pdf995
PictureProject (Version: 1.0)
PictureProject In Touch Downloader 1.0 (Version: 1.0)
Platform (Version: 1.34)
QuickBooks (Version: 22.0.4012.2206)
QuickBooks Pro 2012 (Version: 22.0.4012.2206)
Quicken 2013 (Version: 22.1.11.31)
Samsung CLP-310 Series
Segoe UI (Version: 14.0.4327.805)
Speccy (Version: 1.21)
Spybot - Search & Destroy (Version: 1.6.2)
SureThing CD Labeler Deluxe Update (Version: 5.2.663.0)
TEG-PCITXR 32bit Gigabit PCI Adatper (Version: 1.23.0000)
TurboTax 2009
TurboTax 2009 WinPerFedFormset (Version: 009.000.2881)
TurboTax 2009 WinPerReleaseEngine (Version: 009.000.0328)
TurboTax 2009 WinPerTaxSupport (Version: 009.000.0245)
TurboTax 2009 wrapper (Version: 009.000.0145)
TurboTax 2010
TurboTax 2010 WinPerFedFormset (Version: 010.000.5821)
TurboTax 2010 WinPerReleaseEngine (Version: 010.000.0501)
TurboTax 2010 WinPerTaxSupport (Version: 010.000.0222)
TurboTax 2010 wrapper (Version: 010.000.0157)
TurboTax 2011
TurboTax 2011 WinPerFedFormset (Version: 011.000.3351)
TurboTax 2011 WinPerReleaseEngine (Version: 011.000.0496)
TurboTax 2011 WinPerTaxSupport (Version: 011.000.0222)
TurboTax 2011 wrapper (Version: 011.000.0121)
TurboTax 2012 (Version: 2012.0)
TurboTax 2012 waziper (Version: 012.000.1264)
TurboTax 2012 wgaiper (Version: 012.000.1371)
TurboTax 2012 WinPerFedFormset (Version: 012.000.2114)
TurboTax 2012 WinPerReleaseEngine (Version: 012.000.0451)
TurboTax 2012 WinPerTaxSupport (Version: 012.000.0179)
TurboTax 2012 wrapper (Version: 012.000.0127)
Tweak UI
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB2447568) (Version: 1)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows Internet Explorer 8 (KB2632503) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2492386) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2616676-v2) (Version: 2)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB898461) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB961503) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
VCRedistSetup (Version: 1.0.0)
VIA Platform Device Manager (Version: 1.34)
WebFldrs XP (Version: 9.50.7523)
Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR 4.20 (32-bit) (Version: 4.20.0)
World Community Grid (Version: 6.10.58)
XPS Essentials Pack (Version: 1.0.6000)
XPS Essentials Pack 1.0

==================== Restore Points =========================

19-04-2013 23:08:21 Removed Windows Live Upload Tool
19-04-2013 23:36:30 Software Distribution Service 3.0
20-04-2013 00:21:54 Installed Platform
20-04-2013 00:43:25 avast! Free Antivirus Setup
20-04-2013 00:47:36 Installed Platform
20-04-2013 00:48:46 Installed Platform
20-04-2013 01:05:45 Software Distribution Service 3.0
20-04-2013 01:21:37 Software Distribution Service 3.0
20-04-2013 11:54:45 Software Distribution Service 3.0
20-04-2013 12:48:06 Software Distribution Service 3.0
20-04-2013 13:29:08 Installed BOINC.
20-04-2013 13:31:48 Removed BOINC.
21-04-2013 06:28:40 Software Distribution Service 3.0
21-04-2013 13:00:14 4-21-13 after Ken's work before WinBBS combofix
22-04-2013 11:40:07 Software Distribution Service 3.0
23-04-2013 11:39:54 Software Distribution Service 3.0

==================== Faulty Device Manager Devices =============

Name: PCI Parallel Port
Description: PCI Parallel Port
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver ", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
Components/Payroll/Setup/PPEUpdt.dll,components/payroll/Staging22/setup/PPEUpdt.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
Components/Payroll/Setup/PPECore.dll,components/payroll/Staging22/setup/PPECore.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
Components/Payroll/Setup/IPPEUpdt.dll,components/payroll/Staging22/setup/IPPEUpdt.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
UPSDynHelp.chm,components/payroll/Staging22/setup/help/UPSDynHelp.chm,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks) (User: )
Description: An unexpected error has occured in "QuickBooks Pro 2012 ":
NozHelp.chm,components/payroll/Staging22/setup/help/NozHelp.chm,1

