Solved My laptop sound not working

[Resolved] My laptop sound not working

Hey Guys,

My laptop sound is not working since last 1 week, i dont know what went wrong. I've reinstalled my sound card drivers, still no sound.

My laptop is DELL XPS M1330
I've installed SIGMATEL audio drivers on my sys

Pls tell me is there a way to resolve this issue......

Thnx in advance

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.08.31.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: UDAY [administrator]

8/31/2013 8:29:07 AM
MBAM-log-2013-08-31 (08-43-19).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 391959
Time elapsed: 13 minute(s), 29 second(s)

Memory Processes Detected: 4
C:\Program Files\SearchProtect\bin\CltMngSvc.exe (PUP.Optional.SearchProtect.A) -> 1212 -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\cltmng.exe (PUP.Optional.SearchProtect.A) -> 2072 -> No action taken.
C:\Program Files\DefaultTab\DefaultTabSearch.exe (PUP.Optional.DefaultTab) -> 1292 -> No action taken.
C:\Program Files\lucky leap\updateluckyleap.exe (PUP.Optional.LuckyLeap.A) -> 3156 -> No action taken.

Memory Modules Detected: 8
C:\Program Files\SearchProtect\bin\msvcp100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\msvcr100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\FirefoxModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\ChromeModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\InternetExplorerModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\msvcp100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\msvcr100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\lucky leap\luckyleap.Common.dll (PUP.Optional.LuckyLeap.A) -> No action taken.

Registry Keys Detected: 100
HKLM\SYSTEM\CurrentControlSet\Services\WajamUpdater (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{9A4EB585-5098-C90F-07EC-AA032B02E7DB} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9A4EB585-5098-C90F-07EC-AA032B02E7DB} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9A4EB585-5098-C90F-07EC-AA032B02E7DB} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9A4EB585-5098-C90F-07EC-AA032B02E7DB} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCR\CLSID\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKCR\TypeLib\{FEB62B15-CC00-4736-AAEC-BA046C9DFF73} (PUP.Optional.DefaultTab) -> No action taken.
HKCR\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60} (PUP.Optional.DefaultTab) -> No action taken.
HKCR\DefaultTabBHO.DefaultTabBrowser.1 (PUP.Optional.DefaultTab) -> No action taken.
HKCR\DefaultTabBHO.DefaultTabBrowser (PUP.Optional.DefaultTab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab) -> No action taken.
HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamBHO.1 (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamBHO (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{D5E1E445-726A-B578-BDB4-8B690120B2FE} (PUP.Optional.MultiPlug.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D5E1E445-726A-B578-BDB4-8B690120B2FE} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D5E1E445-726A-B578-BDB4-8B690120B2FE} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D5E1E445-726A-B578-BDB4-8B690120B2FE} (PUP.Optional.MultiPlug.A) -> No action taken.
HKCR\CLSID\{d77aa852-def3-43cb-a3f5-bd679de72f32} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCR\TypeLib\{c3c45c5f-2f1b-4012-a854-f89dc99f2335} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCR\Interface\{7F66829F-F442-431F-AF59-E4474505A67A} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D77AA852-DEF3-43CB-A3F5-BD679DE72F32} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D77AA852-DEF3-43CB-A3F5-BD679DE72F32} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D77AA852-DEF3-43CB-A3F5-BD679DE72F32} (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\SWEETIE.IEToolbar.1 (PUP.Optional.SweetIM) -> No action taken.
HKCR\SWEETIE.IEToolbar (PUP.Optional.SweetIM) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\Toolbar3.SWEETIE.1 (PUP.Optional.SweetIM) -> No action taken.
HKCR\Toolbar3.SWEETIE (PUP.Optional.SweetIM) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> No action taken.
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
HKCR\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} (PUP.Optional.BrowseFox.A) -> No action taken.
HKCR\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} (PUP.Optional.Delta) -> No action taken.
HKCR\esrv.deltaESrvc.1 (PUP.Optional.Delta) -> No action taken.
HKCR\esrv.deltaESrvc (PUP.Optional.Delta) -> No action taken.
HKCR\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23} (PUP.Optional.BrowseFox.A) -> No action taken.
HKCR\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} (PUP.Optional.SearchQu) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7} (PUP.Optional.SearchQu) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7} (PUP.Optional.SearchQu) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7} (PUP.Optional.SearchQu) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7} (PUP.Optional.SearchQu) -> No action taken.
HKCR\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> No action taken.
HKCR\delta.deltaHlpr (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} (PUP.Optional.Delta.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C3F3165C-74D3-6FDB-3274-14FDA8698CFA} (PUP.Optional.SilentInstall.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINSTALL.EXE (PUP.Optional.SilentInstall.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{011B8662-0FF6-C111-DCFD-7708E1F2BD5E} (PUP.Optional.Tarma.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Optional.Tarma.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28B3A996-A15C-5024-FBEA-B800B91B61DD} (PUP.Optional.Tarma.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D82EC1-0D3A-DF54-8E3E-07E1337A5311} (PUP.Optional.SilentInstall.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C670DCAE-E392-AA32-6F42-143C7FC4BDFD} (PUP.Optional.SilentInstall.A) -> No action taken.
HKLM\SYSTEM\CurrentControlSet\Services\CltMngSvc (PUP.Optional.SearchProtect.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect (PUP.Optional.SearchProtect.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC Performer_is1 (PUP.Optional.PCPerformer.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UNINS000.EXE (PUP.Optional.PCPerformer.A) -> No action taken.
HKLM\SYSTEM\CurrentControlSet\Services\DefaultTabSearch (PUP.Optional.DefaultTab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DefaultTab Chrome (PUP.Optional.DefaultTab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lucky leap (PUP.Optional.LuckyLeap.A) -> No action taken.
HKLM\SYSTEM\CurrentControlSet\Services\Update lucky leap (PUP.Optional.LuckyLeap.A) -> No action taken.
HKCR\SearchQUIEHelper.DNSGuard (PUP.Optional.SearchQu) -> No action taken.
HKCR\SearchQUIEHelper.DNSGuard.1 (PUP.Optional.SearchQu) -> No action taken.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr) -> No action taken.
HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta) -> No action taken.
HKCU\SOFTWARE\PerformerSoft\PC Performer (PUP.Optional.PCPerformer.A) -> No action taken.
HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> No action taken.
HKCU\Software\delta LTD (PUP.Optional.Delta.A) -> No action taken.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.
HKCU\SOFTWARE\LUCKY LEAP (PUP.Optional.LuckyLeap.A) -> No action taken.
HKLM\SOFTWARE\babylontoolbar (PUP.Optional.Babylon.A) -> No action taken.
HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde (PUP.Optional.Delta.A) -> No action taken.
HKLM\SOFTWARE\PerformerSoft\PC Performer (PUP.Optional.PCPerformer.A) -> No action taken.
HKLM\SYSTEM\CurrentControlSet\Services\DefaultTabUpdate (PUP.Optional.DefaultTab) -> No action taken.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam (PUP.Optional.Wajam.A) -> No action taken.
HKCR\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} (PUP.Optional.SearchNewTab) -> No action taken.
HKCR\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} (PUP.Optional.SearchNewTab) -> No action taken.

Registry Values Detected: 12
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> Data: -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{99079A25-328F-4BD4-BE04-00955ACAA0A7} (PUP.Optional.SearchQu) -> Data: Searchqu Toolbar -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{99079a25-328f-4bd4-be04-00955acaa0a7} (PUP.Optional.SearchQu) -> Data: -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SearchProtectAll (PUP.Optional.SearchProtect.A) -> Data: C:\Program Files\SearchProtect\bin\cltmng.exe -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SearchProtect (PUP.Optional.SearchProtect.A) -> Data: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\cltmng.exe -> No action taken.
HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta) -> Data: -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|run (Trojan.Agent) -> Data: C:\WINDOWS\system32\config\Win.exe -> No action taken.
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0H1K1L2U1Q1U1R0F1U1H1OtFyDtH0A -> No action taken.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {3B9A204F-15CD-459B-BAE1-CE254A0AFC84} -> No action taken.
HKCU\Software\lucky leap|iid (PUP.Optional.LuckyLeap.A) -> Data: def_luckyleap -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DATAMNGR (PUP.Optional.Datamngr) -> Data: C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE -> No action taken.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {3B9A204F-15CD-459B-BAE1-CE254A0AFC84} -> No action taken.

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.BrowserDefender.A) -> Bad: (c:\docume~1\alluse~1.win\applic~1\browse~1\261519~1.190\{c16c1~1\browse~1.dll) Good: () -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.SProtect.A) -> Bad: (c:\progra~1\savesh~1\sprote~1.dll) Good: () -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs (PUP.Optional.SProtect.A) -> Bad: (c:\progra~1\websea~1\sprote~1.dll) Good: () -> No action taken.

Folders Detected: 46
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\coupons (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\search (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weather (PUP.Optional.SearchQu) -> No action taken.
C:\Program Files\SearchProtect\bin (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\lib (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\ffprotect (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\Partial Backups (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Delta (PUP.Optional.Delta) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Delta\delta (PUP.Optional.Delta) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\lib (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\lib (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\SProtectorRepository (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\DefaultTab (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\lucky leap (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\Wajam (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\Firefox (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\IE (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\Updater (PUP.Optional.Wajam.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab (PUP.Optional.SearchNewTab) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\data (PUP.Optional.SearchNewTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\C6B0ABEBCD104D3B963444A6B8637FD8 (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\File Scout (PUP.Optional.FileScout.A) -> No action taken.

