Solved Can't remove Win32.Downloader.gen

[Resolved] Can't remove Win32.Downloader.gen

First off, I hope I have everything lined out below as it is supposed to be. If not, I'll double back and make sure. Thanks in advance for your patience.

Now, we have something showing up on my wife’s home desktop called Win32.Downloader.gen

When I run Spybot it shows up but Spybot will not remove it on the first run or on a reboot.

Malwarebytes says it removes it but when I run Spybot again it’s still showing.

Below is the Malwarebytes log:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.01.04.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Carol :: CAROL-W7PC [administrator]

1/4/2014 9:31:01 AM
mbam-log-2014-01-04 (09-31-01).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 333577
Time elapsed: 30 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BackgroundContainer (PUP.Optional.Conduit) -> Data: "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


And here are the logs I got with the DDS utility.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16428
Run by Carol at 11:57:13 on 2014-01-04
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.4061.2476 [GMT -6:00]
.
AV: ZoneAlarm Antivirus *Disabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: ZoneAlarm Anti-Spyware *Disabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: ZoneAlarm Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2014\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Intel\AMT\LMS.exe
C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
C:\Program Files (x86)\AVG\AVG2014\avgscanx.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SysWOW64\Rundll32.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\AVG\AVG2014\avgui.exe
C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.better-search.net/?src=10&st=12&i=998&did=10844&ppd=search,33481435340,citrix&barid=1590556092391686143
mWinlogon: Userinit = userinit.exe,
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [BackgroundContainer] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY
mRun: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe "
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
mRun: [Redirector] "C:\Program Files (x86)\Citrix\ICA Client\redirector.exe" /startup
dRunOnce: [SpUninstallDeleteDir] rmdir /s /q "\SearchProtect "
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.1.254
TCP: Interfaces\{047019B2-915F-47D4-8B37-B706389B0942} : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{CF40994F-F323-4EBA-B1F5-6A220C29A9F2} : DHCPNameServer = 192.168.0.249 192.168.0.248
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
SSODL: WebCheck - <orphaned>
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Carol\AppData\Roaming\Mozilla\Firefox\Profiles\buosc6v9.default-1388795940637\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll
FF - plugin: C:\Program Files (x86)\Citrix\ICA Client\npURLInterceptorPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-10-24 194872]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-10-31 294712]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-10-1 123704]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-9-10 31544]
R1 Avgdiska;AVG Disk Driver;C:\Windows\System32\drivers\avgdiska.sys [2013-11-5 150808]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-11-4 240920]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-10-31 212280]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-8-1 251192]
R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\System32\drivers\ctxusbm.sys [2013-6-4 95152]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [2013-11-11 3478544]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [2013-9-24 348008]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-8-23 13672]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2014-1-3 1153368]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2013-11-4 2066968]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [2013-6-18 54160]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2013-1-22 398816]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;C:\Windows\System32\drivers\e1k60x64.sys [2009-6-10 220672]
S3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2013-11-4 56344]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2013-12-31 111616]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-31 19456]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-12-31 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-12-31 30208]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-12-31 1255736]
.
=============== Created Last 30 ================
.
2014-01-04 03:57:49 -------- d-----w- C:\Users\Carol\AppData\Roaming\Malwarebytes
2014-01-04 03:57:37 -------- d-----w- C:\ProgramData\Malwarebytes
2014-01-04 03:57:36 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-01-04 03:57:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-04 03:57:22 -------- d-----w- C:\Users\Carol\AppData\Local\Programs
2014-01-04 01:50:51 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2014-01-04 01:50:51 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2014-01-04 00:03:28 -------- d-----w- C:\Windows\SysWow64\SearchProtect
2014-01-04 00:03:17 -------- d-----w- C:\Users\Carol\AppData\Local\SearchProtect
2014-01-04 00:02:44 -------- d-----w- C:\Program Files (x86)\Conduit
2014-01-04 00:02:42 -------- d-----w- C:\ProgramData\Conduit
2014-01-04 00:02:40 -------- d-----w- C:\Users\Carol\AppData\Local\Conduit
2014-01-04 00:02:17 -------- d-----w- C:\Program Files (x86)\DriverTuner
2014-01-02 02:31:36 -------- d-----w- C:\Users\Carol\AppData\Local\IsolatedStorage
2014-01-02 02:27:40 -------- d-----w- C:\Users\Carol\AppData\Roaming\Intuit
2014-01-02 02:25:21 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
2014-01-02 02:24:49 -------- d-----w- C:\Program Files (x86)\TurboTax
2014-01-02 02:24:32 -------- d-----w- C:\ProgramData\Intuit
2014-01-02 02:17:34 -------- d-----w- C:\Users\Carol\AppData\Roaming\ICAClient
2014-01-02 02:17:27 -------- d-----w- C:\ProgramData\Citrix
2014-01-02 02:17:07 -------- d-----w- C:\Users\Carol\AppData\Local\Citrix
2014-01-02 02:17:07 -------- d-----w- C:\Program Files (x86)\Common Files\Citrix
2014-01-02 02:17:07 -------- d-----w- C:\Program Files (x86)\Citrix
2014-01-02 02:15:44 -------- d-----w- C:\Windows\System32\ljkb
2014-01-02 02:15:37 33792 ----a-w- C:\Windows\System32\ImHttpComm.dll
2014-01-02 02:15:37 1787184 ----a-w- C:\Windows\System32\dmwu.exe
2014-01-01 23:24:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-01 23:24:12 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-01-01 14:39:31 -------- d-----w- C:\Users\Carol\AppData\Local\Apple Computer
2014-01-01 14:39:15 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2014-01-01 14:38:58 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-01 14:38:58 -------- d-----w- C:\Program Files\iTunes
2014-01-01 14:38:58 -------- d-----w- C:\Program Files\iPod
2014-01-01 14:38:58 -------- d-----w- C:\Program Files (x86)\iTunes
2014-01-01 14:37:42 -------- d-----w- C:\Users\Carol\AppData\Local\Apple
2014-01-01 14:37:19 -------- d-----w- C:\Program Files\Bonjour
2014-01-01 14:37:19 -------- d-----w- C:\Program Files (x86)\Bonjour
2014-01-01 13:22:01 -------- d-----w- C:\ProgramData\Brother
2014-01-01 05:03:39 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2014-01-01 05:03:39 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys
2014-01-01 05:03:39 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys
2014-01-01 05:03:39 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
2014-01-01 05:03:39 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys
2014-01-01 05:03:39 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys
2014-01-01 05:03:39 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys
2014-01-01 05:00:02 -------- d-----w- C:\Program Files\CCleaner
2014-01-01 03:27:44 -------- d-----w- C:\Users\Carol\AppData\Local\Adobe
2013-12-31 22:41:50 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-12-31 22:29:52 2871808 ----a-w- C:\Windows\explorer.exe
2013-12-31 22:17:37 -------- d-----w- C:\Windows\PCHEALTH
2013-12-31 22:14:38 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2013-12-31 22:14:20 -------- d-----w- C:\Users\Carol\AppData\Local\Microsoft Help
2013-12-31 22:08:25 458584 ----a-w- C:\Windows\System32\drivers\kl1.sys
2013-12-31 22:08:21 89944 ----a-w- C:\Windows\System32\drivers\klflt.sys
2013-12-31 22:04:03 -------- d-----w- C:\Program Files (x86)\CheckPoint
2013-12-31 22:03:45 -------- d-----w- C:\ProgramData\CheckPoint
2013-12-31 20:34:01 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2013-12-31 20:34:01 194048 ----a-w- C:\Windows\SysWow64\elshyph.dll
2013-12-31 20:31:49 -------- d-----w- C:\Windows\SysWow64\Wat
2013-12-31 20:31:49 -------- d-----w- C:\Windows\System32\Wat
2013-12-31 20:04:27 167424 ----a-w- C:\Program Files\Windows Media Player\wmplayer.exe
2013-12-31 20:04:27 164864 ----a-w- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
2013-12-31 20:04:26 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
2013-12-31 20:04:25 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2013-12-31 20:00:26 -------- d-----w- C:\Windows\SysWow64\RTCOM
2013-12-31 20:00:26 -------- d-----w- C:\Program Files\Realtek
2013-12-31 19:44:40 8199504 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-12-31 19:44:37 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E89C1B32-3FCA-4709-80EF-436C1AA49C00}\mpengine.dll
2013-12-31 19:25:03 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui
2013-12-31 18:52:18 -------- d-----w- C:\Users\Carol\AppData\Roaming\AVG2014
2013-12-31 18:51:36 -------- d-----w- C:\Users\Carol\AppData\Roaming\TuneUp Software
2013-12-31 18:51:15 -------- d--h--w- C:\$AVG
2013-12-31 18:51:15 -------- d-----w- C:\ProgramData\AVG2014
2013-12-31 18:50:14 -------- d-----w- C:\Program Files (x86)\AVG
2013-12-31 18:48:07 -------- d--h--w- C:\ProgramData\Common Files
2013-12-31 18:48:07 -------- d-----w- C:\Users\Carol\AppData\Local\MFAData
2013-12-31 18:48:07 -------- d-----w- C:\Users\Carol\AppData\Local\Avg2014
2013-12-31 18:48:07 -------- d-----w- C:\ProgramData\MFAData
2013-12-31 18:47:04 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
2013-12-31 18:47:04 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll
2013-12-31 18:47:04 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
2013-12-31 18:47:04 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll
2013-12-31 18:47:03 744448 ----a-w- C:\Windows\System32\WUDFx.dll
2013-12-31 18:47:03 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
2013-12-31 18:47:03 229888 ----a-w- C:\Windows\System32\WUDFHost.exe
2013-12-31 18:40:14 -------- d-----w- C:\Windows\System32\MRT
2013-12-31 18:38:48 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2013-12-31 18:38:48 5120 ----a-w- C:\Windows\System32\wmi.dll
2013-12-31 18:38:48 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2013-12-31 18:37:28 -------- d-----w- C:\Windows\Migration
2013-12-31 18:37:21 -------- d-sh--w- C:\Windows\Installer
2013-12-31 18:33:53 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll
2013-12-31 18:32:59 751104 ----a-w- C:\Windows\System32\win32spl.dll
2013-12-31 18:26:24 859648 ----a-w- C:\Windows\System32\IKEEXT.DLL
2013-12-31 18:26:24 830464 ----a-w- C:\Windows\System32\nshwfp.dll
2013-12-31 18:26:24 656896 ----a-w- C:\Windows\SysWow64\nshwfp.dll
2013-12-31 18:26:24 324096 ----a-w- C:\Windows\System32\FWPUCLNT.DLL
2013-12-31 18:26:24 216576 ----a-w- C:\Windows\SysWow64\FWPUCLNT.DLL
2013-12-31 18:24:11 77312 ----a-w- C:\Windows\System32\packager.dll
2013-12-31 18:24:11 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2013-12-31 18:23:25 461312 ----a-w- C:\Windows\System32\scavengeui.dll
2013-12-31 18:21:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2013-12-31 18:21:22 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2013-12-31 18:21:22 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2013-12-31 18:16:20 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2013-12-31 18:16:16 99840 ----a-w- C:\Windows\System32\wudriver.dll
2013-12-31 18:15:50 36864 ----a-w- C:\Windows\System32\wuapp.exe
2013-12-31 18:15:50 186752 ----a-w- C:\Windows\System32\wuwebv.dll
.
==================== Find3M ====================
.
2013-12-31 20:33:58 942592 ----a-w- C:\Windows\System32\jsIntl.dll
2013-11-26 18:25:52 267936 ------w- C:\Windows\System32\MpSigStub.exe
2013-11-26 10:19:07 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2013-11-26 10:18:23 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2013-11-26 09:48:07 66048 ----a-w- C:\Windows\System32\iesetup.dll
2013-11-26 09:46:25 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2013-11-26 09:18:39 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
2013-11-26 09:18:09 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
2013-11-26 09:16:57 708608 ----a-w- C:\Windows\System32\jscript9diag.dll
2013-11-26 08:35:02 5769216 ----a-w- C:\Windows\System32\jscript9.dll
2013-11-26 08:28:16 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2013-11-26 08:16:12 4243968 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-11-26 08:02:16 1995264 ----a-w- C:\Windows\System32\inetcpl.cpl
2013-11-26 07:32:06 1928192 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2013-11-26 07:07:57 2334208 ----a-w- C:\Windows\System32\wininet.dll
2013-11-26 06:33:33 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-11-23 18:26:20 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll
2013-11-23 17:47:34 465920 ----a-w- C:\Windows\System32\WMPhoto.dll
2013-11-12 02:23:09 2048 ----a-w- C:\Windows\System32\tzres.dll
2013-11-12 02:07:29 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2013-11-06 03:55:48 150808 ----a-w- C:\Windows\System32\drivers\avgdiska.sys
2013-11-05 03:52:42 240920 ----a-w- C:\Windows\System32\drivers\avgidsdrivera.sys
2013-11-01 05:00:18 212280 ----a-w- C:\Windows\System32\drivers\avgldx64.sys
2013-11-01 04:49:46 294712 ----a-w- C:\Windows\System32\drivers\avgloga.sys
2013-10-30 02:32:01 335360 ----a-w- C:\Windows\System32\msieftp.dll
2013-10-30 02:19:52 301568 ----a-w- C:\Windows\SysWow64\msieftp.dll
2013-10-30 01:24:31 3155968 ----a-w- C:\Windows\System32\win32k.sys
2013-10-25 04:25:58 194872 ----a-w- C:\Windows\System32\drivers\avgidsha.sys
2013-10-19 02:18:57 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2013-10-19 01:36:59 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
2013-10-12 02:32:04 150016 ----a-w- C:\Windows\System32\wshom.ocx
2013-10-12 02:31:04 202752 ----a-w- C:\Windows\System32\scrrun.dll
2013-10-12 02:04:36 121856 ----a-w- C:\Windows\SysWow64\wshom.ocx
2013-10-12 02:03:31 163840 ----a-w- C:\Windows\SysWow64\scrrun.dll
2013-10-12 01:33:39 156160 ----a-w- C:\Windows\System32\cscript.exe
2013-10-12 01:33:26 168960 ----a-w- C:\Windows\System32\wscript.exe
2013-10-12 01:15:48 141824 ----a-w- C:\Windows\SysWow64\wscript.exe
2013-10-12 01:15:48 126976 ----a-w- C:\Windows\SysWow64\cscript.exe
.
============= FINISH: 11:57:43.16 ===============