System errors:
=============
Error: (04/23/2013 09:06:27 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/23/2013 09:06:25 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/23/2013 07:41:56 AM) (Source: 0) (User: )
Description: \Device\HarddiskVolumeShadowCopy1C:

Error: (04/23/2013 07:41:08 AM) (Source: 0) (User: )
Description: \Device\HarddiskVolumeShadowCopy1C:

Error: (04/23/2013 06:16:38 AM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/23/2013 06:16:35 AM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/22/2013 09:15:05 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/22/2013 09:15:04 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/22/2013 03:48:29 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Error: (04/22/2013 03:48:28 PM) (Source: Removable Storage Service) (User: )
Description: RSM could not load media in drive Drive 0 of library Verbatim STORE N GO USB Device.

Microsoft Office Sessions:
=========================
Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012Components/Payroll/Setup/PPEUpdt.dll,components/payroll/Staging22/setup/PPEUpdt.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012Components/Payroll/Setup/PPECore.dll,components/payroll/Staging22/setup/PPECore.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012Components/Payroll/Setup/IPPEUpdt.dll,components/payroll/Staging22/setup/IPPEUpdt.dll,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012UPSDynHelp.chm,components/payroll/Staging22/setup/help/UPSDynHelp.chm,1

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012: error: source file does not exist or not supported operation.

Error: (04/22/2013 07:51:06 AM) (Source: QuickBooks)(User: )
Description: QuickBooks Pro 2012NozHelp.chm,components/payroll/Staging22/setup/help/NozHelp.chm,1

==================== Memory info ===========================

Percentage of memory in use: 41%
Total physical RAM: 3583.17 MB
Available physical RAM: 2101.36 MB
Total Pagefile: 5465.54 MB
Available Pagefile: 4128.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1959.91 MB

==================== Drives ================================

Drive c: (XP PRO) (Fixed) (Total:466.82 GB) (Free:357.14 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive d: (Storage) (Fixed) (Total:414.63 GB) (Free:396.89 GB) NTFS
Drive i: (STORE N GO) (Removable) (Total:7.45 GB) (Free:6.86 GB) FAT32

Disk ### Status Size Free Dyn Gpt
-------- ---------- ------- ------- --- ---
Disk 0 Online 932 GB 50 GB

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 467 GB 1024 KB
Partition 2 Extended 465 GB 467 GB
Partition 3 Logical 415 GB 467 GB
==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C XP PRO NTFS Partition 467 GB Healthy System (partition with boot components)
=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D Storage NTFS Partition 415 GB Healthy
=========================================================
============================== MBR & Partition Table ==================

====================================================================
Disk: 0 (Size: 932 GB) (Disk ID: 2832B6D2)
Partition 1: (Active) - (Size=467 GB) - (Type=07) (NTFS)
Partition 2: (Not Active) - (Size=465 GB) - (Type=05)

====================================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)

broni · 2013/04/24

All looks clean so far.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.

Double click on adwcleaner.exe to run the tool.

Click on Delete.

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Bocagal1 · 2013/04/25

# AdwCleaner v2.202 - Logfile created 04/25/2013 at 14:17:39
# Updated 23/04/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Rosemary - DAN-9B587E4D6B
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Rosemary\Desktop\adwcleaner.exe
# Option [Search]

***** [Services] *****

***** [Files / Folders] *****

Folder Found : C:\Documents and Settings\All Users\Application Data\APN
Folder Found : C:\Documents and Settings\Dan\Local Settings\Application Data\AVG Secure Search

***** [Registry] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKLM\Software\Supreme Savings
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\kiiwp560.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Rosemary\Application Data\Mozilla\Firefox\Profiles\m34ymj1u.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [14332 octets] - [11/04/2013 17:40:11]
AdwCleaner[R2].txt - [1927 octets] - [25/04/2013 14:17:39]
AdwCleaner[S1].txt - [14414 octets] - [11/04/2013 17:40:34]