Files Detected: 251
C:\Documents and Settings\All Users.WINDOWS\Application Data\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll (PUP.Optional.BrowserDefender.A) -> No action taken.
C:\Program Files\SaveShare\sprotector.dll (PUP.Optional.SProtect.A) -> No action taken.
C:\Program Files\WebSearch\sprotector.dll (PUP.Optional.SProtect.A) -> No action taken.
C:\Program Files\Wajam\Updater\WajamUpdater.exe (PUP.Optional.Wajam.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\savenashare\51fcf737ce65a.dll (PUP.Optional.MultiPlug.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.dll (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\Wajam\IE\priam_bho.dll (PUP.Optional.Wajam.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\51fcf77b836f1.dll (PUP.Optional.MultiPlug.A) -> No action taken.
C:\Program Files\lucky leap\luckyleapBHO.dll (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (PUP.Optional.SweetIM) -> No action taken.
C:\Program Files\Windows iLivid Toolbar\ToolBar\searchqudtx.dll (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabStart.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabStart64.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabWrap.dll (PUP.Optional.DefaultTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabWrap64.dll (PUP.Optional.DefaultTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\update.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\File Scout\filescout.exe (Trojan.PUP.Optional.FileScout.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\BBrowwse2osavvE\uninstall.exe (PUP.Optional.SilentInstall.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate\{820FA904-EFA8-4986-AB6D-A78A59EC8BF2}\Setup.exe (PUP.Optional.Tarma.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate\{820FA904-EFA8-4986-AB6D-A78A59EC8BF2}\TsuDll.dll (PUP.Optional.Tarma.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate\{DBFB0D3D-B1FE-4FE0-AD0B-F9DC00182FCB}\Setup.exe (PUP.Optional.Tarma.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallMate\{DBFB0D3D-B1FE-4FE0-AD0B-F9DC00182FCB}\TsuDll.dll (PUP.Optional.Tarma.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\savenashare\uninstall.exe (PUP.Optional.SilentInstall.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\uninstall.exe (PUP.Optional.SilentInstall.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\My Documents\Downloads\CodecPerformerSetup.exe (Adware.InstallBrain) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\My Documents\Downloads\Keygen .exe (PUP.Optional.Installex) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\My Documents\Downloads\TornTVApp_setup(18_4)_extra_ch.exe (PUP.Optional.OneClickDownloader.A) -> No action taken.
C:\WINDOWS\system32\roboot.exe (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\checktbexist.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\SPStub.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ToolbarHelper.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\ctbe.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\ffLogic.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\ieLogic.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\spff.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\statisticsStub.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ct3298573\stub.exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temp\ins6561\ins6561.exe (PUP.Optional.FirSeriaInstaller.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temporary Internet Files\Content.IE5\0K4YTTA1\checktbexist[1].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\WINDOWS\Installer\988669.msi (PUP.Optional.SweetIM) -> No action taken.
C:\WINDOWS\Installer\988670.msi (PUP.Optional.SweetIM) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\guid.dat (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\dtx.ini (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\log.txt (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\preferences.dat (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\stat-history.log (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\stat.log (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\stats.dat (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\uninstallIE.dat (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\uninstallStatIE.dat (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\version.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weatherbutton_prefs.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\coupons\categories.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\coupons\merchants.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\coupons\merchants2.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\search\searchqutoolbar-search-history.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weather\1386c9d95dacf59d6273972a0977568e (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weather\ea75abf9f764cd4bb25a80b29b39fb2f (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weather\forecasts_cache.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchqutoolbar\weather\observations_cache.xml (PUP.Optional.SearchQu) -> No action taken.
C:\Program Files\SearchProtect\bin\FirefoxModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\ChromeModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\cltmng.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\CltMngSvc.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\InternetExplorerModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\msvcp100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\msvcr100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\rep.dat (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\SPHook32.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\SPRunner.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\bin\uninstall.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\dialogsApi.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\lib\jquery.min.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\lib\json2.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\bubble.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\bubble.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images\information.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images\x-default-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images\x-default-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\SearchProtector.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\settings.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\images\ok-button.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\images\separation-line.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\Dialogs\spsd\images\warning.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\ffprotect\nsprotector.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\ffprotect\abstraction.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\SearchProtect\ffprotect\application.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\rcpupdate.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\1358604458.reg (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\eng_rcp.dat (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\ExcludeList.rcp (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\log_03-08-2013.log (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\log_03-09-2013.log (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\log_03-12-2013.log (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\log_03-13-2013.log (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\log_03-20-2013.log (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\results.rcp (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\TempHLList.rcp (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\Partial Backups\00000001.rmx (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\Partial Backups\00000001.rxb (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\Partial Backups\00000002.rmx (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PerformerSoft\PC Performer\Partial Backups\00000002.rxb (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\xmllite.dll (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Chinese_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\CleanSchedule.exe (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Danish_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Dutch_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\eng_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Finnish_rcp_fi.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\French_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\German_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\greek_rcp_el.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\install_left_image.bmp (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\isxdl.dll (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Italian_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Japanese_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\korean_rcp_ko.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Norwegian_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\PCPerformer.dll (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\PCPerformer.exe (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\polish_rcp_pl.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\portugese_rcp_pt.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Portuguese_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\russian_rcp_ru.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Spanish_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\Swedish_rcp.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\TraditionalCn_rcp_zh-tw.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\turkish_rcp_tr.ini (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\unins000.dat (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\unins000.exe (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Program Files\PC Performer\unins000.msg (PUP.Optional.PCPerformer.A) -> No action taken.
C:\WINDOWS\Tasks\PC Performer_DEFAULT.job (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Delta\sqlite3.dll (PUP.Optional.Delta) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\FirefoxModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\ChromeModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\cltmng.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\CltMngSvc.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\InternetExplorerModule.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\msvcp100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\msvcr100.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\rep.dat (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\SPHook32.dll (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\SPRunner.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\dialogsApi.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\lib\jquery.min.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\lib\json2.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\bubble.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\bubble.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images\information.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images\x-default-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images\x-default-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\SearchProtector.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\settings.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\images\ok-button.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\images\separation-line.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\Dialogs\spsd\images\warning.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\nsprotector.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\abstraction.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\application.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\popupTransparent.xul (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\dialogsApi.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\lib\json2.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\bubble.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\bubble.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\information.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\main.html (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\settings.js (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\SProtectorRepository\EN (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Program Files\DefaultTab\DefaultTab.crx (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\DefaultTab\DefaultTabSearch.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\DefaultTab\uid (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\DefaultTab\uninstaller.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\WINDOWS\Tasks\PC Performer_UPDATES.job (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} (PUP.Optional.Searchqu.A) -> No action taken.
C:\Program Files\lucky leap\updateluckyleap.InstallState (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\eiimolhnbbbdagljikeckdkldgemmmlj.crx (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\luckyleap.Common.dll (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\luckyleap.ico (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\luckyleapOPC.exe (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\luckyleapUninstall.exe (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\Microsoft.Win32.TaskScheduler.dll (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\mj (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\sqlite3.exe (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\lucky leap\updateluckyleap.exe (PUP.Optional.LuckyLeap.A) -> No action taken.
C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (PUP.Optional.Datamngr) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DTUpdate.exe (PUP.Optional.DefaultTab) -> No action taken.
C:\Program Files\Wajam\uninstall.exe (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\IE\favicon.ico (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\IE\wajamLogo.bmp (PUP.Optional.Wajam.A) -> No action taken.
C:\Program Files\Wajam\Updater\update.exe (PUP.Optional.Wajam.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\1.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\a.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\b.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\c.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\d.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\e.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\f.xml (PUP.Optional.PriceGong.A) -> No action taken.

 

C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\g.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\h.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\i.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\J.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\k.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\l.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\m.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\mru.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\n.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\o.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\p.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\q.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\r.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\s.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\t.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\u.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\v.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\w.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\x.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\y.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\PriceGong\Data\z.xml (PUP.Optional.PriceGong.A) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\51fcf77b836f1.tlb (PUP.Optional.SearchNewTab) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\settings.ini (PUP.Optional.SearchNewTab) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Application Data\SearchNewTab\data\SearchNewTab.dat (PUP.Optional.SearchNewTab) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\4185.ico (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\OCBrowserHelper.dll (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\smileyswelovetoolbar.crx (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\SmileysWeLoveToolbarSetup.msi (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\9788046110E847438E795F91B4CD7C2D\smileyswelove_p3v4.exe (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\OpenCandy\C6B0ABEBCD104D3B963444A6B8637FD8\TuneUpUtilities2013_2200319_en-US.exe (PUP.Optional.OpenCandy) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> No action taken.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> No action taken.

(end)


DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.25.2
Run by Administrator at 8:24:57 on 2013-08-31
#Option MBR scan is disabled.
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1731 [GMT 5.5:30]
.
AV: Avira AntiVir PersonalEdition *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\SearchProtect\bin\CltMngSvc.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\DatacardService\DCService.exe
C:\Program Files\DefaultTab\DefaultTabSearch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe
C:\Program Files\lucky leap\updateluckyleap.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\loggingserver.exe
C:\Program Files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Tata Photon+\Huawei\Tata Photon+.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\OEM02Mon.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\WI371A~1\Datamngr\DATAMN~1.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\AVG SafeGuard toolbar\vprot.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\Administrator.ADMINISTRATOR\Qtrax\Player\Notification.exe
C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect\bin\cltmng.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\TuneUp Utilities 2013\integrator.exe
C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com/?ctid=CT3298573&octid=CT3298573&SearchSource=61&CUI=UN36989100831923019&UM=2&UP=SPA2751C98-447F-49F3-A857-66E024909ADB
mStart Page = hxxp://websearch.searchesplace.info/?pid=821&r=2013/08/03&hid=2331904817&lg=EN&cc=IN&unqvl=30
uInternet Connection Wizard,ShellNext = iexplore
uURLSearchHooks: MixiDJ V37 Toolbar: {eef3855c-fc2d-41e6-8d91-d368f51b3055} - c:\program files\mixidj_v37\prxtbMixi.dll
uWindows: Load = c:\windows\inf\Other.exe
uWindows: Run = c:\windows\system32\config\Win.exe
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - LocalServer32 - <no file>
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - c:\documents and settings\administrator.administrator\application data\defaulttab\defaulttab\DefaultTabBHO.dll
BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\program files\windows ilivid toolbar\toolbar\searchqudtx.dll
BHO: savenashare : {9A4EB585-5098-C90F-07EC-AA032B02E7DB} - c:\documents and settings\all users.windows\application data\savenashare\51fcf737ce65a.dll
BHO: SBCONVERT Class: {A1056498-D09A-41E4-864B-505EDD640D9E} - c:\program files\speedbit video downloader\toolbar\SpeedBitVideoDownloader.dll
BHO: UrlHelper Class: {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - c:\program files\windows ilivid toolbar\datamngr\IEBHO.dll
BHO: Wajam: {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - c:\program files\wajam\ie\priam_bho.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: delta Helper Object: {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - LocalServer32 - <no file>
BHO: SearchNewTab: {D5E1E445-726A-B578-BDB4-8B690120B2FE} - c:\documents and settings\all users.windows\application data\searchnewtab\51fcf77b836f1.dll
BHO: lucky leap: {d77aa852-def3-43cb-a3f5-bd679de72f32} - c:\program files\lucky leap\luckyleapbho.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: Freemake.YoutubeButton: {e9e8eb35-ff77-455d-b677-91e5e4fc06c2} -
BHO: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
BHO: MixiDJ V37 Toolbar: {eef3855c-fc2d-41e6-8d91-d368f51b3055} - c:\program files\mixidj_v37\prxtbMixi.dll
BHO: GrabberObj Class: {FF7C3CF0-4B15-11D1-ABED-709549C10000} - c:\program files\speedbit video downloader\toolbar\Grabber.dll
TB: SpeedBit Video Downloader: {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - c:\program files\speedbit video downloader\toolbar\SpeedBitVideoDownloader.dll
TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} - c:\program files\windows ilivid toolbar\toolbar\searchqudtx.dll
TB: SpeedBit Video Downloader: {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - c:\program files\speedbit video downloader\toolbar\SpeedBitVideoDownloader.dll
TB: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
TB: MixiDJ V37 Toolbar: {eef3855c-fc2d-41e6-8d91-d368f51b3055} - c:\program files\mixidj_v37\prxtbMixi.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [Google Update] "c:\documents and settings\administrator.administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [BitTorrent] "c:\program files\bittorrent\BitTorrent.exe" /MINIMIZED
uRun: [DriverMax] "c:\program files\innovative solutions\drivermax\drivermax.exe" -agent
uRun: [DriverMax_RESTART] "c:\program files\innovative solutions\drivermax\drivermax.exe" -RESTART
uRun: [QtraxNotification] c:\documents and settings\administrator.administrator\qtrax\player\Notification.exe
uRun: [SearchProtect] c:\documents and settings\administrator.administrator\application data\searchprotect\bin\cltmng.exe
mRun: [Iusage] c:\program files\internet usage monitor lite edition\netdet.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [PSQLLauncher] "c:\program files\fingerprint reader suite\launcher.exe" /startup
mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [IntelZeroConfig] "c:\program files\intel\wifi\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\common files\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [DATAMNGR] c:\progra~1\wi371a~1\datamngr\DATAMN~1.EXE
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [vProt] "c:\program files\avg safeguard toolbar\vprot.exe "
mRun: [SearchProtectAll] c:\program files\searchprotect\bin\cltmng.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
StartupFolder: c:\docume~1\admini~1.adm\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\ciscos~1.lnk - c:\program files\cisco systems\vpn client\vpngui.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-System: EnableLUA = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:0
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: blank
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: Interfaces\{9B37E5AB-AFC9-427A-BD4F-F9CC73CD1919} : DHCPNameServer = 192.168.42.129
TCP: Interfaces\{E38FDDC8-D46A-4C5E-97CB-6FBE7AC04828} : NameServer = 103.8.46.5 103.8.45.5
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - <orphaned>
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\15.4.0\ViProtocol.dll
AppInit_DLLs= c:\docume~1\alluse~1.win\applic~1\browse~1\261519~1.190\{c16c1~1\browse~1.dll c:\progra~1\savesh~1\sprote~1.dll c:\progra~1\websea~1\sprote~1.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli psqlpwd
IFEO: AcroRd32.exe - "c:\program files\tuneup utilities 2013\TUAutoReactivator32.exe "
IFEO: bittorrent.exe - "c:\program files\tuneup utilities 2013\TUAutoReactivator32.exe "
IFEO: bttray.exe - "c:\program files\tuneup utilities 2013\TUAutoReactivator32.exe "
IFEO: ctlcntr.exe - "c:\program files\tuneup utilities 2013\TUAutoReactivator32.exe "
IFEO: drivermax.exe - "c:\program files\tuneup utilities 2013\TUAutoReactivator32.exe "
.
Note: multiple IFEO entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&CUI=UN16961943771559619&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - MixiDJ V37 Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3298573&octid=CT3298573&SearchSource=61&CUI=UN16961943771559619&UM=2&UP=SPA2751C98-447F-49F3-A857-66E024909ADB
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298573&SearchSource=2&CUI=UN16961943771559619&UM=2&q=
FF - plugin: c:\documents and settings\administrator.administrator\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator.administrator\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\administrator.administrator\application data\mozilla\plugins\npo1d.dll
FF - plugin: c:\documents and settings\administrator.administrator\local settings\application data\facebook\video\skype\npFacebookVideoCalling.dll
FF - plugin: c:\documents and settings\administrator.administrator\local settings\application data\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users.windows\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller\15.4.0\npsitesafety.dll
FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_94.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: 2013-07-09 02:15; {5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}; c:\program files\wajam\firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF - ExtSQL: 2013-08-02 11:20; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\mozilla firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2013-08-03 17:57; ai_t@el-tgz.net; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\ai_t@el-tgz.net
FF - ExtSQL: 2013-08-03 17:58; 8pp8gcdj@iueeu.com; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\8pp8gcdj@iueeu.com
FF - ExtSQL: 2013-08-23 08:27; firefox@luckyleap.net; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\firefox@luckyleap.net.xpi
FF - ExtSQL: 2013-08-25 13:22; addon@defaulttab.com; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\addon@defaulttab.com.xpi
FF - ExtSQL: !HIDDEN! 2010-07-03 07:30; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2013-04-04 11:03; xzaoqcuqfm@yiuazyl-.org; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\xzaoqcuqfm@yiuazyl-.org
FF - ExtSQL: !HIDDEN! 2013-08-03 17:57; ai_t@el-tgz.net; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\ai_t@el-tgz.net
FF - ExtSQL: !HIDDEN! 2013-08-03 17:58; 8pp8gcdj@iueeu.com; c:\documents and settings\administrator.administrator\application data\mozilla\firefox\profiles\8nkz9gap.default\extensions\8pp8gcdj@iueeu.com
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.claro.tlbrSrchUrl -
FF - user.js: extensions.claro.id - 687ba14f000000000000001cbfb47da0
FF - user.js: extensions.claro.appId - {C3110516-8EFC-49D6-8B72-69354F332062}
FF - user.js: extensions.claro.instlDay - 15684
FF - user.js: extensions.claro.vrsn - 1.8.3.10
FF - user.js: extensions.claro.vrsni - 1.8.3.10
FF - user.js: extensions.claro_i.vrsnTs - 1.8.3.1020:21:27
FF - user.js: extensions.claro.prtnrId - claro
FF - user.js: extensions.claro.prdct - claro
FF - user.js: extensions.claro.aflt - babsst
FF - user.js: extensions.claro_i.smplGrp - none
FF - user.js: extensions.claro.tlbrId - base
FF - user.js: extensions.claro.instlRef - sst
FF - user.js: extensions.claro.dfltLng - en
FF - user.js: extensions.claro.excTlbr - false
FF - user.js: extensions.claro.admin - false
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 687ba14f000000000000001e4ce1deed
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15781
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.020:45:46
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2010-8-8 11608]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2013-8-26 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2013-5-24 119056]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2010-8-8 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2010-8-8 151297]
R2 CltMngSvc;Search Protect by Conduit Updater;c:\program files\searchprotect\bin\CltMngSvc.exe [2013-5-8 97056]
R2 DCService.exe;DCService.exe;c:\documents and settings\all users.windows\application data\datacardservice\DCService.exe [2010-5-8 229376]
R2 DefaultTabSearch;DefaultTabSearch;c:\program files\defaulttab\DefaultTabSearch.exe [2013-8-27 573952]
R2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\microsoft sql server\100\dts\binn\MsDtsSrvr.exe [2008-7-10 218136]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2013\TuneUpUtilitiesService32.exe [2013-1-31 1724192]
R2 Update lucky leap;Update lucky leap;c:\program files\lucky leap\updateluckyleap.exe [2013-8-23 206624]
R2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;c:\program files\common files\avg secure search\vtoolbarupdater\15.4.0\ToolbarUpdater.exe [2013-8-26 1616048]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2010-8-8 52056]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2012-10-4 63616]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2013\TuneUpUtilitiesDriver32.sys [2012-8-29 10088]
S2 TIBCOAdmin-TIBCOBC;TIBCO Administrator 5.6 (TIBCOBC);C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice "TIBCOAdmin-TIBCOBC" --> C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice TIBCOAdmin-TIBCOBC [?]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2011-11-4 30312]
S3 cpuz136;cpuz136;\??\c:\docume~1\admini~1.adm\locals~1\temp\cpuz136\cpuz136_x32.sys --> c:\docume~1\admini~1.adm\locals~1\temp\cpuz136\cpuz136_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2012-10-4 101504]
S3 rvd;TIB/Rendezvous Communications Daemon;c:\windows\rvntsctl.exe "rvd" --> c:\windows\rvntsctl.exe rvd [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2011-11-4 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2011-11-4 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2011-11-4 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [2011-11-4 114280]
S3 tibemsd;TIBCO EMS Server;c:\windows\emsntsct.exe "tibemsd" --> c:\windows\emsntsct.exe tibemsd [?]
S3 tibemsmcd;TIBCO EMS Multicast Daemon;c:\windows\emsntsct.exe "tibemsmcd" --> c:\windows\emsntsct.exe tibemsmcd [?]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-9-29 280344]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2011-2-10 104704]
S4 APNMCP;Ask Update Service;c:\program files\askpartnernetwork\toolbar\apnmcp.exe [2013-8-6 164816]
S4 DefaultTabUpdate;DefaultTabUpdate;c:\documents and settings\administrator.administrator\application data\defaulttab\defaulttab\DTUpdate.exe [2013-8-25 107520]
S4 ICM_UpdaterService;ICM_UpdaterService Disp;c:\program files\samsung\samsung networking wizard\ICM_Service.exe [2011-3-18 204883]
S4 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\microsoft sql server\mssql10.mssqlserver\mssql\binn\fdlauncher.exe [2008-7-10 31256]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]
S4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\sony\playmemories home\PMBDeviceInfoProvider.exe [2011-11-25 459832]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]
S4 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users.windows\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-8-14 3291008]
S4 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-21 162408]
S4 WajamUpdater;WajamUpdater;c:\program files\wajam\updater\WajamUpdater.exe [2013-3-28 109064]
S4 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-1-21 110592]
S4 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
.
=============== Created Last 30 ================
.
2013-08-30 18:42:27 889416 ----a-w- c:\documents and settings\administrator.administrator\application data\dotNetFx40_Full_setup.exe
2013-08-28 06:47:23 142848 ----a-w- c:\windows\system32\staco.dll
2013-08-28 06:42:53 90112 ----a-w- c:\windows\system32\stacsv.exe
2013-08-28 06:42:53 4939776 ----a-w- c:\windows\system32\stacgui.cpl
2013-08-28 06:42:53 303104 ----a-w- c:\windows\stsystra.exe
2013-08-28 06:42:53 1601536 ----a-w- c:\windows\system32\stlang.dll
2013-08-28 06:42:32 266240 ----a-w- c:\windows\system32\stacapi.dll
2013-08-28 06:40:53 146944 ----a-w- c:\windows\system32\st325602.dll
2013-08-28 06:40:53 1228296 ----a-w- c:\windows\system32\drivers\sthda.sys
2013-08-28 06:40:53 -------- d-----w- c:\program files\SigmaTel
2013-08-27 05:13:19 -------- d-----w- c:\documents and settings\administrator.administrator\local settings\application data\MixiDJ_V37
2013-08-27 05:13:18 -------- d-----w- c:\program files\MixiDJ_V37
2013-08-27 05:11:44 -------- d-----w- c:\program files\SearchProtect
2013-08-27 05:11:02 -------- d-----w- c:\documents and settings\administrator.administrator\application data\SearchProtect
2013-08-27 04:57:21 -------- d-----w- c:\program files\CPUID
2013-08-27 04:56:17 -------- d-----w- c:\documents and settings\administrator.administrator\Qtrax
2013-08-26 13:13:38 -------- d-----w- c:\windows\system32\SRSLabs
2013-08-26 13:06:59 -------- d-----w- c:\documents and settings\administrator.administrator\local settings\application data\Innovative Solutions
2013-08-26 13:06:56 -------- d-----w- c:\program files\Innovative Solutions
2013-08-26 13:04:58 -------- d-----w- c:\documents and settings\administrator.administrator\local settings\application data\AVG SafeGuard toolbar
2013-08-26 13:04:45 -------- d-----w- c:\documents and settings\administrator.administrator\application data\AVG SafeGuard toolbar
2013-08-26 13:04:40 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-08-26 13:04:36 -------- d-----w- c:\documents and settings\all users.windows\application data\AVG SafeGuard toolbar
2013-08-26 13:04:35 -------- d-----w- c:\program files\AVG SafeGuard toolbar
2013-08-25 07:57:31 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\ctor.dll
2013-08-25 07:57:31 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\DotNetInstaller.exe
2013-08-25 07:57:31 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iscript.dll
2013-08-25 07:57:31 172032 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iuser.dll
2013-08-25 07:57:30 733184 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iKernel.dll
2013-08-25 07:57:30 303104 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\setup.dll
2013-08-25 07:57:30 180356 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iGdi.dll
2013-08-25 07:52:59 -------- d-----w- c:\documents and settings\administrator.administrator\local settings\application data\Wajam
2013-08-25 07:52:56 -------- d-----w- c:\program files\Wajam
2013-08-25 07:52:40 -------- d-----w- c:\program files\DefaultTab
2013-08-25 07:52:39 -------- d--h--w- c:\windows\system32\GroupPolicy
2013-08-25 07:52:37 -------- d-----w- c:\documents and settings\administrator.administrator\application data\DefaultTab
2013-08-25 07:52:36 -------- d-----w- c:\program files\lucky leap
2013-08-06 18:56:55 29984 ----a-w- c:\windows\system32\uxtuneup.dll
2013-08-05 19:28:10 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-08-04 17:56:26 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-08-04 12:23:58 -------- d-----w- c:\documents and settings\administrator.administrator\application data\Malwarebytes
2013-08-04 12:21:36 -------- d-----w- c:\documents and settings\all users.windows\application data\Malwarebytes
2013-08-03 12:25:52 -------- d-----w- c:\documents and settings\all users.windows\application data\StarApp
2013-08-03 12:25:30 -------- d-----w- c:\documents and settings\all users.windows\application data\SearchNewTab
2013-08-03 12:25:18 -------- d-----w- c:\program files\WebSearch
2013-08-03 12:24:51 -------- d-----w- c:\program files\SaveShare
2013-08-03 12:24:26 -------- d-----w- c:\documents and settings\all users.windows\application data\savenashare
.
==================== Find3M ====================
.
2013-08-28 05:01:43 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-28 05:01:43 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-03 08:48:38 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-26 02:47:17 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47:13 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47:12 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52:59 385024 ----a-w- c:\windows\system32\html.iec
2013-07-24 12:24:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-24 12:24:11 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-24 12:24:11 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-24 12:24:11 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-07-10 10:37:53 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 03:03:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-04 07:23:02 562688 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40:45 1876736 ----a-w- c:\windows\system32\win32k.sys
2009-01-16 21:42:58 1784424 -c--a-w- c:\program files\DSFP-3.21.exe
.
============= FINISH: 8:26:03.04 ===============

 

DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 4/25/2010 11:46:56 PM
System Uptime: 8/31/2013 8:06:48 AM (0 hours ago)
.
Motherboard: Dell Inc. | |
Processor: Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz | Microprocessor | 1995/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 49 GiB total, 2.75 GiB free.
D: is FIXED (NTFS) - 49 GiB total, 13.774 GiB free.
E: is CDROM (CDFS)
F: is FIXED (NTFS) - 51 GiB total, 2.029 GiB free.
G: is Removable
H: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: Ethernet Controller
Device ID: PCI\VEN_14E4&DEV_1713&SUBSYS_02091028&REV_02\4&1E93A591&0&00E5
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_14E4&DEV_1713&SUBSYS_02091028&REV_02\4&1E93A591&0&00E5
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_8086&DEV_283E&SUBSYS_02091028&REV_02\3&61AAA01&0&FB
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_8086&DEV_283E&SUBSYS_02091028&REV_02\3&61AAA01&0&FB
Service:
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA
.
Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 6300
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6300
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd
.
Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 5130c-2
Device ID: ROOT\WPD\0001
Manufacturer: Nokia
Name: Nokia 5130c-2
PNP Device ID: ROOT\WPD\0001
Service: WUDFRd
.
==== System Restore Points ===================
.
RP9: 5/13/2010 1:58:40 PM - Software Distribution Service 3.0
RP10: 5/27/2010 10:24:41 PM - Installed Java(TM) 6 Update 20
RP11: 5/29/2010 10:51:44 PM - Software Distribution Service 3.0
RP12: 5/29/2010 11:30:02 PM - Software Distribution Service 3.0
RP13: 6/1/2010 9:37:28 PM - System Checkpoint
RP14: 6/1/2010 11:26:24 PM - Software Distribution Service 3.0
RP15: 6/4/2010 10:47:27 AM - Installed Adobe Reader 9.3.
RP16: 6/5/2010 12:05:31 PM - System Checkpoint
RP17: 6/5/2010 8:06:15 PM - Software Distribution Service 3.0
RP18: 6/6/2010 12:00:05 AM - Software Distribution Service 3.0
RP19: 6/7/2010 11:16:35 AM - System Checkpoint
RP20: 6/9/2010 8:29:49 PM - System Checkpoint
RP21: 6/11/2010 8:08:20 AM - Software Distribution Service 3.0
RP22: 6/19/2010 7:01:52 AM - System Checkpoint
RP23: 6/19/2010 7:12:22 PM - Installed VMware Player.
RP24: 6/20/2010 12:19:49 PM - Installed iTunes
RP25: 6/21/2010 9:06:12 PM - Installed Microsoft Office Professional Edition 2003
RP26: 6/23/2010 2:44:08 PM - Software Distribution Service 3.0
RP27: 6/24/2010 6:59:54 PM - System Checkpoint
RP28: 6/25/2010 3:17:25 PM - Software Distribution Service 3.0
RP29: 6/27/2010 11:56:40 AM - Installed Microsoft Office Enterprise 2007
RP30: 6/27/2010 12:08:18 PM - Printer Driver Send To Microsoft OneNote Driver Installed
RP31: 6/27/2010 12:18:09 PM - Printer Driver Send To Microsoft OneNote Driver Installed
RP32: 6/28/2010 9:00:13 AM - Software Distribution Service 3.0
RP33: 6/30/2010 10:13:18 AM - System Checkpoint
RP34: 7/2/2010 2:17:35 PM - Installed Windows KB954550-v5.
RP35: 7/2/2010 2:18:01 PM - Printer Driver Microsoft XPS Document Writer Installed
RP36: 7/2/2010 2:18:12 PM - Printer Driver Microsoft XPS Document Writer Installed
RP37: 7/2/2010 2:21:54 PM - Installed Windows XP KB942288-v3.
RP38: 7/2/2010 9:51:36 PM - Installed %1 %2.
RP39: 7/2/2010 9:58:03 PM - Installed %1 %2.
RP40: 7/3/2010 7:19:22 AM - Software Distribution Service 3.0
RP41: 7/9/2010 5:17:42 PM - Installed Microsoft Visual C++ 2005 Redistributable
RP42: 7/14/2010 1:18:49 AM - System Checkpoint
RP43: 7/15/2010 2:24:00 AM - System Checkpoint
RP44: 7/15/2010 3:00:15 AM - Software Distribution Service 3.0
RP45: 7/16/2010 3:46:16 AM - System Checkpoint
RP46: 7/17/2010 8:18:31 PM - System Checkpoint
RP47: 7/18/2010 10:07:13 PM - System Checkpoint
RP48: 7/21/2010 8:53:08 PM - System Checkpoint
RP49: 7/22/2010 9:49:55 PM - System Checkpoint
RP50: 7/25/2010 2:20:10 PM - System Checkpoint
RP51: 7/27/2010 9:13:55 PM - System Checkpoint
RP52: 7/28/2010 9:42:07 PM - System Checkpoint
RP53: 7/30/2010 9:16:18 AM - System Checkpoint
RP54: 8/2/2010 2:26:38 PM - System Checkpoint
RP55: 8/4/2010 1:18:42 AM - Software Distribution Service 3.0
RP56: 8/6/2010 12:10:54 AM - System Checkpoint
RP57: 8/8/2010 11:32:55 AM - System Checkpoint
.
==== Image File Execution Options =============
.
IFEO: AcroRd32.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: bittorrent.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: bttray.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: ctlcntr.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: drivermax.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: enrollbtn.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: goforfiles.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: googletalk.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: googleupdater.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: ifrmewrk.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: ihelp.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: ipsecdialer.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: iusage.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: iwrap.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: javaw.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: javaws.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: launchte.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: pmbbrowser.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: pmbinit.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: setmtu.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: skype.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: startmui.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: unins000.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: uninstall.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: vmplayer.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: vpngui.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: wddmstatus.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: wdsmartware.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe "
IFEO: Your Image File Name Here without a path - ntsd -d
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.03)
Adobe Shockwave Player 11.5
Ask Toolbar
AVG SafeGuard toolbar
Avira AntiVir Personal - Free Antivirus
BBrowwse2osavvE
BitMeter
BitTorrent
BrowseToSave 1.74
Bullzip PDF Printer 8.4.0.1425
CPUID CPU-Z 1.64.0
Data Lifeguard Diagnostic for Windows 1.24
DefaultTab
DefaultTab Chrome
Dell System Detect Bootstrapper
Dell Touchpad
DriverMax 7
Expense Minder
Facebook Video Calling 1.2.0.287
Fingerprint Reader Suite 5.6
Free Easy Burner V 4.1
Freemake Video Downloader
GoforFiles
Google Talk (remove only)
Google Talk Plugin
Google Updater
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
Hotfix for Windows XP (KB2779562)
Intel PROSet Wireless
Intel(R) PROSet/Wireless WiFi Software
Internet Usage Monitor Lite Edition
iTunes
Java 7 Update 25
Java Auto Updater
Java(TM) 6 Update 24
K-Lite Codec Pack 5.7.0 (Full)
Laptop Integrated Webcam Driver (1.02.01.0612)
lucky leap 3.0.0
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office 2003 Web Components
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Meeting 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Browser
Microsoft SQL Server 2008 Client Tools
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Database Engine Services
Microsoft SQL Server 2008 Database Engine Shared
Microsoft SQL Server 2008 Full text search
Microsoft SQL Server 2008 Integration Services
Microsoft SQL Server 2008 Management Studio
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 Policies
Microsoft SQL Server 2008 RsFx Driver
Microsoft SQL Server 2008 Setup Support Files (English)
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server Compact 3.5 SP1 Query Tools English
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual Studio Tools for Applications 2.0 - ENU
MixiDJ V37 Toolbar
Mozilla Firefox 23.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVC80_x86
MSVC80_x86_v2
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Nero 8 Micro 8.3.2.1
Nokia Connectivity Cable Driver
PC Connectivity Solution
PC Performer
PlayMemories Home
Qtrax
Qtrax Player
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealUpgrade 1.1
Reliance Netconnect - Broadband+
Samsung Networking Wizard
SAMSUNG USB Driver for Mobile Phones
savenashare
SaveShare 1.74
Search Assistant WebSearch 1.74
Search Protect by conduit
SearchNewTab
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2846071)
Security Update for Windows Internet Explorer 8 (KB2862772)
Security Update for Windows Media Player (KB2834904-v2)
Security Update for Windows Media Player (KB2834904)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2834886)
Security Update for Windows XP (KB2839229)
Security Update for Windows XP (KB2845187)
Security Update for Windows XP (KB2849470)
Security Update for Windows XP (KB2850851)
Security Update for Windows XP (KB2850869)
Security Update for Windows XP (KB2859537)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB982381)
SigmaTel Audio
Skype Click to Call
Skype™ 6.6
SpeedBit Video Downloader
Sql Server Customer Experience Improvement Program
SQL Server System CLR Types
SUPERAntiSpyware
SweetIM for Messenger 3.6
SweetIM Toolbar for Internet Explorer 4.1
Tata Photon+
TeamViewer 7
TIBCO EMS GAC Assembly Registration
TIBCO Rendezvous GAC Assembly Registration
Total Video Converter 3.71 100812
TuneUp Utilities 2013
TuneUp Utilities Language Pack (en-US)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2749655)
Update for Windows XP (KB2863058)
Update for Windows XP (KB951978)
Update for Windows XP (KB980182)
Veetle TV 0.9.17
VLC media player 1.1.2
VPN Client
Wajam
WD Backup
WD Diagnostics
WD FAT32 Formatter
WD Firewire HID Driver
WD SmartWare
WD Spindown or Stop Utility for External Drive, v1.00
WebFldrs XP
WIDCOMM Bluetooth Software
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)
Windows iLivid Toolbar
Windows Internet Explorer 8
Windows Media Format 11 runtime
WinRAR archiver
WordWeb
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
8/27/2013 10:45:47 AM, error: Service Control Manager [7034] - The Hotspot Shield Monitoring Service service terminated unexpectedly. It has done this 1 time(s).
8/27/2013 10:28:36 AM, error: PSched [14107] - QoS [Adapter NDISWANBH]: The Packet Scheduler could not initialize the virtual miniport with NDIS.
8/26/2013 9:34:28 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service gusvc with arguments " " in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8}
8/26/2013 6:46:32 PM, error: SRService [104] - The System Restore initialization process failed.
8/26/2013 6:46:32 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
8/26/2013 2:52:02 PM, error: DCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {A4199E55-EBB9-49E5-AF1A-7A5408B2E206} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.
8/26/2013 1:56:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: SYMTDI
8/25/2013 1:22:56 PM, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {BA126AD1-2166-11D1-B1D0-00805FC1270E} to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================

 

I've ran the tool after installing it........

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.31.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: UDAY [administrator]

9/1/2013 5:49:33 PM
mbam-log-2013-09-01 (17-49-33).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 394116
Time elapsed: 15 minute(s), 44 second(s)

Memory Processes Detected: 1
C:\Program Files\RegClean Pro\RegCleanPro.exe (PUP.Optional.RegCleanPro.A) -> 624 -> Delete on reboot.

Memory Modules Detected: 3
C:\Program Files\RegClean Pro\isxdl.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\Program Files\RegClean Pro\RegCleanPro.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\Program Files\RegClean Pro\xmllite.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RegClean Pro_is1 (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Program Files\RegClean Pro (PUP.Optional.RegCleanPro.A) -> Delete on reboot.

Files Detected: 37
C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\rcpsetup_majorgeeks_majorgeeks_300_250.exe (PUP.Optional.RegCleanerPro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Temporary Internet Files\Content.IE5\S8XINWK2\rcpsetup_majorgeeks_majorgeeks_300_250[1].exe (PUP.Optional.RegCleanerPro) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\TraditionalCn_rcp_zh-tw.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Chinese_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\CleanSchedule.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Cloud_Backup_Setup.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Cloud_Backup_Setup_Intl.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Danish_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Dutch_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\eng_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Finnish_rcp_fi.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\French_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\German_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\greek_rcp_el.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\install_left_image.bmp (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\isxdl.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\Program Files\RegClean Pro\Italian_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Japanese_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\korean_rcp_ko.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Norwegian_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\polish_rcp_pl.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\portugese_rcp_pt.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Portuguese_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\RCPUninstall.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\RegCleanPro.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\Program Files\RegClean Pro\RegCleanPro.exe (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\Program Files\RegClean Pro\russian_rcp_ru.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Spanish_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\Swedish_rcp.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\systweakasp.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\turkish_rcp_tr.ini (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\unins000.dat (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\unins000.exe (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\unins000.msg (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\Program Files\RegClean Pro\xmllite.dll (PUP.Optional.RegCleanPro.A) -> Delete on reboot.
C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job (PUP.Optional.RegCleanPro.A) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\roboot.exe (PUP.Optional.PCPerformer.A) -> Quarantined and deleted successfully.

(end)

 

Ran Rogue Killer....following is the report

RogueKiller V8.6.7 [Aug 28 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Administrator [Admin rights]
Mode : Remove -- Date : 09/02/2013 08:51:03
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Google Update ( "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [7]) -> DELETED
[RUN][SUSP PATH] HKUS\S-1-5-21-1004336348-725345543-1417001333-500\[...]\Run : Google Update ( "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c [7]) -> [0x2] The system cannot find the file specified.
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> REPLACED (1)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 2 ¤¤¤
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500UA.job : C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> DELETED
[V1][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500Core.job : C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe - /c [7] -> DELETED

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[Address] SSDT[53] : NtCreateThread @ 0x805D1068 -> HOOKED (Unknown @ 0xBA671104)
[Address] SSDT[122] : NtOpenProcess @ 0x805CB486 -> HOOKED (Unknown @ 0xBA6710F0)
[Address] SSDT[128] : NtOpenThread @ 0x805CB712 -> HOOKED (Unknown @ 0xBA6710F5)
[Address] SSDT[277] : NtWriteVirtualMemory @ 0x805B4400 -> HOOKED (Unknown @ 0xBA6710FA)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9160823ASG +++++
--- User ---
[MBR] ab75e0d45705e842646e8855cd189eee
[BSP] c87da3ad6f5f0295a5592299c202ed85 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 49999 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 102398310 | Size: 102618 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_09022013_085103.txt >>
RKreport[0]_S_09022013_085021.txt

 

I've tried to open system restore...it is saying System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again

I've restarted the system but the same msg appeared

I went to to RUN>services.msc and scrolled down to SystemRestoreService and found service status is disabled, I tried to enable it, a new popup window appeared saying
Could not start the System Restore Service on Local Computer
Error 2: The system cannot find the file specified

 

Done!!!!

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.02.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: UDAY [administrator]

9/2/2013 9:31:30 AM
mbar-log-2013-09-02 (09-31-30).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 398457
Time elapsed: 1 hour(s), 2 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1005

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_24

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 1.994000 GHz
Memory total: 3219095552, free: 1877012480

Downloaded database version: v2013.09.02.01
Downloaded database version: v2013.08.06.01
=======================================
------------ Kernel report ------------
09/02/2013 09:31:17
------------ Loaded modules -----------
\WINDOWS\system32\ntkrnlpa.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
nfofgxbp.sys
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
compbatt.sys
\WINDOWS\system32\DRIVERS\BATTC.SYS
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\NETw5x32.sys
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\rimmptsk.sys
\SystemRoot\system32\DRIVERS\rimsptsk.sys
\SystemRoot\system32\DRIVERS\rixdptsk.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\btkrnl.sys
\SystemRoot\system32\DRIVERS\dne2000.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\ew_jubusenum.sys
\SystemRoot\system32\DRIVERS\WDFLDR.SYS
\SystemRoot\System32\Drivers\wdf01000.sys
\SystemRoot\system32\DRIVERS\btport.sys
\SystemRoot\system32\drivers\btaudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\drivers\sthda.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\WINDOWS\system32\drivers\avgtpx86.sys
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\ssmdrv.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\system32\DRIVERS\avipbb.sys
\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\btwusb.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\tcusb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\btwdndis.sys
\SystemRoot\system32\DRIVERS\btwmodem.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\btwhid.sys
\SystemRoot\system32\DRIVERS\OEM02Dev.sys
\SystemRoot\system32\DRIVERS\OEM02Vfx.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\system32\DRIVERS\ewusbmdm.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\ATMFD.DLL
\??\C:\WINDOWS\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\WudfPf.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\s24trans.sys
\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\??\C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\system32\drivers\kmixer.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR4
Upper Device Object: 0xffffffff8a880ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\000000c5\
Lower Device Object: 0xffffffff8a985ea0
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8abe4ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-e\
Lower Device Object: 0xffffffff8acacd98
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8abe4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8aca9e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8abe4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8acacd98, DeviceName: \Device\Ide\IdeDeviceP2T0L0-e\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
The directory C:\WINDOWS\SYSTEM32\drivers seems inaccessible or encrypted.
Drivers scan is aborted.
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 10000000