 

Oops! Fixed that -- added it at the top.

And the title was supposed to day "can't remove Win32.Downloader.gen" but the phone rang in the middle and when I got back to the post I left that off.

Thanks again.

 

Okay. I uninstalled ZoneAlarm and then followed all of the steps you outlined. The reports (which I understand very little of) follow:


RogueKiller V8.8.0 _x64_ [Dec 27 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Carol [Admin rights]
Mode : Scan -- Date : 01/04/2014 17:34:30
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] rundll32.exe -- C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll [7] -> rundll32.exe KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : BackgroundContainer ( "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun [7][7][x]) -> FOUND
[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] BackgroundContainer Startup Task : "C:\Windows\SysWOW64\Rundll32.exe" - "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun [7][7][x] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
[...]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HDS721010KLA330 ATA Device +++++
--- User ---
[MBR] 126e9fb26522d0562e6aa33b7b2ca09f
[BSP] 819a590f32a5649e58f76e0bc116a1f9 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 12000 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 24578048 | Size: 285 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25161728 | Size: 941582 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Seagate FreeAgent GoFlex USB Device +++++
--- User ---
[MBR] 566f5133e98d11b1e8bb97dcc94efaa2
[BSP] 5cab7fac78b6fe5301595cea6da44b25 : Empty MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_01042014_173430.txt >>



RogueKiller V8.8.0 _x64_ [Dec 27 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Carol [Admin rights]
Mode : Remove -- Date : 01/04/2014 17:35:49
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH][DLL] rundll32.exe -- C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll [7] -> rundll32.exe KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : BackgroundContainer ( "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun [7][7][x]) -> DELETED
[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] BackgroundContainer Startup Task : "C:\Windows\SysWOW64\Rundll32.exe" - "C:\Users\Carol\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll ",DllRun [7][7][x] -> DELETED

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
[...]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HDS721010KLA330 ATA Device +++++
--- User ---
[MBR] 126e9fb26522d0562e6aa33b7b2ca09f
[BSP] 819a590f32a5649e58f76e0bc116a1f9 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 12000 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 24578048 | Size: 285 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25161728 | Size: 941582 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Seagate FreeAgent GoFlex USB Device +++++
--- User ---
[MBR] 566f5133e98d11b1e8bb97dcc94efaa2
[BSP] 5cab7fac78b6fe5301595cea6da44b25 : Empty MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_D_01042014_173549.txt >>
RKreport[0]_S_01042014_173430.txt


Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org

Database version: v2014.01.04.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Carol :: CAROL-W7PC [administrator]

1/4/2014 5:44:32 PM
mbar-log-2014-01-04 (17-44-32).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 226640
Time elapsed: 6 minute(s), 58 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1008

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.327000 GHz
Memory total: 4258521088, free: 2795757568