########## EOF - C:\AdwCleaner[R2].txt - [2048 octets] ##########

Bocagal1 · 2013/04/25

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.8.9 (04.22.2013:1)
OS: Microsoft Windows XP x86
Ran by Rosemary on Thu 04/25/2013 at 14:44:47.50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Rosemary\Application Data\pccustubinstaller "

~~~ FireFox

Successfully deleted: [File] "C:\Program Files\Mozilla Firefox\searchplugins\search.xml "
Emptied folder: C:\Documents and Settings\Rosemary\Application Data\mozilla\firefox\profiles\m34ymj1u.default\minidumps [2 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 04/25/2013 at 14:46:35.85
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bocagal1 · 2013/04/25

OTL logfile created on: 4/25/2013 2:47:53 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Rosemary\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.85 Gb Available Physical Memory | 81.45% Memory free
5.34 Gb Paging File | 4.88 Gb Available in Paging File | 91.49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 466.82 Gb Total Space | 357.19 Gb Free Space | 76.52% Space Free | Partition Type: NTFS
Drive D: | 414.63 Gb Total Space | 396.93 Gb Free Space | 95.73% Space Free | Partition Type: NTFS
Drive I: | 7.45 Gb Total Space | 6.86 Gb Free Space | 92.11% Space Free | Partition Type: FAT32

Computer Name: DAN-9B587E4D6B | User Name: Rosemary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/04/25 14:15:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rosemary\Desktop\OTL.exe
PRC - [2013/04/10 03:15:58 | 027,151,288 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2013/02/05 17:18:22 | 005,007,880 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
PRC - [2013/02/05 17:18:22 | 001,065,480 | R--- | M] (Carbonite, Inc.) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
PRC - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 11:11:06 | 000,947,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/12/06 19:17:04 | 000,045,056 | ---- | M] (Intuit) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2012/08/23 13:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2011/08/19 22:31:14 | 001,248,256 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe
PRC - [2010/08/23 20:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/12/17 04:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
PRC - [2007/01/11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE

========== Modules (No Company Name) ==========

MOD - [2013/04/20 11:07:26 | 000,221,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\766ccafdc4a09b964aa9286a15bca48a\System.ServiceProcess.ni.dll
MOD - [2013/04/20 11:06:49 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\5ea93652e4752c75bc6fbb195b4eb864\System.Runtime.Remoting.ni.dll
MOD - [2013/04/20 11:06:45 | 000,787,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\1d254fbc811d0de6c54a9d9c428c4497\System.EnterpriseServices.ni.dll
MOD - [2013/04/20 11:06:43 | 000,649,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\dcb0e7d56ffca14d7c483103235b11ad\System.Transactions.ni.dll
MOD - [2013/04/20 11:01:24 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\d7ee03714420b252415b952d40ef59e4\System.ServiceProcess.ni.dll
MOD - [2013/04/20 08:53:21 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll
MOD - [2013/04/20 08:53:11 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll
MOD - [2013/04/20 08:52:57 | 013,199,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\39f4c7717661667c68f9af8c4f6402b9\System.Windows.Forms.ni.dll
MOD - [2013/04/20 08:52:40 | 001,667,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\b573c6a62bb88df0ee2af59b6a8ca910\System.Drawing.ni.dll
MOD - [2013/04/20 08:52:12 | 006,815,232 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\9071f089ab65d518d1bd7e8fa857a95f\System.Data.ni.dll
MOD - [2013/04/20 08:50:24 | 005,617,664 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\43cd41484df96d15df949eb17dd88152\System.Xml.ni.dll
MOD - [2013/04/20 08:50:18 | 000,982,528 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\5de5d8c1c02e33789e3cf7e3f54c0ec9\System.Configuration.ni.dll
MOD - [2013/04/20 08:50:07 | 007,069,696 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\27dcf04ed7a3506045597c02a5a1fc31\System.Core.ni.dll
MOD - [2013/04/20 08:49:55 | 009,094,656 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\15872842e3e63ddf0f720f406706198e\System.ni.dll
MOD - [2013/04/20 08:49:46 | 014,412,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll
MOD - [2013/03/13 16:48:52 | 024,978,944 | ---- | M] () -- C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\libcef.dll
MOD - [2013/02/12 19:53:00 | 003,194,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2013/02/12 19:52:57 | 002,933,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2013/02/12 19:52:55 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2013/02/12 19:52:42 | 000,630,784 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2013/02/12 19:52:41 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2013/02/12 19:52:38 | 000,258,048 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2013/02/12 19:52:37 | 000,261,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2013/02/12 19:52:34 | 002,048,000 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2013/02/12 19:52:29 | 000,114,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2013/02/12 19:52:12 | 005,025,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/11/13 19:32:50 | 003,558,400 | ---- | M] () -- C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2011/11/22 10:50:24 | 000,051,716 | ---- | M] () -- C:\WINDOWS\system32\pdf995mon.dll