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 102398247
Partition file system is NTFS
Partition is bootable

Partition 1 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 102398310 Numsec = 210162330

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-312561808-312581808)...
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8a880ab8, DeviceName: \Device\Harddisk1\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a789e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a880ab8, DeviceName: \Device\Harddisk1\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a985ea0, DeviceName: \Device\000000c5\, DriverName: \Driver\USBSTOR\
------------ End ----------
Scan finished
=======================================


Removal queue found; removal started
Removing C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
Removing C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_63_i.mbam...
Removing C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1005

(c) Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

Java version: 1.6.0_24

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 1.994000 GHz
Memory total: 3219095552, free: 1614151680

Downloaded database version: v2013.09.02.01
Downloaded database version: v2013.08.06.01
=======================================
Initializing...
------------ Kernel report ------------
09/02/2013 10:47:03
------------ Loaded modules -----------
\WINDOWS\system32\ntkrnlpa.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
nfofgxbp.sys
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
compbatt.sys
\WINDOWS\system32\DRIVERS\BATTC.SYS
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
dmload.sys
dmio.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltMgr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\NETw5x32.sys
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\rimmptsk.sys
\SystemRoot\system32\DRIVERS\rimsptsk.sys
\SystemRoot\system32\DRIVERS\rixdptsk.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\drivers\Afc.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\btkrnl.sys
\SystemRoot\system32\DRIVERS\dne2000.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\rdpdr.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\ew_jubusenum.sys
\SystemRoot\system32\DRIVERS\WDFLDR.SYS
\SystemRoot\System32\Drivers\wdf01000.sys
\SystemRoot\system32\DRIVERS\btport.sys
\SystemRoot\system32\drivers\btaudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\drivers\sthda.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\??\C:\WINDOWS\system32\drivers\avgtpx86.sys
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\ssmdrv.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\system32\DRIVERS\avipbb.sys
\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\btwusb.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\tcusb.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\btwdndis.sys
\SystemRoot\system32\DRIVERS\btwmodem.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\btwhid.sys
\SystemRoot\system32\DRIVERS\OEM02Dev.sys
\SystemRoot\system32\DRIVERS\OEM02Vfx.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\system32\DRIVERS\ewusbmdm.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\ATMFD.DLL
\??\C:\WINDOWS\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\WudfPf.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\s24trans.sys
\??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\??\C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR4
Upper Device Object: 0xffffffff8a880ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\000000c5\
Lower Device Object: 0xffffffff8a985ea0
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8abe4ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-e\
Lower Device Object: 0xffffffff8acacd98
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8abe4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8aca9e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8abe4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8acacd98, DeviceName: \Device\Ide\IdeDeviceP2T0L0-e\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
The directory C:\WINDOWS\SYSTEM32\drivers seems inaccessible or encrypted.
Drivers scan is aborted.
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 10000000

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 102398247
Partition file system is NTFS
Partition is bootable

Partition 1 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 102398310 Numsec = 210162330

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-312561808-312581808)...
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8a880ab8, DeviceName: \Device\Harddisk1\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a789e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a880ab8, DeviceName: \Device\Harddisk1\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a985ea0, DeviceName: \Device\000000c5\, DriverName: \Driver\USBSTOR\
------------ End ----------

 

DONE!!!!!
ComboFix 13-09-02.02 - Administrator 09/03/2013 0:46.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1948 [GMT 5.5:30]
Running from: c:\documents and settings\Administrator.ADMINISTRATOR\My Documents\Downloads\ComboFix.exe
AV: Avira AntiVir PersonalEdition *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator.ADMINISTRATOR\Administrator1
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\BabMaint.exe
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\addon.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\amazon_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabBHO.cfg
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DefaultTabUninstaller.exe
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\DT.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\ebay_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\facebook_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\search_here_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\searchhere.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\twitter_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\wikipedia_ie.ico
c:\documents and settings\Administrator.ADMINISTRATOR\My Documents\Internet Explorer.lnk
c:\documents and settings\All Users.WINDOWS\Application Data\BBrowwse2osavvE
c:\documents and settings\All Users.WINDOWS\Application Data\BBrowwse2osavvE\515d109a333b0.tlb
c:\documents and settings\All Users.WINDOWS\Application Data\BBrowwse2osavvE\data\BBrowwse2osavvE.dat
c:\documents and settings\All Users.WINDOWS\Application Data\BBrowwse2osavvE\settings.ini
c:\documents and settings\All Users.WINDOWS\Application Data\savenashare
c:\documents and settings\All Users.WINDOWS\Application Data\savenashare\51fcf737ce65a.tlb
c:\documents and settings\All Users.WINDOWS\Application Data\savenashare\data\savenashare .dat
c:\documents and settings\All Users.WINDOWS\Application Data\savenashare\settings.ini
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\BBrowwse2osavvE
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\BBrowwse2osavvE\BBrowwse2osavvE.lnk
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\BBrowwse2osavvE\Uninstall.lnk
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\savenashare
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\SearchNewTab
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\SearchNewTab\SearchNewTab.lnk
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\SearchNewTab\Uninstall.lnk
c:\program files\Internet Explorer\SETBC.tmp
c:\program files\Internet Explorer\SETBD.tmp
c:\program files\Mozilla Firefox\searchplugins\SearchquWebSearch.xml
c:\program files\SaveShare
c:\program files\SaveShare\uninstall.exe
c:\windows\system32\Cache
c:\windows\system32\Cache\075884af680ff6dc.fb
c:\windows\system32\Cache\227113dfa1ca894d.fb
c:\windows\system32\Cache\49fbbc5a8678d502.fb
c:\windows\system32\Cache\5c54eb1a1655b076.fb
c:\windows\system32\Cache\613e8ce7ab7106af.fb
c:\windows\system32\Cache\633a76311867bd11.fb
c:\windows\system32\Cache\691f14230153a9e1.fb
c:\windows\system32\Cache\6cb409d7ac73d9f1.fb
c:\windows\system32\Cache\7614bd6cfa99e546.fb
c:\windows\system32\Cache\77664b6ccc36be9f.fb
c:\windows\system32\Cache\881b3593316772f0.fb
c:\windows\system32\Cache\98657d0579ae1930.fb
c:\windows\system32\Cache\ba7364925379b1a8.fb
c:\windows\system32\Cache\d5c0f4e7bbe35bf3.fb
c:\windows\system32\Cache\d9ca663388d21ec0.fb
c:\windows\system32\Cache\f2cda51fd108941f.fb
c:\windows\system32\Cache\f34d8db84131d925.fb
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\IWPDGINA.DLL
c:\windows\system32\logs
c:\windows\system32\logs\Settings.dat
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_BACKUP_INFO
-------\Legacy_DCSERVICE.EXE
-------\Legacy_DEFAULTTABSEARCH
-------\Service_DCService.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-08-02 to 2013-09-02 )))))))))))))))))))))))))))))))
.
.
2013-09-02 04:01 . 2013-09-02 05:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-01 12:08 . 2013-09-01 12:08 -------- d-----w- c:\program files\MyPC Backup
2013-09-01 12:07 . 2013-09-01 12:07 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Amazon Browser Bar
2013-09-01 12:06 . 2013-09-01 12:07 -------- d-----w- c:\program files\Amazon Browser Bar
2013-09-01 12:04 . 2013-09-01 12:04 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak
2013-09-01 11:45 . 2013-09-01 11:45 54016 ----a-w- c:\windows\system32\drivers\jfcxhg.sys
2013-08-31 03:46 . 2007-05-10 04:53 94208 ----a-w- c:\windows\system32\stacsv.exe
2013-08-31 03:46 . 2007-05-10 04:53 4952064 ----a-w- c:\windows\system32\stacgui.cpl
2013-08-31 03:46 . 2007-05-10 04:52 405504 ----a-w- c:\windows\stsystra.exe
2013-08-31 03:46 . 2007-04-10 11:32 1601536 ----a-w- c:\windows\system32\stlang.dll
2013-08-31 03:45 . 2007-05-10 04:53 270336 ----a-w- c:\windows\system32\stacapi.dll
2013-08-31 02:55 . 2013-08-31 02:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-08-31 02:55 . 2013-04-04 09:20 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-28 06:47 . 2007-02-19 08:56 142848 ------w- c:\windows\system32\staco.dll
2013-08-28 06:40 . 2013-08-28 06:40 -------- d-----w- c:\program files\SigmaTel
2013-08-28 06:40 . 2007-08-21 04:28 146944 ----a-w- c:\windows\system32\st325602.dll
2013-08-28 06:40 . 2007-05-10 04:54 1222840 ----a-w- c:\windows\system32\drivers\sthda.sys
2013-08-27 05:13 . 2013-08-31 17:56 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37
2013-08-27 05:13 . 2013-08-27 05:13 -------- d-----w- c:\program files\MixiDJ_V37
2013-08-27 05:11 . 2013-09-01 11:48 -------- d-----w- c:\program files\SearchProtect
2013-08-27 05:11 . 2013-09-01 11:48 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect
2013-08-27 04:58 . 2013-08-27 04:58 -------- d-----w- c:\documents and settings\fbwuser
2013-08-27 04:57 . 2013-08-27 04:57 -------- d-----w- c:\program files\CPUID
2013-08-27 04:56 . 2013-08-27 04:56 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Qtrax
2013-08-26 13:13 . 2013-08-26 13:13 -------- d-----w- c:\windows\system32\SRSLabs
2013-08-26 13:06 . 2013-08-26 13:06 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Innovative Solutions
2013-08-26 13:06 . 2013-08-26 13:06 -------- d-----w- c:\program files\Innovative Solutions
2013-08-26 13:04 . 2013-08-26 15:59 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-08-26 13:04 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-09-01 17:50 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-08-26 13:04 . 2013-08-26 13:04 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-09-01 17:50 -------- d-----w- c:\program files\AVG SafeGuard toolbar
2013-08-25 07:57 . 2004-07-15 18:50 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-08-25 07:57 . 2004-07-15 18:49 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-08-25 07:57 . 2004-07-15 18:48 172032 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-08-25 07:57 . 2004-07-15 18:48 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-08-25 07:57 . 2013-08-25 07:57 303104 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-08-25 07:57 . 2013-08-25 07:57 180356 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-08-25 07:57 . 2004-07-15 18:50 733184 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-08-25 07:52 . 2013-08-25 07:52 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Wajam
2013-08-25 07:52 . 2013-08-25 07:52 -------- d--h--w- c:\windows\system32\GroupPolicy
2013-08-25 07:52 . 2013-09-02 19:27 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab
2013-08-09 19:39 . 2013-08-09 19:39 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY\Application Data\TuneUp Software
2013-08-06 18:56 . 2013-01-31 09:35 29984 ----a-w- c:\windows\system32\uxtuneup.dll
2013-08-05 19:28 . 2013-07-26 02:47 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-08-04 17:56 . 2013-08-27 03:18 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-08-04 12:23 . 2013-08-04 12:23 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Malwarebytes
2013-08-04 12:21 . 2013-08-04 12:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-02 19:35 . 2013-09-02 19:35 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-08-31 17:49 . 2012-07-27 05:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-31 17:49 . 2012-02-09 10:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-03 08:48 . 2006-10-18 16:17 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-26 02:47 . 2008-04-14 11:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47 . 2008-04-14 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2008-04-14 11:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 11:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-24 12:24 . 2013-07-24 12:24 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-24 12:24 . 2012-09-09 12:40 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-24 12:24 . 2010-05-27 16:55 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-24 12:24 . 2010-05-27 16:55 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-07-10 10:37 . 2008-04-14 11:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 03:03 . 2008-04-14 11:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2008-04-14 00:01 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-01-16 21:42 . 2009-09-29 04:08 1784424 -c--a-w- c:\program files\DSFP-3.21.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . EC7A575CAECA0895B31F75DDBCF325BC . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2}]
2009-11-06 19:37 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@= "{F2F31467-B1AC-4df0-AE79-FD5FA085E22B} "
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-16 17:43 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@= "{A3E208F7-0E3A-4182-A7A6-B169D5D691AA} "
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-16 17:43 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-23 39408]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-05-15 4760816]
"BitTorrent "= "c:\program files\BitTorrent\BitTorrent.exe" [2013-05-28 882520]
"DriverMax "= "c:\program files\Innovative Solutions\DriverMax\drivermax.exe" [2013-08-12 7292416]
"DriverMax_RESTART "= "c:\program files\Innovative Solutions\DriverMax\drivermax.exe" [2013-08-12 7292416]
"QtraxNotification "= "c:\documents and settings\Administrator.ADMINISTRATOR\Qtrax\Player\Notification.exe" [2013-08-27 116008]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Iusage "= "c:\program files\Internet Usage Monitor Lite Edition\netdet.exe" [2004-03-15 28672]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"PSQLLauncher "= "c:\program files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 49168]
"OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"NvMediaCenter "= "NvMCTray.dll" [2007-08-17 81920]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-08-17 8478720]
"IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-16 1368064]
"IntelWireless "= "c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-16 1191936]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"avgnt "= "c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"TkBellExe "= "c:\program files\real\realplayer\update\realsched.exe" [2012-06-01 296056]
"vProt "= "c:\program files\AVG SafeGuard toolbar\vprot.exe" [2013-09-01 2314416]
"SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3 "= "advpack.dll" [2009-03-07 128512]
.
c:\documents and settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\program files\MyPC Backup\MyPC Backup.exe [2013-7-1 1945128]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe "-user_logon" [2011-9-29 1524776]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe "=c:\windows\system32\ctfmon.exe
"Facebook Update "= "c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"BitTorrent "= "c:\program files\BitTorrent\BitTorrent.exe" /MINIMIZED
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
"Google Update "= "c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" /background
"SUPERAntiSpyware "=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"MotiveReportAgent "= "c:\program files\Common Files\Motive\McciBootStrapper.exe" /url= "-APPKEY=Motive -WindowContext=ReportAgent -url=file://c:\program files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath= "c:\program files\Common Files\Motive\MotiveBrowser.exe" /hidden
"TkBellExe "= "c:\program files\real\realplayer\update\realsched.exe" -osboot
"WD Button Manager "=WDBtnMgr.exe
"WD Spindown Utility "= "c:\program files\Western Digital Technologies\Spindown\ExSpinDn.exe "
"PMBVolumeWatcher "=c:\program files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
"Iusage "=c:\program files\Internet Usage Monitor Lite Edition\netdet.exe
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe "
"ApnTBMon "= "c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe "
"SynTPEnh "=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"WordWeb "= "c:\program files\WordWeb\wweb32.exe" -startup
"SweetIM "=c:\program files\SweetIM\Messenger\SweetIM.exe
"SigmatelSysTrayApp "=stsystra.exe
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\SmartVoip.com\\SmartVoip\\SmartVoip.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe "=
"c:\\Program Files\\Windows iLivid Toolbar\\ToolBar\\dtUser.exe "=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe "=
"c:\\WINDOWS\\system32\\muzapp.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Desktop\\Uday\\SweetImSetup_1.exe "=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe "=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe "=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe "=
"c:\\Program Files\\GoforFiles\\goforfilesdl.exe "=
"c:\\Program Files\\GoforFiles\\GoforFiles.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [8/26/2013 6:34 PM 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 9:57 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/13/2011 3:25 AM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [5/24/2013 1:41 AM 119056]
R2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [7/10/2008 1:22 AM 218136]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe [1/31/2013 3:05 PM 1724192]
R2 Updater Service for AMZN;Updater Service for AMZN;c:\program files\Amazon Browser Bar\ToolbarUpdaterService.exe [3/21/2013 11:54 PM 222368]
R2 vToolbarUpdater15.5.0;vToolbarUpdater15.5.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [9/1/2013 11:20 PM 1643184]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [10/4/2012 6:07 PM 63616]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys [8/29/2012 4:42 PM 10088]
S2 BackupStack;Computer Backup (MyPC Backup);c:\program files\MyPC Backup\BackupStack.exe [7/1/2013 11:25 PM 32808]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [8/31/2013 8:25 AM 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/31/2013 8:25 AM 701512]
S2 TIBCOAdmin-TIBCOBC;TIBCO Administrator 5.6 (TIBCOBC);C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice "TIBCOAdmin-TIBCOBC" --> C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice TIBCOAdmin-TIBCOBC [?]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [11/4/2011 8:30 AM 30312]
S3 cpuz136;cpuz136;\??\c:\docume~1\ADMINI~1.ADM\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys --> c:\docume~1\ADMINI~1.ADM\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [10/4/2012 6:07 PM 101504]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/31/2013 8:25 AM 22856]
S3 rvd;TIB/Rendezvous Communications Daemon;c:\windows\rvntsctl.exe "rvd" --> c:\windows\rvntsctl.exe rvd [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [11/4/2011 8:30 AM 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [11/4/2011 8:30 AM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [11/4/2011 8:30 AM 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [11/4/2011 8:30 AM 114280]
S3 tibemsd;TIBCO EMS Server;c:\windows\emsntsct.exe "tibemsd" --> c:\windows\emsntsct.exe tibemsd [?]
S3 tibemsmcd;TIBCO EMS Multicast Daemon;c:\windows\emsntsct.exe "tibemsmcd" --> c:\windows\emsntsct.exe tibemsmcd [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2/10/2011 9:48 PM 104704]
S4 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [8/6/2013 5:00 AM 164816]
S4 ICM_UpdaterService;ICM_UpdaterService Disp;c:\program files\Samsung\Samsung Networking Wizard\ICM_Service.exe [3/18/2011 7:06 PM 204883]
S4 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [7/10/2008 1:15 AM 31256]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/10/2008 8:19 AM 47128]
S4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [11/25/2011 3:21 PM 459832]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [7/10/2008 2:49 AM 242712]
S4 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users.WINDOWS\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [8/14/2013 11:10 AM 3291008]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/21/2013 9:53 AM 162408]
S4 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [1/21/2010 4:24 PM 110592]
S4 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [6/16/2009 8:58 AM 20480]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 17:49]
.
2013-09-02 c:\windows\Tasks\BrowserProtect.job
- c:\windows\system32\sc.exe [2008-04-14 10:39]
.
2013-08-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500Core.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-10-07 05:37]
.
2013-08-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500UA.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-10-07 05:37]
.
2013-08-31 c:\windows\Tasks\GoforFilesUpdate.job
- c:\program files\GoforFiles\GFFUpdater.exe [2013-03-17 15:14]
.
2013-01-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-23 13:38]
.
2013-09-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1004336348-725345543-1417001333-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 12:51]
.
2013-08-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1004336348-725345543-1417001333-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 12:51]
.
2013-09-01 c:\windows\Tasks\ReclaimerUpdateFiles_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
2013-09-02 c:\windows\Tasks\ReclaimerUpdateXML_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
2013-09-02 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://websearch.searchesplace.info/?pid=821&r=2013/08/03&hid=2331904817&lg=EN&cc=IN&unqvl=30
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: essar.com\myequations
Trusted Zone: google.co.in\www
Trusted Zone: google.com\www
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\wlkaqe49.default-1378057855546\
FF - ExtSQL: 2013-08-27 00:25; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\MOZILLA FIREFOX\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
ShellIconOverlayIdentifiers-{CDC95B92-E27C-4745-A8C5-64A52A78855D} - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-DefaultTab - c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab\DefaultTab\uninstalldt.exe
AddRemove-SP_8e303e95 - c:\program files\SaveShare\uninstall.exe
AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\program files\SAMSUNG\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\SAMSUNG\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-03 01:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-TIBCOBC]
"ImagePath "= "C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice \ "TIBCOAdmin-TIBCOBC\" "
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-TIBCOBC]
"ImagePath "= "C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice \ "TIBCOAdmin-TIBCOBC\" "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975} "=hex:51,66,7a,6c,4c,1d,3b,1b,1f,24,3f,
54,8d,39,16,0c,8f,fa,b7,9b,02,74,39,6a
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,75,08,60,7f,be,8a,e7,41,8b,06,e2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,67,1a,8e,c4,a9,a1,a5,42,86,6e,17,\
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings]
@Denied: (2) (Administrator)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk "=hex(0):9d,d3,f2,a9,16,2b,da,a0,c4,d7,c9,d7,66,eb,74,6b,c3,02,bb,e1,4f,
2f,6d,8a,f3,62,65,2a,b1,84,4b,4d,02,5e,0f,3c,be,59,25,cd,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{bd0c2305-441e-4985-a5bb-9c480a23078f}]
@Denied: (Full) (Everyone)
"Model "=dword:000000c6
"Therad "=dword:00000025
"MData "=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,02,74,03,43,ea,1f,06,fb,83,e0,8b,c5,07,bb,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(1820)
c:\windows\system32\psqlpwd.dll
c:\program files\Fingerprint Reader Suite\homefus2.dll
c:\program files\Fingerprint Reader Suite\infra.dll
.
- - - - - - - > 'explorer.exe'(3984)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mslbui.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\STacSV.exe
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe
c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
c:\windows\system32\RunDLL32.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
.
**************************************************************************
.
Completion time: 2013-09-03 01:08:30 - machine was rebooted
ComboFix-quarantined-files.txt 2013-09-02 19:38
.
Pre-Run: 2,813,186,048 bytes free
Post-Run: 3,448,885,248 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect
c:\$win_nt$.~bt\BOOTSECT.DAT= "Microsoft Windows XP Professional Setup "
.
- - End Of File - - 13395A608BFF0DAA59ECCCC43BF68C4B
8F558EB6672622401DA993E1E865C861