Downloaded database version: v2014.01.04.08
Downloaded database version: v2013.12.18.01
Initializing...
======================
------------ Kernel report ------------
01/04/2014 17:44:28
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\avgrkx64.sys
\SystemRoot\system32\DRIVERS\avgloga.sys
\SystemRoot\system32\DRIVERS\avgmfx64.sys
\SystemRoot\system32\DRIVERS\avgidsha.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\ctxusbm.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\avgtdia.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\drivers\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\drivers\blbdrive.sys
\SystemRoot\system32\DRIVERS\avgldx64.sys
\SystemRoot\system32\DRIVERS\avgidsdrivera.sys
\SystemRoot\system32\DRIVERS\avgdiska.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\yk62x64.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\system32\drivers\spsys.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa8005ea0060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000006c\
Lower Device Object: 0xfffffa8005f5c060
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004c0a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\
Lower Device Object: 0xfffffa8004759680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004c0a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004c095d0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004c0a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800468cc40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004759680, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 411369B6

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 24576000

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 24578048 Numsec = 583680
Partition is not bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 25161728 Numsec = 1928359936

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa8005ea0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8005ea0b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8005ea0060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8005f5c060, DeviceName: \Device\0000006c\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: A4B57300

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 625137345

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072932864 bytes
Sector size: 512 bytes

Done!
Read File: File "c:\programdata\avg2014\chjw\305aa3c85aa38964.dat:6524c068-6479-4769-9172-b210e3fa252c" is sparse (flags = 32768)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_1_24578048_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_r.mbam...
Removal finished


Rkill 2.6.4 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/04/2014 06:08:20 PM in x64 mode.
Windows Version: Windows 7 Professional Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\Carol\Desktop\rkill\rkill-01-04-2014-06-08-22.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* Cannot edit the HOSTS file.
* Permissions Fixed. Administrators can now edit the HOSTS file.

* HOSTS file entries found:

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com

20 out of 15490 HOSTS entries shown.
Please review HOSTS file for further entries.

Program finished at: 01/04/2014 06:08:50 PM
Execution time: 0 hours(s), 0 minute(s), and 30 seconds(s)

--------------

End of reports - thanks again, and standing by -

 

BTW, the history on this computer is that I bought it as a refurb. Geezum -- it has been educational!

 

combofix log

ComboFix 14-01-04.03 - Carol 01/04/2014 18:28:17.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.4061.2890 [GMT -6:00]
Running from: c:\users\Carol\Desktop\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\conhost.exe
c:\windows\SysWow64\dwm.exe
c:\windows\SysWow64\hkcmd.exe
c:\windows\SysWow64\igfxpers.exe
c:\windows\SysWow64\igfxtray.exe
c:\windows\SysWow64\lsm.exe
c:\windows\SysWow64\spoolsv.exe
c:\windows\SysWow64\taskhost.exe
E:\Autorun.inf
E:\Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-12-05 to 2014-01-05 )))))))))))))))))))))))))))))))
.
.
2014-01-05 00:32 . 2014-01-05 00:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-04 23:44 . 2014-01-04 23:56 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-01-04 23:44 . 2014-01-04 23:44 117464 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-01-04 23:43 . 2014-01-04 23:43 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-01-04 23:33 . 2014-01-04 23:33 35392 ----a-w- c:\windows\system32\drivers\megasas.sys.bak
2014-01-04 11:48 . 2014-01-04 11:48 0 ----a-w- c:\windows\SysWow64\winlogon.exe
2014-01-04 11:48 . 2014-01-04 11:48 0 ----a-w- c:\windows\SysWow64\smss.exe
2014-01-04 11:48 . 2014-01-04 11:48 0 ----a-w- c:\windows\SysWow64\services.exe
2014-01-04 11:48 . 2014-01-04 11:48 0 ----a-w- c:\windows\SysWow64\lsass.exe
2014-01-04 03:57 . 2014-01-04 04:38 -------- d-----w- c:\programdata\Malwarebytes
2014-01-04 03:57 . 2014-01-04 03:57 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-04 03:57 . 2013-04-04 20:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-04 01:50 . 2014-01-04 02:07 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-01-04 01:50 . 2014-01-04 01:51 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2014-01-04 00:11 . 2014-01-04 00:51 -------- d-----w- c:\program files\DIFX
2014-01-04 00:03 . 2014-01-04 00:03 -------- d-----w- c:\windows\SysWow64\SearchProtect
2014-01-04 00:02 . 2014-01-04 00:02 -------- d-----w- c:\program files (x86)\Conduit
2014-01-04 00:02 . 2014-01-04 04:35 -------- d-----w- c:\programdata\Conduit
2014-01-04 00:02 . 2014-01-04 00:51 -------- d-----w- c:\program files (x86)\DriverTuner
2014-01-02 02:25 . 2014-01-02 02:26 -------- d-----w- c:\program files (x86)\Common Files\Intuit
2014-01-02 02:24 . 2014-01-02 02:24 -------- d-----w- c:\program files (x86)\TurboTax
2014-01-02 02:24 . 2014-01-02 02:26 -------- d-----w- c:\programdata\Intuit
2014-01-02 02:17 . 2014-01-02 02:17 -------- d-----w- c:\programdata\Citrix
2014-01-02 02:17 . 2014-01-02 02:17 -------- d-----w- c:\program files (x86)\Citrix
2014-01-02 02:17 . 2014-01-02 02:17 -------- d-----w- c:\program files (x86)\Common Files\Citrix
2014-01-02 02:15 . 2014-01-02 02:15 -------- d-----w- c:\windows\system32\ljkb
2014-01-02 02:15 . 2013-11-25 16:06 1787184 ----a-w- c:\windows\system32\dmwu.exe
2014-01-02 02:15 . 2013-11-25 15:59 33792 ----a-w- c:\windows\system32\ImHttpComm.dll
2014-01-01 23:24 . 2014-01-01 23:24 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-01 23:24 . 2014-01-01 23:24 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-01 23:24 . 2014-01-01 23:24 -------- d-----w- c:\windows\SysWow64\Macromed
2014-01-01 23:24 . 2014-01-01 23:24 -------- d-----w- c:\windows\system32\Macromed
2014-01-01 14:39 . 2012-08-21 19:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-01-01 14:38 . 2014-01-01 14:39 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-01 14:38 . 2014-01-01 14:39 -------- d-----w- c:\program files\iTunes
2014-01-01 14:38 . 2014-01-01 14:39 -------- d-----w- c:\program files (x86)\iTunes
2014-01-01 14:38 . 2014-01-01 14:38 -------- d-----w- c:\programdata\Apple Computer
2014-01-01 14:38 . 2014-01-01 14:38 -------- d-----w- c:\program files\iPod
2014-01-01 14:37 . 2014-01-01 14:37 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-01-01 14:37 . 2014-01-01 14:37 -------- d-----w- c:\program files\Common Files\Apple
2014-01-01 14:37 . 2014-01-01 14:37 -------- d-----w- c:\program files\Bonjour
2014-01-01 14:37 . 2014-01-01 14:37 -------- d-----w- c:\program files (x86)\Bonjour
2014-01-01 14:37 . 2014-01-01 14:38 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-01-01 14:37 . 2014-01-01 14:37 -------- d-----w- c:\programdata\Apple
2014-01-01 13:22 . 2014-01-01 13:22 -------- d-----w- c:\programdata\Brother
2014-01-01 05:03 . 2013-09-04 12:12 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-01 05:03 . 2013-09-04 12:11 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-01 05:03 . 2013-09-04 12:11 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-01 05:03 . 2013-09-04 12:11 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-01 05:03 . 2013-09-04 12:11 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-01 05:03 . 2013-09-04 12:11 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-01 05:03 . 2013-09-04 12:11 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-01 05:00 . 2014-01-04 01:35 -------- d-----w- c:\program files\CCleaner
2014-01-01 03:28 . 2014-01-01 03:28 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2013-12-31 23:12 . 2013-12-31 23:12 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2013-12-31 22:38 . 2013-12-31 22:38 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2013-12-31 22:17 . 2013-12-31 22:17 -------- d-----w- c:\windows\PCHEALTH
2013-12-31 22:14 . 2013-12-31 22:14 -------- d-----w- c:\program files\Microsoft Office
2013-12-31 22:14 . 2013-12-31 22:14 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
2013-12-31 22:14 . 2014-01-04 00:51 -------- d-----w- c:\programdata\Microsoft Help
2013-12-31 22:14 . 2013-12-31 22:14 -------- d-----r- C:\MSOCache
2013-12-31 22:08 . 2014-01-04 23:22 -------- dc----w- c:\windows\system32\DRVSTORE
2013-12-31 22:03 . 2013-12-31 22:03 -------- d-----w- c:\programdata\CheckPoint
2013-12-31 20:34 . 2013-12-31 20:34 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-31 20:34 . 2013-12-31 20:34 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-31 20:31 . 2013-12-31 20:31 -------- d-----w- c:\windows\SysWow64\Wat
2013-12-31 20:31 . 2013-12-31 20:31 -------- d-----w- c:\windows\system32\Wat
2013-12-31 20:04 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-31 20:04 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-31 20:04 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-31 20:04 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2013-12-31 20:04 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2013-12-31 20:00 . 2014-01-04 00:51 -------- d-----w- c:\windows\SysWow64\RTCOM
2013-12-31 20:00 . 2013-12-31 20:00 -------- d-----w- c:\program files\Realtek
2013-12-31 19:44 . 2013-12-16 07:54 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E89C1B32-3FCA-4709-80EF-436C1AA49C00}\mpengine.dll
2013-12-31 19:25 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui
2013-12-31 18:51 . 2014-01-04 04:38 -------- d-----w- c:\programdata\AVG2014
2013-12-31 18:51 . 2013-12-31 18:51 -------- d-----w- C:\$AVG
2013-12-31 18:50 . 2013-12-31 18:50 -------- d-----w- c:\program files (x86)\AVG
2013-12-31 18:48 . 2014-01-05 00:06 -------- d-----w- c:\programdata\MFAData
2013-12-31 18:48 . 2013-12-31 18:48 -------- d--h--w- c:\programdata\Common Files
2013-12-31 18:47 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2013-12-31 18:47 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2013-12-31 18:47 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2013-12-31 18:47 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2013-12-31 18:47 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2013-12-31 18:47 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2013-12-31 18:47 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2013-12-31 18:40 . 2013-12-31 18:40 -------- d-----w- c:\windows\system32\MRT
2013-12-31 18:38 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2013-12-31 18:38 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2013-12-31 18:38 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2013-12-31 18:37 . 2013-12-31 22:17 -------- d-----w- c:\program files (x86)\Microsoft.NET
2013-12-31 18:37 . 2013-12-31 18:37 -------- d-----w- c:\windows\Migration
2013-12-31 18:37 . 2014-01-04 23:23 -------- d-sh--w- c:\windows\Installer
2013-12-31 18:36 . 2013-10-15 00:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-12-31 18:34 . 2013-07-26 02:24 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-12-31 18:33 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll
2013-12-31 18:32 . 2013-04-26 05:51 751104 ----a-w- c:\windows\system32\win32spl.dll
2013-12-31 18:26 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-12-31 18:26 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-12-31 18:26 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-12-31 18:26 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-12-31 18:26 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-12-31 18:24 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2013-12-31 18:24 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2013-12-31 18:23 . 2013-08-28 01:12 461312 ----a-w- c:\windows\system32\scavengeui.dll
2013-12-31 18:21 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2013-12-31 18:21 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2013-12-31 18:21 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2013-12-31 18:16 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2013-12-31 18:16 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2013-12-31 18:16 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2013-12-31 18:16 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2013-12-31 18:16 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2013-12-31 18:16 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2013-12-31 18:16 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2013-12-31 18:15 . 2012-06-02 21:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2013-12-31 18:15 . 2012-06-02 21:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2013-12-31 18:13 . 2014-01-04 00:51 -------- d-----w- c:\users\Carol
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-26 18:25 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-06 03:55 . 2013-11-06 03:55 150808 ----a-w- c:\windows\system32\drivers\avgdiska.sys
2013-11-05 03:52 . 2013-11-05 03:52 240920 ----a-w- c:\windows\system32\drivers\avgidsdrivera.sys
2013-11-01 05:00 . 2013-11-01 05:00 212280 ----a-w- c:\windows\system32\drivers\avgldx64.sys
2013-11-01 04:49 . 2013-11-01 04:49 294712 ----a-w- c:\windows\system32\drivers\avgloga.sys
2013-10-25 04:25 . 2013-10-25 04:25 194872 ----a-w- c:\windows\system32\drivers\avgidsha.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"SpybotSD TeaTimer "= "c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI "= "c:\program files (x86)\AVG\AVG2014\avgui.exe" [2013-11-08 4956176]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]
"APSDaemon "= "c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-14 59720]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-02 152392]
"ConnectionCenter "= "c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2013-06-14 395656]
"Redirector "= "c:\program files (x86)\Citrix\ICA Client\redirector.exe" [2013-06-14 153992]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallDeleteDir "= "rmdir" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs "=1 (0x1)
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe;c:\program files (x86)\AVG\AVG2014\avgidsagent.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k60x64.sys [x]
R3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys;c:\windows\SYSNATIVE\drivers\HECIx64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys;c:\windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 Avgdiska;AVG Disk Driver;c:\windows\system32\DRIVERS\avgdiska.sys;c:\windows\SYSNATIVE\DRIVERS\avgdiska.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys;c:\windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys;c:\windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys;c:\windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2014\avgwdsvc.exe [x]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe;c:\program files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-04-20 11817576]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2012-11-16 163384]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2012-11-16 387640]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2012-11-16 418360]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.better-search.net/?src=10&st=12&i=998&did=10844&ppd=search,33481435340,citrix&barid=1590556092391686143
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Carol\AppData\Roaming\Mozilla\Firefox\Profiles\buosc6v9.default-1388795940637\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.11 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution "= "{15727DE6-F92D-4E46-ACB4-0E2C58B31A18} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key "= "ActionsPane3 "
"Location "= "c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-01-04 18:35:06
ComboFix-quarantined-files.txt 2014-01-05 00:35
.
Pre-Run: 884,258,435,072 bytes free
Post-Run: 884,083,552,256 bytes free
.
- - End Of File - - 5B0162DC377B84F7495E7511C25D2CBA
A36C5E4F47E84449FF07ED3517B43A31