MOD - [2011/10/13 12:40:28 | 000,854,016 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/10/13 12:40:26 | 000,270,336 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/10/13 12:40:22 | 000,023,912 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/10/13 12:40:22 | 000,012,136 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2010/03/08 00:12:03 | 000,409,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2010/03/08 00:12:02 | 000,476,520 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2010/03/08 00:11:58 | 000,046,952 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2010/03/08 00:11:58 | 000,018,792 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2010/03/08 00:11:57 | 000,421,224 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2010/03/08 00:11:57 | 000,269,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\3.1.26.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2010/03/08 00:11:56 | 000,120,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2010/03/08 00:11:56 | 000,070,504 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2010/03/08 00:11:55 | 000,121,704 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2010/03/03 03:51:42 | 000,403,456 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2010/03/03 03:51:41 | 000,471,040 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2010/03/03 03:51:37 | 000,046,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2010/03/03 03:51:36 | 000,018,720 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2010/03/03 03:51:35 | 000,419,616 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2010/03/03 03:51:33 | 000,270,112 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\2.0.445.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2010/03/03 03:51:32 | 000,120,096 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2010/03/03 03:51:32 | 000,070,432 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2010/03/03 03:51:31 | 000,121,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2007/08/14 03:39:16 | 000,022,723 | ---- | M] () -- C:\WINDOWS\system32\cl31cl3.dll

========== Services (SafeList) ==========

SRV - [2013/04/19 20:13:38 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/04/12 08:30:42 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/02/09 23:20:28 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013/02/05 17:18:22 | 005,007,880 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto | Running] -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe -- (CarboniteService)
SRV - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/12/06 19:17:04 | 000,045,056 | ---- | M] (Intuit) [Auto | Running] -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2012/08/23 13:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2011/08/19 22:31:14 | 001,248,256 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe -- (QBVSS)
SRV - [2011/08/19 22:30:58 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2011/06/26 02:45:56 | 000,256,000 | R--- | M] () [Auto | Stopped] -- C:\Rosemary11905R\pev.3XE -- (PEVSystemStart)
SRV - [2010/08/23 20:21:40 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2007/12/17 04:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01)
SRV - [2007/01/11 04:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\CDriver.sys -- (MSICDSetup)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Rosemary\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2013/04/18 21:14:36 | 000,035,144 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon)
DRV - [2012/12/19 01:41:55 | 000,128,440 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2012/06/01 05:52:41 | 000,012,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2011/08/09 17:33:58 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BANTExt.sys -- (BANTExt)
DRV - [2010/08/04 21:16:54 | 002,127,728 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2010/04/02 09:11:16 | 000,087,536 | ---- | M] (CyberLink Corp.) [2011/04/13 21:45:00] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2009/11/30 02:31:42 | 000,050,176 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1c51x86.sys -- (L1c)
DRV - [2009/02/24 17:27:32 | 000,118,656 | R--- | M] (TRENDware International, Inc ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AC DE 22 ED 1F A9 CC 01 [binary data]
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..\SearchScopes\{F8ABCBA6-702F-46D0-B2BF-336DC79876A9}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/12 08:30:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2013/03/14 11:09:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rosemary\Application Data\Mozilla\Extensions
[2010/03/07 22:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rosemary\Application Data\Mozilla\Firefox\extensions
[2010/03/07 22:52:19 | 000,000,000 | ---D | M] (WhiteSmoke New) -- C:\Documents and Settings\Rosemary\Application Data\Mozilla\Firefox\extensions\{739df940-c5ee-4bab-9d7e-270894ae687a}
[2013/04/11 17:40:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rosemary\Application Data\Mozilla\Firefox\Profiles\m34ymj1u.default\extensions
[2013/04/12 08:30:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/04/12 08:30:42 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013/03/26 22:17:52 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013/03/30 10:25:50 | 000,003,723 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml
[2013/03/26 22:17:52 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2013/04/18 19:06:06 | 000,000,899 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {5EB1D2B1-45DC-48B3-852D-E575B405B851} - No CLSID value found.