 

DONE!!!!!
ComboFix 13-09-02.02 - Administrator 09/03/2013 8:38.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2114 [GMT 5.5:30]
Running from: c:\documents and settings\Administrator.ADMINISTRATOR\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator.ADMINISTRATOR\Desktop\CFScript.txt
AV: Avira AntiVir PersonalEdition *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
FILE ::
"c:\documents and settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\MyPC Backup.lnk "
"c:\windows\system32\drivers\jfcxhg.sys "
"c:\windows\Tasks\BrowserProtect.job "
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\SearchProtect
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\1378037722.reg
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\eng_rcp.dat
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\ExcludeList.rcp
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\log_09-01-2013.log
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000001.rmx
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000001.rxb
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\RCPscanlog.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\results.rcp
c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Systweak\RegClean Pro\Version 6.1\TempHLList.rcp
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_6_325_CT3255406_Images_634865922899792583_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_6_325_CT3255406_images_634865923226984272_24PX_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_6_325_CT3255406_Skins_634865921557431652_28px_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_bankimages_commandcomps_block_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_About_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Browse_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Contact_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_More_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privacy_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Refresh_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Upgrade_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_eula_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_Menu_uninstall-icon_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_SearchEngines_tfd_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_images_SearchEngines_video_gif.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_MarketPlace_1a_2dc_1af6a81c-86ff-4937-bd94-7bdb646af2dc_Appearance_634473642776763064_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_MarketPlace_71_92f_71422c68-106e-4efa-a402-2c5d0c3ab92f_Appearance_634374241008412502_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_MarketPlace_78_f1b_789d74ff-86a2-4fb9-9903-16e7b2641f1b_Appearance_634825030599553405_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\CacheIcons\http___storage_conduit_com_MarketPlace_93_ce3_93951332-f9a7-4af7-af02-17ec3d749ce3_Appearance_634159521796627506_24x24_png.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\AddedAppDialog\app-added.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\AddedAppDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\DefualtImages\icon.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\DetectedAppDialog\app-2go.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\DetectedAppDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\DialogsAPI.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\EngineFirstTimeDialog\EngineFirstTimeDialog.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\EngineFirstTimeDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\EngineFirstTimeDialog\right-click.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\excanvas.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\generalDialogStyle.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\images\ok-button.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\images\separation-line.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\images\warning.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\SearchProtector.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\NewSearchProtectorDialog\SearchProtector.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\PIE.htc
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\RoundedCorners.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\RoundedCornersIE9.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\bubble.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\bubble.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\images\information.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\images\x-default-LTR.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\images\x-default-RTL.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-LTR.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-RTL.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorBubbleDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\Images\info.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\Images\ok-on.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\Images\ok.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\SearchProtector.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorDialog\SearchProtector.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\Images\Icon.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\Images\info.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\Images\ok-on.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\Images\ok.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\settings.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\app-store-icon.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\arrow.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\divider.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\emailNotifier.gif
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\facebook.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\radio.GIF
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\truste_welcome.GIF
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\images\weather.GIF
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.css
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarUntrustedAppsApprovalDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\ToolbarUntrustedAppsApprovalDialog\ToolbarUntrustedAppsApprovalDialog.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAddedAppDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAddedAppDialog\UT-app-dialog-added.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAppApprovalDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAppApprovalDialog\UT-app-dialog-needs-your-approval.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAppPendingDialog\main.html
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\UntrustedAppPendingDialog\UT-app-dialog-is-waiting.js
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Dialogs\version.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=en&ctid=CT3298573.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=en&ctid=CT3298573.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=en&ctid=CT3298573.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en&ctid=CT3298573.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\hk64tbMixi.dll
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\hktbMixi.dll
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ldrtbMixi.dll
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGong_16.png
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\manifest.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\AppsMetaData\data.bck.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\AppsMetaData\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\DynamicDialogs\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarHiddenLogin\data.bck.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarHiddenLogin\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarHiddenSettings\data.bck.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarHiddenSettings\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarLogin\data.bck.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarLogin\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarSettings\data.bck.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_CT3298573\ToolbarSettings\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\Repository\conduit_CT3298573_en\ToolbarTranslation\data.txt
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\tbMixi.dll
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\ThirdPartyComponents.xml
c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\MixiDJ_V37\toolbar.cfg
c:\program files\MixiDJ_V37
c:\program files\MixiDJ_V37\GottenAppsContextMenu.xml
c:\program files\MixiDJ_V37\hk64tbMixi.dll
c:\program files\MixiDJ_V37\hktbMixi.dll
c:\program files\MixiDJ_V37\ldrtbMixi.dll
c:\program files\MixiDJ_V37\MixiDJ_V37ToolbarHelper.exe
c:\program files\MixiDJ_V37\OtherAppsContextMenu.xml
c:\program files\MixiDJ_V37\prxtbMixi.dll
c:\program files\MixiDJ_V37\SharedAppsContextMenu.xml
c:\program files\MixiDJ_V37\tbMixi.dll
c:\program files\MixiDJ_V37\toolbar.cfg
c:\program files\MixiDJ_V37\ToolbarContextMenu.xml
c:\program files\MixiDJ_V37\uninstall.exe
c:\program files\MyPC Backup
c:\program files\MyPC Backup\aff.conf
c:\program files\MyPC Backup\AlphaVSS.51.x86.dll
c:\program files\MyPC Backup\AlphaVSS.52.x64.dll
c:\program files\MyPC Backup\AlphaVSS.52.x86.dll
c:\program files\MyPC Backup\AlphaVSS.60.x64.dll
c:\program files\MyPC Backup\AlphaVSS.60.x86.dll
c:\program files\MyPC Backup\AlphaVSS.Common.dll
c:\program files\MyPC Backup\AWSSDK.dll
c:\program files\MyPC Backup\BackupStack.exe
c:\program files\MyPC Backup\Configuration Updater.exe
c:\program files\MyPC Backup\Crypto32.dll
c:\program files\MyPC Backup\Crypto64.dll
c:\program files\MyPC Backup\Database\mpcb_backup_conf.db
c:\program files\MyPC Backup\Database\mpcb_file_cache.db
c:\program files\MyPC Backup\Database\mpcb_queues.db
c:\program files\MyPC Backup\Database\mpcb_settings.db
c:\program files\MyPC Backup\Database\mpcb_sig_cache.db
c:\program files\MyPC Backup\de_DE.mo
c:\program files\MyPC Backup\diffstack.dll
c:\program files\MyPC Backup\es_ES.mo
c:\program files\MyPC Backup\fr_FR.mo
c:\program files\MyPC Backup\GetText.dll
c:\program files\MyPC Backup\it_IT.mo
c:\program files\MyPC Backup\LogicNP.EZShellExtensions.dll
c:\program files\MyPC Backup\MPCBClient.dll
c:\program files\MyPC Backup\MPCBContextMenu.dll
c:\program files\MyPC Backup\MPCBIconOverlays.dll
c:\program files\MyPC Backup\MyPC Backup.exe
c:\program files\MyPC Backup\mypcbackup.ico
c:\program files\MyPC Backup\pt_PT.mo
c:\program files\MyPC Backup\RegisterExtensionDotNet20_x64.exe
c:\program files\MyPC Backup\RegisterExtensionDotNet20_x86.exe
c:\program files\MyPC Backup\RestartExplorer.exe
c:\program files\MyPC Backup\Service Start.exe
c:\program files\MyPC Backup\Shared Stack.dll
c:\program files\MyPC Backup\Signup Wizard.exe
c:\program files\MyPC Backup\syncicon.ico
c:\program files\MyPC Backup\syncing.ico
c:\program files\MyPC Backup\tick.ico
c:\program files\MyPC Backup\uninst.exe
c:\program files\MyPC Backup\UnRegisterExtensions.exe
c:\program files\MyPC Backup\Updater.exe
c:\program files\MyPC Backup\x64\System.Data.SQLite.dll
c:\program files\MyPC Backup\x86\System.Data.SQLite.dll
c:\program files\SearchProtect
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_BackupStack
-------\Legacy_BackupStack
-------\Service_BackupStack
-------\Service_BackupStack
.
.
((((((((((((((((((((((((( Files Created from 2013-08-03 to 2013-09-03 )))))))))))))))))))))))))))))))
.
.
2013-09-03 03:17 . 2013-09-03 03:17 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-09-02 04:01 . 2013-09-02 05:44 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-01 12:07 . 2013-09-01 12:07 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Amazon Browser Bar
2013-09-01 12:06 . 2013-09-01 12:07 -------- d-----w- c:\program files\Amazon Browser Bar
2013-09-01 11:45 . 2013-09-01 11:45 54016 ----a-w- c:\windows\system32\drivers\jfcxhg.sys
2013-08-31 03:46 . 2007-05-10 04:53 94208 ----a-w- c:\windows\system32\stacsv.exe
2013-08-31 03:46 . 2007-05-10 04:53 4952064 ----a-w- c:\windows\system32\stacgui.cpl
2013-08-31 03:46 . 2007-05-10 04:52 405504 ----a-w- c:\windows\stsystra.exe
2013-08-31 03:46 . 2007-04-10 11:32 1601536 ----a-w- c:\windows\system32\stlang.dll
2013-08-31 03:45 . 2007-05-10 04:53 270336 ----a-w- c:\windows\system32\stacapi.dll
2013-08-31 02:55 . 2013-08-31 02:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-08-31 02:55 . 2013-04-04 09:20 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-28 06:47 . 2007-02-19 08:56 142848 ------w- c:\windows\system32\staco.dll
2013-08-28 06:40 . 2013-08-28 06:40 -------- d-----w- c:\program files\SigmaTel
2013-08-28 06:40 . 2007-08-21 04:28 146944 ----a-w- c:\windows\system32\st325602.dll
2013-08-28 06:40 . 2007-05-10 04:54 1222840 ----a-w- c:\windows\system32\drivers\sthda.sys
2013-08-27 04:58 . 2013-08-27 04:58 -------- d-----w- c:\documents and settings\fbwuser
2013-08-27 04:57 . 2013-08-27 04:57 -------- d-----w- c:\program files\CPUID
2013-08-27 04:56 . 2013-08-27 04:56 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Qtrax
2013-08-26 13:13 . 2013-08-26 13:13 -------- d-----w- c:\windows\system32\SRSLabs
2013-08-26 13:06 . 2013-08-26 13:06 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Innovative Solutions
2013-08-26 13:06 . 2013-08-26 13:06 -------- d-----w- c:\program files\Innovative Solutions
2013-08-26 13:04 . 2013-08-26 15:59 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-08-26 13:04 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-09-01 17:50 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-08-26 13:04 . 2013-08-26 13:04 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG SafeGuard toolbar
2013-08-26 13:04 . 2013-09-01 17:50 -------- d-----w- c:\program files\AVG SafeGuard toolbar
2013-08-25 07:57 . 2004-07-15 18:50 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2013-08-25 07:57 . 2004-07-15 18:49 266240 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2013-08-25 07:57 . 2004-07-15 18:48 172032 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2013-08-25 07:57 . 2004-07-15 18:48 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2013-08-25 07:57 . 2013-08-25 07:57 303104 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2013-08-25 07:57 . 2013-08-25 07:57 180356 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2013-08-25 07:57 . 2004-07-15 18:50 733184 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2013-08-25 07:52 . 2013-08-25 07:52 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Wajam