 

Okay, combined they are too large so I'll do the next series in three posts.

1st, AdwCleaner

# AdwCleaner v3.016 - Report created 04/01/2014 at 19:15:01
# Updated 23/12/2013 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Carol - CAROL-W7PC
# Running from : C:\Users\Carol\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Windows\SysWOW64\Searchprotect
Folder Deleted : C:\Windows\System32\ljkb
Folder Deleted : C:\Users\Carol\AppData\Local\Conduit
Folder Deleted : C:\Users\Carol\AppData\Local\Searchprotect
Folder Deleted : C:\Users\Carol\AppData\LocalLow\Conduit
File Deleted : C:\Windows\System32\dmwu.exe
File Deleted : C:\Windows\System32\ImhxxpComm.dll

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\BackgroundContainer
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\SearchProtect

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Carol\AppData\Roaming\Mozilla\Firefox\Profiles\buosc6v9.default-1388795940637\prefs.js ]


*************************

AdwCleaner[R0].txt - [2037 octets] - [04/01/2014 19:12:16]
AdwCleaner[S0].txt - [1771 octets] - [04/01/2014 19:15:01]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1831 octets] ##########

 

JRT -

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 7 Professional x64
Ran by Carol on Sat 01/04/2014 at 19:20:58.92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3431354717-3686151681-1201377859-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3F442BE8-9565-4559-B6DC-BD4A3E70B4CF}



~~~ Files

Successfully deleted: [File] "C:\Users\Carol\appdata\locallow\SkwConfig.bin "



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 01/04/2014 at 19:27:04.98
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Say Broni, the OTL file by itself is still too large to post. What do you suggest for splitting it?

 

OTL part 1

OTL logfile created on: 1/4/2014 7:33:52 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Carol\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.97 Gb Total Physical Memory | 2.86 Gb Available Physical Memory | 72.06% Memory free
7.93 Gb Paging File | 6.76 Gb Available in Paging File | 85.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.51 Gb Total Space | 823.26 Gb Free Space | 89.53% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 61.92 Gb Free Space | 20.77% Space Free | Partition Type: NTFS

Computer Name: CAROL-W7PC | User Name: Carol | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/01/04 19:30:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Carol\Desktop\OTL.exe
PRC - [2013/11/07 22:03:50 | 004,956,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2014\avgui.exe
PRC - [2013/09/24 01:33:08 | 000,348,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
PRC - [2013/09/05 08:04:00 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/06/14 16:45:20 | 000,924,040 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
PRC - [2013/06/14 16:44:24 | 000,153,992 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
PRC - [2013/06/14 16:43:52 | 000,395,656 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
PRC - [2013/06/13 21:00:38 | 001,505,608 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
PRC - [2013/06/09 19:55:00 | 000,054,152 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
PRC - [2012/08/23 12:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2012/01/18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2009/10/07 18:48:00 | 002,066,968 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
PRC - [2009/10/07 18:47:58 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\AMT\LMS.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe


========== Modules (No Company Name) ==========

MOD - [2013/12/31 12:39:52 | 012,894,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\05ca0ca95b6fcc0d710b63b6200cc178\System.Windows.Forms.ni.dll
MOD - [2013/12/31 12:39:45 | 001,644,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\c4477b3ce64d0d612d1ab0dba425b77f\System.Drawing.ni.dll
MOD - [2013/12/31 12:39:42 | 010,060,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\79f6324a598a7c4446a4a1168be7c4b1\System.ni.dll
MOD - [2013/12/31 12:39:36 | 016,953,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\045c9588954c3662d542b53f4462268b\mscorlib.ni.dll
MOD - [2013/09/13 19:51:44 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013/09/13 19:51:20 | 001,242,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013/11/26 03:18:09 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/05/26 23:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 19:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\lsass.exe -- (VaultSvc)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\lsass.exe -- (SamSs)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\lsass.exe -- (ProtectedStorage)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\lsass.exe -- (Netlogon)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysWOW64\lsass.exe -- (KeyIso)
SRV - [2014/01/04 05:48:25 | 000,000,000 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\lsass.exe -- (EFS)
SRV - [2013/12/05 13:36:33 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/11/11 22:02:14 | 003,478,544 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/09/24 01:33:08 | 000,348,008 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe -- (avgwd)
SRV - [2013/09/11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/09/05 08:04:00 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/08/23 12:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2012/01/18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2009/10/07 18:48:00 | 002,066,968 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe -- (UNS)
SRV - [2009/10/07 18:47:58 | 000,174,616 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\AMT\LMS.exe -- (LMS)
SRV - [2009/06/10 15:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013/11/05 21:55:48 | 000,150,808 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgdiska.sys -- (Avgdiska)
DRV:64bit: - [2013/11/04 21:52:42 | 000,240,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2013/10/31 23:00:18 | 000,212,280 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2013/10/31 22:49:46 | 000,294,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2013/10/24 22:25:58 | 000,194,872 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2013/10/01 00:52:08 | 000,123,704 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2013/09/10 00:43:02 | 000,031,544 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2013/08/01 16:07:06 | 000,251,192 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2013/06/04 19:07:44 | 000,095,152 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
DRV:64bit: - [2013/01/22 02:53:42 | 000,398,816 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2012/11/14 16:57:04 | 010,629,408 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012/08/23 08:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 08:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/08/23 08:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/03/01 00:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/18 06:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:64bit: - [2011/03/11 00:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 00:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 21:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/20 21:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/10/07 18:48:02 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/08/05 19:56:26 | 000,476,672 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 17:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009/06/10 14:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/09 01:14:20 | 000,015,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nuidfltr.sys -- (NuidFltr)
DRV - [2009/07/13 19:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.better-search.net/?src=1...,33481435340,citrix&barid=1590556092391686143
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "https://www.facebook.com/ "
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Citrix.com/npican: C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013/12/31 17:15:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Carol\AppData\Roaming\Mozilla\Extensions
[2013/12/31 17:12:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/12/31 17:12:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2014/01/04 18:32:52 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [Redirector] C:\Program Files (x86)\Citrix\ICA Client\redirector.exe (Citrix Systems, Inc.)
O4 - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\.DEFAULT..\RunOnce: [SpUninstallDeleteDir] rmdir /s /q "\SearchProtect" File not found
O4 - HKU\S-1-5-18..\RunOnce: [SpUninstallDeleteDir] rmdir /s /q "\SearchProtect" File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3431354717-3686151681-1201377859-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{047019B2-915F-47D4-8B37-B706389B0942}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF40994F-F323-4EBA-B1F5-6A220C29A9F2}: DhcpNameServer = 192.168.0.249 192.168.0.248
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=euc-jp - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS936 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS949 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=MS950 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=euc-jp - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS936 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS949 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=MS950 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF8 - No CLSID value found
O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 - No CLSID value found
O18:64bit: - Protocol\Filter\ica - No CLSID value found
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/01/04 19:30:55 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Carol\Desktop\OTL.exe
[2014/01/04 19:20:56 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014/01/04 19:18:40 | 001,036,305 | ---- | C] (Thisisu) -- C:\Users\Carol\Desktop\JRT.exe
[2014/01/04 19:12:05 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/01/04 18:38:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\logishrd
[2014/01/04 18:38:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\logishrd
[2014/01/04 18:35:11 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/01/04 18:35:08 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2014/01/04 18:27:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014/01/04 18:27:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014/01/04 18:27:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014/01/04 18:27:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/01/04 18:26:56 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014/01/04 18:23:20 | 005,160,001 | R--- | C] (Swearware) -- C:\Users\Carol\Desktop\ComboFix.exe
[2014/01/04 18:08:22 | 000,000,000 | ---D | C] -- C:\Users\Carol\Desktop\rkill
[2014/01/04 17:44:28 | 000,117,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014/01/04 17:44:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014/01/04 17:43:20 | 000,089,304 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014/01/04 17:43:18 | 000,000,000 | ---D | C] -- C:\Users\Carol\Desktop\mbar
[2014/01/04 17:34:26 | 000,398,816 | ---- | C] (Marvell) -- C:\Windows\SysNative\drivers\yk62x64.sys.bak
[2014/01/04 17:33:59 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys.bak
[2014/01/04 17:33:58 | 000,065,600 | ---- | C] (LSI Corporation) -- C:\Windows\SysNative\drivers\lsi_sas2.sys.bak
[2014/01/04 17:33:52 | 000,031,232 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw85cir.sys.bak
[2014/01/04 17:33:43 | 000,294,712 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys.bak