O4 - HKLM..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXEXXX C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008..\Run: [Auto EPSON Stylus Photo R280 Series (Copy 1) on PREFERRE-901505] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Documents and Settings\Rosemary\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Rosemary\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1340479904892 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1340479886048 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1277BEF1-ECD1-4BB4-AF06-854B23CFF0F1}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{42D65B82-7165-4BC7-8322-035057612EF1}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DA10535F-91B7-4963-B9C2-49678085FF7D}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\intu-help-qb5 {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O18 - Protocol\Handler\linkscanner - No CLSID value found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/07 22:49:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/04/25 14:44:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/04/25 14:44:13 | 000,000,000 | ---D | C] -- C:\JRT
[2013/04/25 14:15:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Rosemary\Desktop\OTL.exe
[2013/04/25 14:15:07 | 000,535,764 | ---- | C] (Oleg N. Scherbakov) -- C:\Documents and Settings\Rosemary\Desktop\JRT.exe
[2013/04/24 01:58:35 | 000,000,000 | ---D | C] -- C:\FRST
[2013/04/24 01:57:37 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/04/24 01:57:30 | 001,147,871 | ---- | C] (Farbar) -- C:\Documents and Settings\Rosemary\Desktop\FRST.exe
[2013/04/21 21:43:17 | 000,000,000 | --SD | C] -- C:\Rosemary11905R
[2013/04/21 21:31:15 | 001,752,992 | ---- | C] (Bleeping Computer, LLC) -- C:\Documents and Settings\Rosemary\Desktop\rkill.exe
[2013/04/21 12:14:00 | 005,057,323 | R--- | C] (Swearware) -- C:\Documents and Settings\Rosemary\Desktop\Rosemary.exe
[2013/04/20 10:36:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\StartupDisabled
[2013/04/20 10:29:57 | 000,000,000 | ---D | C] -- C:\Intuit
[2013/04/20 09:53:28 | 000,000,000 | ---D | C] -- C:\Program Files\Belarc
[2013/04/20 09:34:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Speccy
[2013/04/20 09:33:58 | 000,000,000 | ---D | C] -- C:\Program Files\Speccy
[2013/04/20 08:18:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2013/04/20 08:18:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Start Menu\Programs\WinRAR
[2013/04/19 21:41:51 | 000,000,000 | ---D | C] -- C:\Program Files\Dropbox
[2013/04/19 21:01:18 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2013/04/17 06:20:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Local Settings\Application Data\Google
[2013/04/17 06:20:06 | 000,228,600 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2013/04/17 06:17:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/04/15 09:17:29 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2013/04/15 08:30:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2013/04/15 08:30:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2013/04/15 08:30:09 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2013/04/15 08:30:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/04/15 08:29:10 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/04/15 08:27:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2013/04/12 08:30:31 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/04/11 17:21:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Local Settings\Application Data\Apple
[2013/04/04 10:49:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2013/04/04 08:51:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Application Data\Malwarebytes
[2013/04/04 08:51:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/04 08:51:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2013/04/04 08:51:32 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/04/04 08:51:32 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/04/04 08:43:10 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Rosemary\IECompatCache
[2013/04/04 08:31:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Intuit
[2013/04/02 05:26:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\iolo
[2013/03/30 10:26:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Local Settings\Application Data\AVG SafeGuard toolbar
[2013/03/30 10:25:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\cache
[2013/03/29 09:31:29 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/03/29 09:23:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
[2013/03/29 09:17:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rosemary\Local Settings\Application Data\MFAData
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/04/25 14:41:02 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/04/25 14:31:41 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/04/25 14:21:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/04/25 14:18:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/04/25 14:15:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rosemary\Desktop\OTL.exe
[2013/04/25 14:15:16 | 000,535,764 | ---- | M] (Oleg N. Scherbakov) -- C:\Documents and Settings\Rosemary\Desktop\JRT.exe
[2013/04/25 14:13:40 | 000,619,461 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\adwcleaner.exe
[2013/04/24 01:58:19 | 001,147,871 | ---- | M] (Farbar) -- C:\Documents and Settings\Rosemary\Desktop\FRST.exe
[2013/04/21 21:31:21 | 001,752,992 | ---- | M] (Bleeping Computer, LLC) -- C:\Documents and Settings\Rosemary\Desktop\rkill.exe
[2013/04/21 15:35:48 | 000,000,089 | ---- | M] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2013/04/21 15:29:58 | 000,000,060 | ---- | M] () -- C:\WINDOWS\wpd99.drv
[2013/04/21 13:18:26 | 000,002,399 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TurboTax 2010.lnk