2013-08-25 07:52 . 2013-08-25 07:52 -------- d--h--w- c:\windows\system32\GroupPolicy
2013-08-25 07:52 . 2013-09-02 19:27 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\DefaultTab
2013-08-09 19:39 . 2013-08-09 19:39 -------- d-----w- c:\documents and settings\NetworkService.NT AUTHORITY\Application Data\TuneUp Software
2013-08-06 18:56 . 2013-01-31 09:35 29984 ----a-w- c:\windows\system32\uxtuneup.dll
2013-08-05 19:28 . 2013-07-26 02:47 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-08-04 17:56 . 2013-08-27 03:18 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-08-04 12:23 . 2013-08-04 12:23 -------- d-----w- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Malwarebytes
2013-08-04 12:21 . 2013-08-04 12:21 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-31 17:49 . 2012-07-27 05:33 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-31 17:49 . 2012-02-09 10:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-03 08:48 . 2006-10-18 16:17 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-26 02:47 . 2008-04-14 11:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:47 . 2008-04-14 11:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:47 . 2008-04-14 11:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 11:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-24 12:24 . 2013-07-24 12:24 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-24 12:24 . 2012-09-09 12:40 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-24 12:24 . 2010-05-27 16:55 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-24 12:24 . 2010-05-27 16:55 144896 ----a-w- c:\windows\system32\javacpl.cpl
2013-07-10 10:37 . 2008-04-14 11:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 03:03 . 2008-04-14 11:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08 . 2008-04-14 00:01 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-01-16 21:42 . 2009-09-29 04:08 1784424 -c--a-w- c:\program files\DSFP-3.21.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-10-09 . EC7A575CAECA0895B31F75DDBCF325BC . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{e9e8eb35-ff77-455d-b677-91e5e4fc06c2}]
2009-11-06 19:37 297808 ----a-w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@= "{F2F31467-B1AC-4df0-AE79-FD5FA085E22B} "
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-16 17:43 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@= "{A3E208F7-0E3A-4182-A7A6-B169D5D691AA} "
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-16 17:43 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-08-23 39408]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-05-15 4760816]
"BitTorrent "= "c:\program files\BitTorrent\BitTorrent.exe" [2013-05-28 882520]
"DriverMax "= "c:\program files\Innovative Solutions\DriverMax\drivermax.exe" [2013-08-12 7292416]
"DriverMax_RESTART "= "c:\program files\Innovative Solutions\DriverMax\drivermax.exe" [2013-08-12 7292416]
"QtraxNotification "= "c:\documents and settings\Administrator.ADMINISTRATOR\Qtrax\Player\Notification.exe" [2013-08-27 116008]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Iusage "= "c:\program files\Internet Usage Monitor Lite Edition\netdet.exe" [2004-03-15 28672]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"PSQLLauncher "= "c:\program files\Fingerprint Reader Suite\launcher.exe" [2007-04-16 49168]
"OEM02Mon.exe "= "c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"NvMediaCenter "= "NvMCTray.dll" [2007-08-17 81920]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-08-17 8478720]
"IntelZeroConfig "= "c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-16 1368064]
"IntelWireless "= "c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-16 1191936]
"GrooveMonitor "= "c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"avgnt "= "c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"TkBellExe "= "c:\program files\real\realplayer\update\realsched.exe" [2012-06-01 296056]
"vProt "= "c:\program files\AVG SafeGuard toolbar\vprot.exe" [2013-09-01 2314416]
"SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3 "= "advpack.dll" [2009-03-07 128512]
.
c:\documents and settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\
MyPC Backup.lnk - c:\qoobox\Quarantine\C\Program Files\MyPC Backup\MyPC Backup.exe.vir [2013-7-1 1945128]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe "-user_logon" [2011-9-29 1524776]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe "=c:\windows\system32\ctfmon.exe
"Facebook Update "= "c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"BitTorrent "= "c:\program files\BitTorrent\BitTorrent.exe" /MINIMIZED
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
"Google Update "= "c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" /background
"SUPERAntiSpyware "=c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"MotiveReportAgent "= "c:\program files\Common Files\Motive\McciBootStrapper.exe" /url= "-APPKEY=Motive -WindowContext=ReportAgent -url=file://c:\program files\Common Files\Motive\ReportAgent.html" /browsertype=CustomMSIE /browserpath= "c:\program files\Common Files\Motive\MotiveBrowser.exe" /hidden
"TkBellExe "= "c:\program files\real\realplayer\update\realsched.exe" -osboot
"WD Button Manager "=WDBtnMgr.exe
"WD Spindown Utility "= "c:\program files\Western Digital Technologies\Spindown\ExSpinDn.exe "
"PMBVolumeWatcher "=c:\program files\Sony\PlayMemories Home\PMBVolumeWatcher.exe
"Iusage "=c:\program files\Internet Usage Monitor Lite Edition\netdet.exe
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe "
"ApnTBMon "= "c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe "
"SynTPEnh "=c:\program files\Synaptics\SynTP\SynTPEnh.exe
"WordWeb "= "c:\program files\WordWeb\wweb32.exe" -startup
"SweetIM "=c:\program files\SweetIM\Messenger\SweetIM.exe
"SigmatelSysTrayApp "=stsystra.exe
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\SmartVoip.com\\SmartVoip\\SmartVoip.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe "=
"c:\\Program Files\\Windows iLivid Toolbar\\ToolBar\\dtUser.exe "=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe "=
"c:\\WINDOWS\\system32\\muzapp.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Desktop\\Uday\\SweetImSetup_1.exe "=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe "=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer.exe "=
"c:\\Program Files\\TeamViewer\\Version7\\TeamViewer_Service.exe "=
"c:\\Documents and Settings\\Administrator.ADMINISTRATOR\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe "=
"c:\\Program Files\\GoforFiles\\goforfilesdl.exe "=
"c:\\Program Files\\GoforFiles\\GoforFiles.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
.
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [8/26/2013 6:34 PM 37664]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 9:57 PM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/13/2011 3:25 AM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [5/24/2013 1:41 AM 119056]
R2 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe [7/10/2008 1:22 AM 218136]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe [1/31/2013 3:05 PM 1724192]
R2 Updater Service for AMZN;Updater Service for AMZN;c:\program files\Amazon Browser Bar\ToolbarUpdaterService.exe [3/21/2013 11:54 PM 222368]
R2 vToolbarUpdater15.5.0;vToolbarUpdater15.5.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe [9/1/2013 11:20 PM 1643184]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [10/4/2012 6:07 PM 63616]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys [8/29/2012 4:42 PM 10088]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [8/31/2013 8:25 AM 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [8/31/2013 8:25 AM 701512]
S2 TIBCOAdmin-TIBCOBC;TIBCO Administrator 5.6 (TIBCOBC);C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice "TIBCOAdmin-TIBCOBC" --> C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice TIBCOAdmin-TIBCOBC [?]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [11/4/2011 8:30 AM 30312]
S3 cpuz136;cpuz136;\??\c:\docume~1\ADMINI~1.ADM\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys --> c:\docume~1\ADMINI~1.ADM\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [10/4/2012 6:07 PM 101504]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/31/2013 8:25 AM 22856]
S3 rvd;TIB/Rendezvous Communications Daemon;c:\windows\rvntsctl.exe "rvd" --> c:\windows\rvntsctl.exe rvd [?]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [11/4/2011 8:30 AM 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [11/4/2011 8:30 AM 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [11/4/2011 8:30 AM 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [11/4/2011 8:30 AM 114280]
S3 tibemsd;TIBCO EMS Server;c:\windows\emsntsct.exe "tibemsd" --> c:\windows\emsntsct.exe tibemsd [?]
S3 tibemsmcd;TIBCO EMS Multicast Daemon;c:\windows\emsntsct.exe "tibemsmcd" --> c:\windows\emsntsct.exe tibemsmcd [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/6/2008 4:06 PM 11520]
S3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2/10/2011 9:48 PM 104704]
S4 APNMCP;Ask Update Service;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [8/6/2013 5:00 AM 164816]
S4 ICM_UpdaterService;ICM_UpdaterService Disp;c:\program files\Samsung\Samsung Networking Wizard\ICM_Service.exe [3/18/2011 7:06 PM 204883]
S4 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe [7/10/2008 1:15 AM 31256]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/10/2008 8:19 AM 47128]
S4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [11/25/2011 3:21 PM 459832]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [7/10/2008 2:49 AM 242712]
S4 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users.WINDOWS\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [8/14/2013 11:10 AM 3291008]
S4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/21/2013 9:53 AM 162408]
S4 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [1/21/2010 4:24 PM 110592]
S4 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [6/16/2009 8:58 AM 20480]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 17:49]
.
2013-09-03 c:\windows\Tasks\BrowserProtect.job
- c:\windows\system32\sc.exe [2008-04-14 10:39]
.
2013-08-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500Core.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-10-07 05:37]
.
2013-08-31 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500UA.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-10-07 05:37]
.
2013-08-31 c:\windows\Tasks\GoforFilesUpdate.job
- c:\program files\GoforFiles\GFFUpdater.exe [2013-03-17 15:14]
.
2013-01-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-08-23 13:38]
.
2013-09-03 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1004336348-725345543-1417001333-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 12:51]
.
2013-08-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1004336348-725345543-1417001333-500.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 12:51]
.
2013-09-01 c:\windows\Tasks\ReclaimerUpdateFiles_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
2013-09-02 c:\windows\Tasks\ReclaimerUpdateXML_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
2013-09-03 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job
- c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-08-30 07:51]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = hxxp://websearch.searchesplace.info/?pid=821&r=2013/08/03&hid=2331904817&lg=EN&cc=IN&unqvl=30
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: essar.com\myequations
Trusted Zone: google.co.in\www
Trusted Zone: google.com\www
TCP: Interfaces\{E38FDDC8-D46A-4C5E-97CB-6FBE7AC04828}: NameServer = 103.8.46.5 103.8.45.5
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\wlkaqe49.default-1378057855546\
FF - ExtSQL: 2013-08-27 00:25; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\MOZILLA FIREFOX\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-MixiDJ_V37 Toolbar - c:\program files\MixiDJ_V37\uninstall.exe
AddRemove-MyPC Backup - c:\program files\MyPC Backup\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-03 08:46
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-TIBCOBC]
"ImagePath "= "C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice \ "TIBCOAdmin-TIBCOBC\" "
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TIBCOAdmin-TIBCOBC]
"ImagePath "= "C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe --ntservice \ "TIBCOAdmin-TIBCOBC\" "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975} "=hex:51,66,7a,6c,4c,1d,3b,1b,1f,24,3f,
54,8d,39,16,0c,8f,fa,b7,9b,02,74,39,6a
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,75,08,60,7f,be,8a,e7,41,8b,06,e2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,67,1a,8e,c4,a9,a1,a5,42,86,6e,17,\
.
[HKEY_USERS\S-1-5-21-1004336348-725345543-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings]
@Denied: (2) (Administrator)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk "=hex(0):9d,d3,f2,a9,16,2b,da,a0,c4,d7,c9,d7,66,eb,74,6b,c3,02,bb,e1,4f,
2f,6d,8a,f3,62,65,2a,b1,84,4b,4d,02,5e,0f,3c,be,59,25,cd,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{bd0c2305-441e-4985-a5bb-9c480a23078f}]
@Denied: (Full) (Everyone)
"Model "=dword:000000c6
"Therad "=dword:00000025
"MData "=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,02,74,03,43,ea,1f,06,fb,83,e0,8b,c5,07,bb,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(1852)
c:\windows\system32\psqlpwd.dll
c:\program files\Fingerprint Reader Suite\homefus2.dll
c:\program files\Fingerprint Reader Suite\infra.dll
.
- - - - - - - > 'explorer.exe'(668)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\dfshim.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\STacSV.exe
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe
c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
c:\program files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
c:\windows\system32\RunDLL32.exe
c:\program files\Microsoft Office\Office12\ONENOTEM.EXE
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Tata Photon+\Huawei\Tata Photon+.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2013-09-03 08:51:32 - machine was rebooted
ComboFix-quarantined-files.txt 2013-09-03 03:21
ComboFix2.txt 2013-09-02 19:38
.
Pre-Run: 7,015,817,216 bytes free
Post-Run: 6,828,347,392 bytes free
.
- - End Of File - - 7B583BBB4B86257A3A848508A836CC0C
8F558EB6672622401DA993E1E865C861