[2014/01/04 17:33:43 | 000,251,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgtdia.sys.bak
[2014/01/04 17:33:43 | 000,212,280 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys.bak
[2014/01/04 17:33:43 | 000,123,704 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys.bak
[2014/01/04 17:33:43 | 000,031,544 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgrkx64.sys.bak
[2014/01/04 17:33:42 | 000,240,920 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys.bak
[2014/01/04 17:33:42 | 000,194,872 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsha.sys.bak
[2014/01/04 17:33:42 | 000,150,808 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgdiska.sys.bak
[2014/01/04 17:33:41 | 000,194,128 | ---- | C] (AMD Technologies Inc.) -- C:\Windows\SysNative\drivers\amdsbs.sys.bak
[2014/01/04 17:31:04 | 000,000,000 | ---D | C] -- C:\Users\Carol\Desktop\RK_Quarantine
[2014/01/04 17:23:01 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2014/01/04 11:59:58 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Ricks Computer Maintenance Work
[2014/01/03 21:57:49 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Malwarebytes
[2014/01/03 21:57:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2014/01/03 21:57:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/01/03 21:57:36 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014/01/03 21:57:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2014/01/03 21:57:22 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Programs
[2014/01/03 19:50:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2014/01/03 19:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2014/01/03 19:50:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2014/01/03 18:11:39 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2014/01/03 18:02:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner
[2014/01/03 18:02:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DriverTuner
[2014/01/01 20:31:36 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\IsolatedStorage
[2014/01/01 20:27:40 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Intuit
[2014/01/01 20:26:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2012
[2014/01/01 20:25:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intuit
[2014/01/01 20:24:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TurboTax
[2014/01/01 20:24:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Intuit
[2014/01/01 20:17:34 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\ICAClient
[2014/01/01 20:17:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Citrix
[2014/01/01 20:17:07 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Citrix
[2014/01/01 20:17:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Citrix
[2014/01/01 20:17:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citrix
[2014/01/01 17:24:26 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Macromedia
[2014/01/01 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2014/01/01 17:24:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2014/01/01 08:39:31 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Apple Computer
[2014/01/01 08:39:31 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Apple Computer
[2014/01/01 08:39:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2014/01/01 08:38:58 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2014/01/01 08:38:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2014/01/01 08:38:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2014/01/01 08:38:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2014/01/01 08:38:58 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2014/01/01 08:37:42 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Apple
[2014/01/01 08:37:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2014/01/01 08:37:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2014/01/01 08:37:19 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2014/01/01 08:37:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2014/01/01 08:37:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2014/01/01 08:37:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2014/01/01 07:22:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother
[2013/12/31 23:00:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/12/31 23:00:02 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/12/31 22:51:37 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Outlook Files
[2013/12/31 21:56:53 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft
[2013/12/31 21:56:53 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\BrFaxRx
[2013/12/31 21:56:53 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\2010-07 (Jul)
[2013/12/31 21:56:53 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\2010-01 (Jan)
[2013/12/31 21:28:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2013/12/31 21:28:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013/12/31 21:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013/12/31 21:27:44 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Adobe
[2013/12/31 21:26:03 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\TurboTax
[2013/12/31 21:26:01 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\TG
[2013/12/31 21:26:01 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\SightSpeed Recordings
[2013/12/31 21:25:56 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Rachel
[2013/12/31 21:25:56 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\MyWebPages
[2013/12/31 21:25:53 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\My Scans
[2013/12/31 21:25:53 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\My PaperPort Documents
[2013/12/31 21:25:53 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\My Google Gadgets
[2013/12/31 21:25:53 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\My eBooks
[2013/12/31 21:25:53 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\My Albums
[2013/12/31 21:25:52 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\ItsDeductible2006
[2013/12/31 21:25:45 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Image Transfer
[2013/12/31 21:25:45 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\HTML
[2013/12/31 21:17:19 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\FPUYouth
[2013/12/31 21:14:57 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Downloads
[2013/12/31 21:14:49 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Downloaded Program Updates
[2013/12/31 21:14:49 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Corel User Files
[2013/12/31 21:14:49 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\CCWin9
[2013/12/31 21:14:49 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\4Videosoft Studio
[2013/12/31 17:12:32 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Mozilla
[2013/12/31 17:12:32 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Mozilla
[2013/12/31 17:12:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013/12/31 17:12:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013/12/31 17:12:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/12/31 16:18:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013/12/31 16:17:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2013/12/31 16:17:37 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013/12/31 16:14:56 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013/12/31 16:14:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2013/12/31 16:14:20 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Microsoft Help
[2013/12/31 16:14:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2013/12/31 16:14:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2013/12/31 16:14:03 | 000,000,000 | R--D | C] -- C:\MSOCache
[2013/12/31 16:08:21 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2013/12/31 16:07:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2013/12/31 16:03:45 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2013/12/31 14:31:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2013/12/31 14:31:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2013/12/31 14:30:41 | 000,000,000 | ---D | C] -- C:\Users\Carol\Documents\Utilities
[2013/12/31 14:27:58 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Adobe
[2013/12/31 14:06:37 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013/12/31 14:00:26 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2013/12/31 14:00:26 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2013/12/31 12:52:18 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\AVG2014
[2013/12/31 12:51:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/12/31 12:51:36 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\TuneUp Software
[2013/12/31 12:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2014
[2013/12/31 12:51:15 | 000,000,000 | ---D | C] -- C:\$AVG
[2013/12/31 12:50:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2013/12/31 12:48:07 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013/12/31 12:48:07 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\MFAData
[2013/12/31 12:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2013/12/31 12:48:07 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Avg2014
[2013/12/31 12:40:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
[2013/12/31 12:37:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013/12/31 12:37:28 | 000,000,000 | ---D | C] -- C:\Windows\Migration
[2013/12/31 12:37:21 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013/12/31 12:13:50 | 000,000,000 | R--D | C] -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013/12/31 12:13:50 | 000,000,000 | R--D | C] -- C:\Users\Carol\Searches
[2013/12/31 12:13:50 | 000,000,000 | R--D | C] -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013/12/31 12:13:50 | 000,000,000 | -H-D | C] -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2013/12/31 12:13:42 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Identities
[2013/12/31 12:13:40 | 000,000,000 | R--D | C] -- C:\Users\Carol\Contacts
[2013/12/31 12:13:39 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\VirtualStore
[2013/12/31 12:13:36 | 000,000,000 | --SD | C] -- C:\Users\Carol\AppData\Roaming\Microsoft
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Videos
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Saved Games
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Pictures
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Music
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Links
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Favorites
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Downloads
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Documents
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\Desktop
[2013/12/31 12:13:36 | 000,000,000 | R--D | C] -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\AppData\Local\Temporary Internet Files
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Templates
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Start Menu
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\SendTo
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Recent
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\PrintHood
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\NetHood
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Documents\My Videos
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Documents\My Pictures
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Documents\My Music
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\My Documents
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Local Settings
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\AppData\Local\History
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Cookies
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\Application Data
[2013/12/31 12:13:36 | 000,000,000 | -HSD | C] -- C:\Users\Carol\AppData\Local\Application Data