[2013/04/21 12:14:17 | 005,057,323 | R--- | M] (Swearware) -- C:\Documents and Settings\Rosemary\Desktop\Rosemary.exe
[2013/04/20 09:53:33 | 000,001,785 | ---- | M] () -- C:\Documents and Settings\Rosemary\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2013/04/20 09:53:33 | 000,001,767 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
[2013/04/20 09:37:52 | 000,007,942 | ---- | M] () -- C:\WINDOWS\System32\nvAppTimestamps
[2013/04/20 09:22:28 | 001,072,544 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013/04/20 09:22:28 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013/04/20 09:17:20 | 001,072,544 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013/04/20 09:12:47 | 000,503,136 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/04/20 09:12:47 | 000,088,534 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/04/19 21:56:07 | 000,348,200 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/04/19 21:41:34 | 000,001,033 | ---- | M] () -- C:\Documents and Settings\Rosemary\Start Menu\Programs\Startup\Dropbox.lnk
[2013/04/19 21:41:34 | 000,001,033 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\Dropbox.lnk
[2013/04/19 21:32:31 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/04/19 21:02:23 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2013/04/19 18:49:57 | 000,000,821 | ---- | M] () -- C:\Documents and Settings\Rosemary\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/04/19 08:03:39 | 000,002,393 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\TurboTax 2012.lnk
[2013/04/19 00:44:20 | 000,074,703 | ---- | M] () -- C:\WINDOWS\System32\mfc45.dat
[2013/04/18 21:14:36 | 000,035,144 | ---- | M] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/18 19:06:06 | 000,000,899 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/04/18 15:38:43 | 000,002,393 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\TurboTax 2011.lnk
[2013/04/17 06:20:07 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2013/04/15 09:17:32 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2013/04/15 00:24:51 | 000,533,185 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\12 Fillable 4868.pdf
[2013/04/14 17:33:03 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/04/11 17:23:31 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/11 11:21:00 | 000,334,728 | ---- | M] () -- C:\Documents and Settings\Rosemary\My Documents\12 Gardner.tax2012
[2013/04/10 07:29:32 | 000,002,393 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TurboTax 2009.lnk
[2013/04/05 06:43:54 | 000,000,748 | ---- | M] () -- C:\Documents and Settings\Rosemary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/04/02 07:45:04 | 000,000,631 | ---- | M] () -- C:\Documents and Settings\Rosemary\Desktop\April '13 ours.lnk
[2013/04/02 05:33:10 | 000,445,930 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130417-133112.backup
[2013/04/02 05:27:37 | 000,445,930 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130402-053310.backup
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/04/25 14:13:12 | 000,619,461 | ---- | C] () -- C:\Documents and Settings\Rosemary\Desktop\adwcleaner.exe
[2013/04/20 09:53:33 | 000,001,785 | ---- | C] () -- C:\Documents and Settings\Rosemary\Application Data\Microsoft\Internet Explorer\Quick Launch\Belarc Advisor.lnk
[2013/04/20 09:53:33 | 000,001,773 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Belarc Advisor.lnk
[2013/04/20 09:53:33 | 000,001,767 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk
[2013/04/20 09:53:28 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2013/04/19 21:12:10 | 000,000,384 | -H-- | C] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/04/19 21:02:12 | 000,001,704 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013/04/19 00:44:20 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dat
[2013/04/18 21:14:36 | 000,035,144 | ---- | C] () -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/04/15 09:17:32 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2013/04/15 09:17:29 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2013/04/15 08:30:09 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/04/15 08:30:09 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/04/15 08:30:09 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/04/15 08:30:09 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/04/15 08:30:09 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013/04/11 11:21:00 | 000,334,728 | ---- | C] () -- C:\Documents and Settings\Rosemary\My Documents\12 Gardner.tax2012
[2013/04/07 08:10:33 | 000,533,185 | ---- | C] () -- C:\Documents and Settings\Rosemary\Desktop\12 Fillable 4868.pdf
[2013/04/05 06:43:54 | 000,000,748 | ---- | C] () -- C:\Documents and Settings\Rosemary\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/04/05 06:43:54 | 000,000,736 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2013/04/04 08:51:34 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/02 07:45:07 | 000,000,631 | ---- | C] () -- C:\Documents and Settings\Rosemary\Desktop\April '13 ours.lnk
[2013/03/19 23:28:51 | 000,482,408 | ---- | C] () -- C:\WINDOWS\ssndii.exe
[2013/03/19 23:28:17 | 000,022,723 | ---- | C] () -- C:\WINDOWS\System32\cl31cl3.dll