[2013/12/31 12:13:36 | 000,000,000 | -H-D | C] -- C:\Users\Carol\AppData
[2013/12/31 12:13:36 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Temp
[2013/12/31 12:13:36 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Local\Microsoft
[2013/12/31 12:13:36 | 000,000,000 | ---D | C] -- C:\Users\Carol\AppData\Roaming\Media Center Programs

 

OTL part 2

========== Files - Modified Within 30 Days ==========

[2014/01/04 19:30:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Carol\Desktop\OTL.exe
[2014/01/04 19:23:41 | 000,021,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/01/04 19:23:41 | 000,021,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/01/04 19:18:43 | 001,036,305 | ---- | M] (Thisisu) -- C:\Users\Carol\Desktop\JRT.exe
[2014/01/04 19:16:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/01/04 19:16:23 | 3193,888,768 | -HS- | M] () -- C:\hiberfil.sys
[2014/01/04 19:10:42 | 001,233,962 | ---- | M] () -- C:\Users\Carol\Desktop\adwcleaner.exe
[2014/01/04 18:38:49 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2014/01/04 18:32:52 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014/01/04 18:23:27 | 005,160,001 | R--- | M] (Swearware) -- C:\Users\Carol\Desktop\ComboFix.exe
[2014/01/04 17:44:28 | 000,117,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014/01/04 17:43:20 | 000,089,304 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014/01/04 17:34:26 | 000,398,816 | ---- | M] (Marvell) -- C:\Windows\SysNative\drivers\yk62x64.sys.bak
[2014/01/04 17:33:59 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys.bak
[2014/01/04 17:33:58 | 000,065,600 | ---- | M] (LSI Corporation) -- C:\Windows\SysNative\drivers\lsi_sas2.sys.bak
[2014/01/04 17:33:52 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw85cir.sys.bak
[2014/01/04 17:33:43 | 000,294,712 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgloga.sys.bak
[2014/01/04 17:33:43 | 000,251,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgtdia.sys.bak
[2014/01/04 17:33:43 | 000,212,280 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgldx64.sys.bak
[2014/01/04 17:33:43 | 000,194,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsha.sys.bak
[2014/01/04 17:33:43 | 000,123,704 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgmfx64.sys.bak
[2014/01/04 17:33:43 | 000,031,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgrkx64.sys.bak
[2014/01/04 17:33:42 | 000,240,920 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgidsdrivera.sys.bak
[2014/01/04 17:33:42 | 000,150,808 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\SysNative\drivers\avgdiska.sys.bak
[2014/01/04 17:33:41 | 000,194,128 | ---- | M] (AMD Technologies Inc.) -- C:\Windows\SysNative\drivers\amdsbs.sys.bak
[2014/01/04 12:30:31 | 000,781,298 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/01/04 12:30:31 | 000,661,656 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/01/04 12:30:31 | 000,121,524 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/01/04 05:58:28 | 000,677,081 | ---- | M] () -- C:\Users\Carol\AppData\Local\census.cache
[2014/01/04 05:58:08 | 000,064,529 | ---- | M] () -- C:\Users\Carol\AppData\Local\ars.cache
[2014/01/04 05:48:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\winlogon.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\smss.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\services.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\lsass.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\csrss.exe
[2014/01/04 05:40:00 | 000,000,036 | ---- | M] () -- C:\Users\Carol\AppData\Local\housecall.guid.cache
[2014/01/03 21:57:38 | 000,001,120 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/01/03 20:07:46 | 000,000,281 | ---- | M] () -- C:\Windows\wininit.ini
[2014/01/03 19:50:56 | 000,001,293 | ---- | M] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2014/01/03 19:50:56 | 000,001,269 | ---- | M] () -- C:\Users\Carol\Desktop\Spybot - Search & Destroy.lnk
[2014/01/03 19:35:04 | 000,000,829 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2014/01/03 18:15:51 | 000,424,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/01/01 20:38:23 | 000,000,469 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

[2014/01/01 19:48:05 | 000,003,029 | ---- | M] () -- C:\Users\Carol\Desktop\Microsoft Outlook 2010.lnk
[2014/01/01 18:41:39 | 000,073,252 | ---- | M] () -- C:\Users\Carol\Documents\AL One 2013.csv
[2014/01/01 17:46:54 | 000,000,426 | ---- | M] () -- C:\Windows\BRWMARK.INI

[2014/01/01 08:39:28 | 000,001,790 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2014/01/01 07:41:13 | 000,000,000 | -H-- | M] () -- C:\Users\Carol\Documents\Default.rdp
[2014/01/01 07:26:58 | 000,000,034 | ---- | M] () -- C:\Windows\SysWow64\BD5240.DAT

[2013/12/31 22:51:40 | 000,001,142 | ---- | M] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk
[2013/12/31 21:50:39 | 000,002,951 | ---- | M] () -- C:\Users\Carol\Desktop\Microsoft Excel 2010.lnk
[2013/12/31 21:50:29 | 000,003,021 | ---- | M] () -- C:\Users\Carol\Desktop\Microsoft Word 2010.lnk
[2013/12/31 21:28:52 | 000,002,026 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/12/31 20:01:29 | 000,006,837 | ---- | M] () -- C:\Users\Public\Documents\bookmarks-2013-12-31.json
[2013/12/31 20:00:15 | 000,000,410 | ---- | M] () -- C:\Users\Public\Documents\feeds.opml
[2013/12/31 20:00:14 | 000,025,891 | ---- | M] () -- C:\Users\Public\Documents\bookmark.htm
[2013/12/31 17:12:25 | 000,001,158 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/12/31 14:34:57 | 000,001,418 | ---- | M] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/12/31 14:33:58 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/12/31 14:33:58 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013/12/31 14:13:05 | 000,041,450 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013/12/31 14:13:05 | 000,041,450 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013/12/31 12:51:37 | 000,000,972 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2014.lnk
[2013/12/31 12:38:21 | 000,757,660 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

========== Files Created - No Company Name ==========

[2014/01/04 19:10:40 | 001,233,962 | ---- | C] () -- C:\Users\Carol\Desktop\adwcleaner.exe
[2014/01/04 18:38:49 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2014/01/04 18:27:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014/01/04 18:27:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014/01/04 18:27:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014/01/04 18:27:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014/01/04 18:27:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014/01/04 05:58:28 | 000,677,081 | ---- | C] () -- C:\Users\Carol\AppData\Local\census.cache
[2014/01/04 05:58:08 | 000,064,529 | ---- | C] () -- C:\Users\Carol\AppData\Local\ars.cache
[2014/01/04 05:48:25 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\winlogon.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\smss.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\services.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\lsass.exe
[2014/01/04 05:48:25 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\csrss.exe
[2014/01/04 05:40:00 | 000,000,036 | ---- | C] () -- C:\Users\Carol\AppData\Local\housecall.guid.cache
[2014/01/03 21:57:38 | 000,001,120 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/01/03 20:07:45 | 000,000,281 | ---- | C] () -- C:\Windows\wininit.ini
[2014/01/03 19:50:56 | 000,001,293 | ---- | C] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2014/01/03 19:50:56 | 000,001,269 | ---- | C] () -- C:\Users\Carol\Desktop\Spybot - Search & Destroy.lnk
[2014/01/01 20:26:29 | 000,000,469 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2014/01/01 20:26:18 | 000,002,531 | ---- | C] () -- C:\Users\Public\Desktop\TurboTax 2012.lnk
[2014/01/01 20:17:46 | 000,001,515 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Receiver.lnk
[2014/01/01 19:48:05 | 000,003,029 | ---- | C] () -- C:\Users\Carol\Desktop\Microsoft Outlook 2010.lnk


[2014/01/01 08:39:28 | 000,001,790 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2014/01/01 08:37:41 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2014/01/01 07:41:13 | 000,000,000 | -H-- | C] () -- C:\Users\Carol\Documents\Default.rdp
[2014/01/01 07:26:57 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2014/01/01 07:26:57 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD5240.DAT
[2013/12/31 23:00:03 | 000,000,829 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/12/31 22:51:40 | 000,001,142 | ---- | C] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk


[2013/12/31 21:56:53 | 018,030,896 | ---- | C] () -- C:\Users\Public\Documents\iPhone_iOS4_User_Guide.pdf
[2013/12/31 21:50:39 | 000,002,951 | ---- | C] () -- C:\Users\Carol\Desktop\Microsoft Excel 2010.lnk
[2013/12/31 21:50:29 | 000,003,021 | ---- | C] () -- C:\Users\Carol\Desktop\Microsoft Word 2010.lnk
[2013/12/31 21:28:52 | 000,002,026 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/12/31 21:28:51 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/12/31 21:26:15 | 001,560,742 | ---- | C] () -- C:\Users\Carol\Documents\Wattslabel.ncd
[2013/12/31 21:26:15 | 001,379,739 | ---- | C] () -- C:\Users\Carol\Documents\Wedding.mht
[2013/12/31 21:26:15 | 000,000,293 | ---- | C] () -- C:\Users\Carol\Documents\Shortcut to Local Disk (C).lnk
[2013/12/31 21:26:15 | 000,000,044 | ---- | C] () -- C:\Users\Carol\Documents\Track01.cda
[2013/12/31 21:26:14 | 006,834,430 | ---- | C] () -- C:\Users\Carol\Documents\Samsung Eternity Manual.pdf

[2013/12/31 21:26:14 | 000,503,376 | ---- | C] () -- C:\Users\Carol\Documents\rebate[1].pdf




[2013/12/31 21:26:14 | 000,020,262 | ---- | C] () -- C:\Users\Carol\Documents\Resume UA.TIF




[2013/12/31 21:26:13 | 000,723,046 | ---- | C] () -- C:\Users\Carol\Documents\Letterheadclm.bmp


[2013/12/31 21:26:13 | 000,257,798 | ---- | C] () -- C:\Users\Carol\Documents\ParkingRegistration.xps



[2013/12/31 21:26:13 | 000,051,616 | ---- | C] () -- C:\Users\Carol\Documents\HCHS
[2013/12/31 21:26:13 | 000,023,494 | ---- | C] () -- C:\Users\Carol\Documents\Letterhead1.TIF
[2013/12/31 21:26:13 | 000,020,300 | ---- | C] () -- C:\Users\Carol\Documents\Letterhead.tif
[2013/12/31 21:26:13 | 000,007,680 | ---- | C] () -- C:\Users\Carol\Documents\LA Trip.MSWMM
[2013/12/31 21:26:13 | 000,000,796 | ---- | C] () -- C:\Users\Carol\Documents\IE6SP2.reg
[2013/12/31 21:26:12 | 001,077,532 | ---- | C] () -- C:\Users\Carol\Documents\FPUFlyer8X11.pdf
[2013/12/31 21:26:08 | 004,927,881 | ---- | C] () -- C:\Users\Carol\Documents\DaveRamseyQuestions.mp3
[2013/12/31 21:26:08 | 000,269,216 | ---- | C] () -- C:\Users\Carol\Documents\cc_20120113_214203.reg

[2013/12/31 21:26:07 | 000,012,524 | ---- | C] () -- C:\Users\Carol\Documents\bookmark.htm

[2013/12/31 20:01:29 | 000,006,837 | ---- | C] () -- C:\Users\Public\Documents\bookmarks-2013-12-31.json
[2013/12/31 20:00:15 | 000,000,410 | ---- | C] () -- C:\Users\Public\Documents\feeds.opml
[2013/12/31 20:00:13 | 000,025,891 | ---- | C] () -- C:\Users\Public\Documents\bookmark.htm
[2013/12/31 17:12:25 | 000,001,170 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/12/31 17:12:25 | 000,001,158 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/12/31 14:34:57 | 000,001,418 | ---- | C] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/12/31 14:33:58 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013/12/31 14:33:58 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013/12/31 12:51:37 | 000,000,972 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2014.lnk
[2013/12/31 12:47:03 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013/12/31 12:38:21 | 000,757,660 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/12/31 12:33:43 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013/12/31 12:13:51 | 000,001,424 | ---- | C] () -- C:\Users\Carol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013/12/31 12:13:36 | 000,000,290 | ---- | C] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2013/12/31 12:13:36 | 000,000,272 | ---- | C] () -- C:\Users\Carol\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2013/08/20 06:32:46 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2013/08/20 06:32:34 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2012/01/18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe

========== ZeroAccess Check ==========

[2009/07/13 22:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
" " = C:\Windows\SysNative\shell32.dll -- [2013/07/25 20:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2013/07/25 19:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 19:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 21:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 19:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/12/31 12:52:18 | 000,000,000 | ---D | M] -- C:\Users\Carol\AppData\Roaming\AVG2014
[2014/01/01 20:23:25 | 000,000,000 | ---D | M] -- C:\Users\Carol\AppData\Roaming\ICAClient
[2013/12/31 12:51:36 | 000,000,000 | ---D | M] -- C:\Users\Carol\AppData\Roaming\TuneUp Software

========== Purity Check ==========



< End of report >

 

Extras -

OTL Extras logfile created on: 1/4/2014 7:33:52 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Carol\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.97 Gb Total Physical Memory | 2.86 Gb Available Physical Memory | 72.06% Memory free
7.93 Gb Paging File | 6.76 Gb Available in Paging File | 85.27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.51 Gb Total Space | 823.26 Gb Free Space | 89.53% Space Free | Partition Type: NTFS
Drive E: | 298.09 Gb Total Space | 61.92 Gb Free Space | 20.77% Space Free | Partition Type: NTFS

Computer Name: CAROL-W7PC | User Name: Carol | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll ",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01EEF62F-E25B-4843-B42E-967B45BA662E}" = rport=138 | protocol=17 | dir=out | app=system |
"{1C705BB2-8F8C-44D5-8D64-CDF2BB7C8D41}" = lport=137 | protocol=17 | dir=in | app=system |
"{1CDA8CB9-9755-4452-81D4-EDCD5B51BBAD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1D40A747-E8C9-44D6-912A-62CFC56B57B7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{27FC99E9-AA90-47B8-81DC-03F99DE7BEDD}" = lport=445 | protocol=6 | dir=in | app=system |
"{3484CF36-500D-4DCC-AC71-3A9BE9B2FDE6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{408C9ED5-92EC-4843-89FF-66864F1476CC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{4B707F40-0F74-4697-BE89-F9A57E6E5D8B}" = rport=137 | protocol=17 | dir=out | app=system |
"{5B2C18DD-F972-4666-A4D1-2991F65E728C}" = lport=138 | protocol=17 | dir=in | app=system |
"{5C4BA2CB-4C2C-4A1F-BD19-A6736D7CD55D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{75D06649-7875-4EC6-8F63-0FEA0C78F7D1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7EAAD6B1-260F-4DAB-9598-CAC91C55F4EF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{884BE52D-BF3E-4103-9431-B7BBBEA6E7A2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{958D91B2-2A5D-45C5-88BF-FCB7E34E7627}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdateservice.exe |
"{AB7CB6FA-C16E-4998-9404-ADCAADE1CDAE}" = rport=139 | protocol=6 | dir=out | app=system |
"{B27F1FD3-60AF-43BA-9ED9-419C124D594C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{B6D3800C-2977-483D-BC12-FB78FD83F3F5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BD02B4B6-07AA-4826-A8F5-AA1E3C7E0D4A}" = lport=139 | protocol=6 | dir=in | app=system |
"{C29AAAFA-ACE7-4591-BFCF-FA0ED1482F76}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{C344AE16-1308-451B-AC35-BF6468D2E5EA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E8C05AA1-7897-43A4-AFB4-6F1762CEFF35}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EB822B35-491E-44CD-BCBB-74A6FC0CA61B}" = rport=445 | protocol=6 | dir=out | app=system |
"{F024A5F0-0AE4-43FF-9E61-4160F1DD61D3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F716B10A-23EE-466C-9206-CF047E3198C2}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdater.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{067C08FC-41B6-4F24-89EF-DECF76E4E21A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2779D342-EEE3-4FEA-A3EE-4B978784C5E8}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{33378569-693F-4BFB-AA5C-901B70AF1D8E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3711B6EB-187E-4C14-B398-C4DFF082A1E4}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{3A2E1BBF-0BAE-49B4-A13D-A4F3C7954098}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{44D300B2-D4A6-4065-85F5-080002D7FB71}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{597E6BB6-EA72-4DF9-A71A-18BB71CB8F39}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgdiagex.exe |
"{65A97839-0FCD-48C1-A5AD-3D282D31F6EA}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{6916CB92-3B2D-4C0D-B7DC-05700F4A8670}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{78CF40A4-BAAE-45B1-98DB-FD3837F95391}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgnsa.exe |
"{7FAF2AFD-B965-43A3-914B-91C7CD9D4177}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{8B3A0A3A-A11A-4F2B-BF99-D7B048E483EC}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{8C6C7198-F487-4576-915C-35352B588C7F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8CEA9CFC-8107-4428-B4AC-41A5662D70A3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{933649D2-CB98-4725-9453-3EFFE4D997A5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A08610EC-6A0E-4BAB-823E-9C5B26010C3F}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{A0A461C7-A13A-4F4F-8911-D29CEBE20577}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{A41E1F1F-D875-48AA-9AEF-C19426AF1F55}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AA097610-6303-4521-920C-AC6EFE485466}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B3A511AC-8DF6-4A92-97B1-A80A7311282B}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgemca.exe |
"{B3C98228-3F72-4D1E-AAC2-B0CA6B2E6A77}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgemca.exe |
"{B75BCD07-2EE9-4282-BA4B-10B461747AA5}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{B9B19F2B-F006-4CAD-8A94-CBDD60A213F4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C4CE1D6A-7621-44DF-94A8-B4578F402D95}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5500668-F7C4-4487-B1B0-B39AB4D9938F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C8ED10B1-B0D9-4CD8-83CA-70890722308F}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2014\avgmfapx.exe |
"{CE7CF92B-9521-4127-9CEC-B8AD2518989B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D29CD64A-9996-4CAF-9CF3-B522FA5F36AC}" = protocol=6 | dir=out | app=system |
"{DAA30EDD-1E5D-4A2D-84D6-8DEC8928E72C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E6CEADEC-CAFB-4DF1-8B7C-366F02463E87}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E74F5E69-0A78-4B4E-96CA-D4C35B84809D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgdiagex.exe |
"{E8D6CAF6-8DB4-40A0-BCE5-C5500C42B25C}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{EC83C796-634C-4435-AE53-CAA16BBCFABD}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F79F3D54-3864-48ED-92B0-28B869040A25}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{FA2DB190-36BD-4308-ABC7-E26B8C07FF40}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FB13572D-D9E5-421F-AC32-5085E47A4EB8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FB49B3C9-394B-45E6-84F3-8DADB8647F16}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FBBA1F26-2C39-4FE1-B67E-3883F9E84E92}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgmfapx.exe |
"{FEDE06EE-BA3B-4E6F-B555-FAAF059724BB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2014\avgnsa.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}" = Apple Mobile Device Support
"{34883B9C-CDFE-46F0-9C5B-935484C218C3}" = AVG 2014
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{7F624BD1-4FE0-432F-B928-68302E156D04}" = AVG 2014
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8C775E70-A791-4DA8-BCC3-6AB7136F4484}" = Visual Studio 2012 x64 Redistributables
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}" = iTunes
"29B76F9C91EE9BA9A63E88D9F0000E010363DCB5" = Windows Driver Package - Intel hdc (10/05/2012 9.1.9.1002)
"5E9040CBF06133134873F64C0D152BEBA5F98677" = Windows Driver Package - Intel System (10/05/2012 9.1.9.1002)
"60F614E3025535A863A24F4F9764AE19C3B5A55C" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (04/19/2011 6.0.1.6353)
"62461C94E7F67025AC113795AF5428E1B73EA068" = Windows Driver Package - Intel USB (10/05/2012 9.1.9.1002)
"6C352BEA80A0DBEB6FCE6F10DEDB382409B6E4CF" = Windows Driver Package - Intel System (10/05/2012 9.1.9.1002)
"A290390FCD4285BD620E9759C6F99DF295294C72" = Windows Driver Package - Intel hdc (10/05/2012 9.1.9.1002)
"AVG" = AVG 2014
"C3A70335CB2AC07FE59EC2651F0644CD82F62E3C" = Windows Driver Package - Marvell (yukonw7) Net (01/08/2013 12.10.14.3)
"CCEA11A308396B9C5812FC6CF7FA74FED4B9218A" = Windows Driver Package - Intel Corporation (igfx) Display (10/04/2012 8.15.10.2869)
"CCleaner" = CCleaner
"F02A07F8DE671BE932BB921549A1912BBBBDC957" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (04/19/2011 6.0.1.6353)
"HECI" = Intel(R) Management Engine Interface
"MESOL" = Intel® Active Management Technology

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1606C5A0-DCD7-4543-A185-FAAD210E5284}" = Citrix Receiver(Aero)
"{3E6D7195-3B74-46AF-9BD1-49EBECD0A455}" = Citrix Receiver(DV)
"{42D65288-92F3-4AD6-892C-DFEE475F69A9}" = Citrix Receiver Updater
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{520C1D80-935C-42B9-9340-E883849D804F}_is1" = DriverTuner 3.1.0.0
"{6BDC0D7C-9E42-4667-8FA9-2F26A2FEF4D0}" = Citrix Receiver(USB)
"{6C487153-A286-48F7-BE55-717552E90E20}" = Self-service Plug-in
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{89EC099E-958D-462E-972C-385591946978}" = TurboTax 2012 WinPerFedFormset
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables
"{9A0FE2C0-7A7E-444E-8BD4-087178A91865}" = Online Plug-in
"{A8B1F076-965D-4663-A9D4-C2FB58A42AE4}" = TurboTax 2012 WinPerTaxSupport
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.05)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{D67AEDE1-BCCF-4C5D-BF4F-A08FE92075B7}" = Citrix Receiver Inside
"{DB1C49C7-AC32-4785-A281-774744FC78F5}" = Citrix Authentication Manager
"{E83F5F27-43F3-4163-ABE5-F68C989286ED}" = TurboTax 2012 wrapper
"{EC94A726-7636-4693-9627-D8A8B44793EE}" = Citrix Receiver (HDX Flash Redirection)
"{F014B696-28C5-4554-802F-A15380418F53}" = TurboTax 2012 WinPerReleaseEngine
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FA57CBC1-487B-4B77-B2CB-F2BDD21AE82D}" = TurboTax 2012 waliper
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CitrixOnlinePluginPackWeb" = Citrix Receiver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 26.0 (x86 en-US)" = Mozilla Firefox 26.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.SingleImage" = Microsoft Office Professional 2010
"TurboTax 2012" = TurboTax 2012

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2014 9:33:23 PM | Computer Name = Carol-W7PC | Source = Application Hang | ID = 1002
Description = The program OTL.exe version 3.2.69.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 13e0 Start Time:
01cf09b5dce1186f Termination Time: 0 Application Path: C:\Users\Carol\Desktop\OTL.exe

Report
Id:


< End of report >

 

Whew! I've been at this plus other chores all day and before long the clock gongs and I turn into a pumpkin... I have two questions:

1. Can these most recent steps wait until tomorrow afternoon?

2. Can the unit be left running or should I shut it down and reboot in the morning?