[2013/03/09 20:50:47 | 000,000,120 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2013/03/09 18:42:32 | 000,000,089 | ---- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2012/03/27 16:04:55 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2012/03/14 13:08:02 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2012/03/14 12:04:24 | 000,073,220 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2012/03/14 12:04:24 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2012/03/14 12:04:24 | 000,029,114 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2012/03/14 12:04:24 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2012/03/14 12:04:24 | 000,021,021 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2012/03/14 12:04:24 | 000,015,670 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2012/03/14 12:04:24 | 000,013,280 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2012/03/14 12:04:24 | 000,010,673 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2012/03/14 12:04:24 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2012/03/14 12:04:24 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2012/03/14 12:04:24 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2012/03/14 12:04:24 | 000,001,137 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2012/03/14 12:04:24 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2012/03/14 12:04:24 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2012/03/14 12:04:24 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2012/03/14 12:04:24 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2012/02/23 10:24:04 | 000,065,793 | ---- | C] () -- C:\WINDOWS\System32\esfw7c.bin
[2012/02/14 15:26:47 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/07 12:49:24 | 001,249,678 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1993962763-1383384898-1801674531-1003-0.dat
[2012/01/07 12:49:24 | 000,311,318 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/01/06 17:37:20 | 000,000,744 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
[2011/11/27 14:16:31 | 000,012,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2011/11/22 10:52:24 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini
[2011/11/22 10:50:24 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2011/11/22 10:50:24 | 000,000,060 | ---- | C] () -- C:\WINDOWS\wpd99.drv
[2011/11/03 13:19:44 | 000,000,410 | ---- | C] () -- C:\WINDOWS\brwmark.ini
[2011/11/03 13:19:44 | 000,000,211 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2011/11/03 13:19:44 | 000,000,092 | ---- | C] () -- C:\WINDOWS\brpcfx.ini
[2011/11/03 13:19:44 | 000,000,052 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2011/11/03 13:19:44 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BD7820N.dat
[2011/10/16 14:00:16 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011/09/23 12:13:14 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2011/09/22 13:58:27 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/03/07 13:45:01 | 004,546,224 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1993962763-1383384898-1801674531-1008-0.dat
[2010/03/07 13:45:00 | 002,189,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

========== ZeroAccess Check ==========

[2011/09/22 14:10:19 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shdocvw.dll -- [2011/02/17 09:51:57 | 001,510,400 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 08:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2011/09/07 07:00:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\8E004473-5A1B-4BD6-BD49-576A088F1717
[2011/04/14 05:50:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Acronis
[2013/04/16 12:59:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\1click dvd copy pro
[2013/04/19 20:52:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/01/26 13:45:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG January 2013 Campaign
[2013/03/29 09:23:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG SafeGuard toolbar
[2013/03/29 09:26:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2012/03/01 16:22:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Carbonite
[2013/03/09 18:42:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/09/23 12:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2012/03/14 12:04:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2013/04/19 06:32:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iolo
[2013/03/19 12:12:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LGSI
[2013/04/17 06:42:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2013/03/09 18:43:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nuance
[2013/04/21 15:29:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995
[2013/03/09 19:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SQL Anywhere 11
[2013/03/10 17:32:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut
[2011/04/13 21:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2011/09/23 12:13:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2012/03/09 16:42:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\vsosdk
[2011/04/14 06:06:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/10/09 15:11:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\blekkotb_019
[2012/03/14 13:08:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\EPSON
[2012/11/23 16:43:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\iolo
[2011/09/23 12:13:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Nikon
[2011/11/29 14:40:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\VirtualStore
[2013/01/30 13:43:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\TuneUp Software
[2011/09/22 16:47:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\iolo
[2013/04/02 05:26:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\iolo
[2013/04/25 14:43:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosemary\Application Data\Dropbox
[2010/03/03 01:01:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosemary\Application Data\Epson
[2011/11/22 10:52:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosemary\Application Data\pdf995
[2013/04/13 02:06:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rosemary\Application Data\TaxCut
[2013/01/30 13:43:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\UpdatusUser\Application Data\TuneUp Software

========== Purity Check ==========

< End of report >

Bocagal1 · 2013/04/25

After running these tools IE would not reload this thread saved as a favorite???

broni · 2013/04/25

Create new bookmark.

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- D:\CDriver.sys -- (MSICDSetup)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Rosemary\LOCALS~1\Temp\catchme.sys -- (catchme)
SRV - [2011/06/26 02:45:56 | 000,256,000 | R--- | M] () [Auto | Stopped] -- C:\Rosemary11905R\pev.3XE -- (PEVSystemStart)
FF - user.js - File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {5EB1D2B1-45DC-48B3-852D-E575B405B851} - No CLSID value found.
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXEXXX C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found
O15 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKU\S-1-5-21-1993962763-1383384898-1801674531-1008\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)
O18 - Protocol\Handler\linkscanner - No CLSID value found

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Windows Defender

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

Bocagal1 · 2013/04/26

All processes killed
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Code: > in the current context!
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service SSPORT stopped successfully!
Service SSPORT deleted successfully!
File C:\WINDOWS\system32\Drivers\SSPORT.sys not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service MSICDSetup stopped successfully!
Service MSICDSetup deleted successfully!
File D:\CDriver.sys not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service DgiVecp stopped successfully!
Service DgiVecp deleted successfully!
File C:\WINDOWS\system32\Drivers\DgiVecp.sys not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
File C:\DOCUME~1\Rosemary\LOCALS~1\Temp\catchme.sys not found.
Service PEVSystemStart stopped successfully!
Service PEVSystemStart deleted successfully!
C:\Rosemary11905R\pev.3XE moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5EB1D2B1-45DC-48B3-852D-E575B405B851}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5EB1D2B1-45DC-48B3-852D-E575B405B851}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NvMediaCenter deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ttlc\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1993962763-1383384898-1801674531-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner\ deleted successfully.
File Protocol\Handler\linkscanner - No CLSID value found not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 11736 bytes
->Temporary Internet Files folder emptied: 1111009 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 14050980 bytes
->Flash cache emptied: 1600 bytes

User: All Users

User: Dan
->Temp folder emptied: 0 bytes
->FireFox cache emptied: 65374155 bytes
->Google Chrome cache emptied: 8849190 bytes
->Flash cache emptied: 76671 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 262546 bytes

User: NetworkService
->Temp folder emptied: 142288 bytes
->Temporary Internet Files folder emptied: 33244 bytes

User: Rosemary
->Temp folder emptied: 94921854 bytes
->Temporary Internet Files folder emptied: 119740138 bytes
->FireFox cache emptied: 30566722 bytes
->Flash cache emptied: 1454 bytes

User: System Utilities

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: VALIDATE

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3569580 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 89401949 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 189106874 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 589.00 mb

[EMPTYJAVA]

User: Administrator
->Java cache emptied: 0 bytes

User: All Users

User: Dan

User: Default User

User: LocalService

User: NetworkService

User: Rosemary

User: System Utilities

User: UpdatusUser

User: VALIDATE

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Dan
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

User: Rosemary
->Flash cache emptied: 0 bytes

User: System Utilities

User: UpdatusUser

User: VALIDATE

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 04262013_021707

Files\Folders moved on Reboot...
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\TUPTUJLI\ibank[2].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\IJJWK2OI\ibank[2].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\IJJWK2OI\ibank[3].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\IJJWK2OI\xd_arbiter[2].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\HTWH1AIE\fastbutton[4].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\HTWH1AIE\p-01-0VIaSjnOLg[2].gif moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\HTWH1AIE\xd_arbiter[1].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\CQ0OR2RE\105246-active-i-think-i-have-virus-system-very-slow-2[1].html moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\CQ0OR2RE\ibank[2].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\CQ0OR2RE\like[7].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\Content.IE5\CQ0OR2RE\search[4].htm moved successfully.
C:\Documents and Settings\Rosemary\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Log in or Sign up

Solved I think I have a virus - system is VERY slow

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Share This Page

Log in or Sign up

Solved I think I have a virus - system is VERY slow

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

Bocagal1 Banned Thread Starter

broni Moderator Malware Analyst

Bocagal1 Banned Thread Starter

Share This Page

Useful Searches