 

# AdwCleaner v3.002 - Report created 03/09/2013 at 09:34:02
# Updated 01/09/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Administrator - UDAY
# Running from : C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Sound Issue\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : Updater Service for AMZN

***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\BrowserProtect
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\SoftSafe
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\StarApp
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\SweetIM
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\PC Performer
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\RegClean Pro
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Speedbit Video Downloader
Folder Deleted : C:\Program Files\Amazon Browser Bar
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\delta
Folder Deleted : C:\Program Files\file scout
Folder Deleted : C:\Program Files\Speedbit Video Downloader
Folder Deleted : C:\Program Files\SweetIM
Folder Deleted : C:\Program Files\WebSearch
Folder Deleted : C:\Program Files\Windows iLivid Toolbar
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
File Deleted : C:\END
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\Babylon.xml
File Deleted : C:\WINDOWS\Tasks\BrowserProtect.job

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eiimolhnbbbdagljikeckdkldgemmmlj
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DealPly
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [qtraxnotification]
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB
Key Deleted : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX
Key Deleted : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\SBConvert.SBConvert
Key Deleted : HKLM\SOFTWARE\Classes\SBConvert.SBConvert.3
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\sim-packages
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_48c708f2
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_b0285714
Key Deleted : HKCU\Software\5ded98be53de817
Key Deleted : HKLM\SOFTWARE\5ded98be53de817
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C84BABA-BF9D-4E42-A684-5288580631D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0923E315-2D8B-48CE-A37C-AE9A42F9711C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A1BBE49-C6F1-40EA-9D2F-262F0AF6DDE3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2022154E-7E3E-4809-871E-1B45A6FC7058}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{292ECB89-350E-45D2-816F-52C15305B144}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{36CC2180-B6BF-4951-9578-6B0C40044AAA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44A36944-22C6-4A08-BC7C-161F3E540DBF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{51F04BD6-3888-4849-864C-617FAE709CE0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6247DD2C-8CF9-4041-A235-93691D71B8B4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{835BED79-DF7E-4096-B355-ED43FA2EA87B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C953EC4-8CFA-44FB-B32E-1249E5505091}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E863BD6-50DE-47D0-A6F1-3C1F6DB72451}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9DD36F1E-5111-41C5-ADED-A2A11A2FF3E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A2FB8217-E320-434E-BA79-513E357AD54F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A9CEBBF4-9129-479A-9231-E833ED3D3A8F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AFD4D1F9-167C-4884-95AE-B5A9797B0D16}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B3EAD50C-ECB0-459A-9EDA-F505AB99675B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C47788B1-9604-4D7A-A684-F4D450F2D7D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA3B41D0-D4C1-4808-B248-75DA27238828}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D4A2FF6C-087F-4D40-8DFE-92AAD484BFB8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D88B9D5C-A9CF-4C69-906D-1CCA5D85A2EF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E4E394E0-D331-431F-B76D-E3A19193D5F6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F83AF01C-AA2F-469F-8BE7-D178FB15FD07}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF7C3CF0-4B15-11D1-ABED-709549C10000}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C84BABA-BF9D-4E42-A684-5288580631D2}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EA138CDE-95B6-4573-B8E1-F2D298160C8B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15E505E1-4716-4021-8A6B-09D72C915525}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8A96AF9E-4074-43B7-BEA3-87217BDA7406}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0329E7D6-6F54-462D-93F6-F5C3118BADF2}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0329E7D6-6F54-462D-93F6-F5C3118BADF2}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\Windows iLivid Toolbar\ToolBar\dtUser.exe]
Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Uday\SweetImSetup_1.exe]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\Default Tab
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\filescout
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\SBConvert
Key Deleted : HKCU\Software\SearchProtect
Key Deleted : HKCU\Software\searchqutoolbar
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\MixiDJ_V37
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\AppDataLow\Software\DefaultTab
Key Deleted : HKLM\Software\Amazon Browser Bar
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Default Tab
Key Deleted : HKLM\Software\DefaultTab
Key Deleted : HKLM\Software\Delta
Key Deleted : HKLM\Software\ImInstaller
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\Software\Wajam
Key Deleted : HKLM\Software\MixiDJ_V37
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A1194237-547A-461d-BD44-B97B1574A7DA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A81A974F-8A22-43E6-9243-5198FF758DA1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Browser Bar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SPEEDbit Video Downloader
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A1194237-547A-461d-BD44-B97B1574A7DA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A81A974F-8A22-43E6-9243-5198FF758DA1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Searchqu 406 MediaBar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SPEEDbit Video Downloader
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MixiDJ_V37 Toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v23.0.1 (en-US)

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [19002 octets] - [03/09/2013 09:25:49]
AdwCleaner[S0].txt - [19029 octets] - [03/09/2013 09:34:02]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19090 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.7 (09.01.2013:1)
OS: Microsoft Windows XP x86
Ran by Administrator on Tue 09/03/2013 at 9:52:11.81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\\bProtectTabs



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\qtrax
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\Qtrax
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\mypc backup
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2154E098-0B48-4B72-9A4B-44FC9CD7EC5F}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9A39E5F2-A529-4A59-9558-006A6E7272EB}



~~~ Files

Successfully deleted: [File] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\google\chrome\user data\default\bprotector web data "
Successfully deleted: [File] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\google\chrome\user data\default\bprotectorpreferences "



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users.WINDOWS\application data\apn "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\defaulttab "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\goforfiles "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\performersoft "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\searchquband "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\conduit "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\conduitengine "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\wajam "
Successfully deleted: [Folder] "C:\Program Files\goforfiles "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\start menu\programs\mypc backup "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\start menu\programs\wajam "
Successfully deleted: [Folder] "C:\Documents and Settings\Administrator.ADMINISTRATOR\qtrax "





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 09/03/2013 at 9:55:52.14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

OTL logfile created on: 9/3/2013 9:57:10 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Sound Issue
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.41 Gb Available Physical Memory | 80.34% Memory free
4.84 Gb Paging File | 4.26 Gb Available in Paging File | 88.03% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48.83 Gb Total Space | 6.26 Gb Free Space | 12.81% Space Free | Partition Type: NTFS
Drive D: | 48.83 Gb Total Space | 14.62 Gb Free Space | 29.94% Space Free | Partition Type: NTFS
Drive E: | 36.34 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 51.39 Gb Total Space | 3.58 Gb Free Space | 6.97% Space Free | Partition Type: NTFS

Computer Name: UDAY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/09/03 09:51:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Sound Issue\OTL.exe
PRC - [2013/05/24 01:41:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2013/01/31 15:05:52 | 001,926,944 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
PRC - [2013/01/31 15:05:50 | 001,724,192 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe
PRC - [2012/10/04 16:41:28 | 000,110,592 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\Tata Photon+.exe
PRC - [2012/06/01 21:25:50 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2010/08/10 12:43:33 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2010/08/10 12:43:32 | 000,151,297 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008/06/12 14:28:45 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008/04/14 16:30:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/10 10:23:50 | 000,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\system32\stacsv.exe
PRC - [2007/05/10 10:22:32 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
PRC - [2007/05/10 01:01:00 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\OEM02Mon.exe


========== Modules (No Company Name) ==========

MOD - [2013/08/06 12:26:00 | 011,497,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll
MOD - [2012/10/04 16:41:28 | 000,110,592 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\Tata Photon+.exe
MOD - [2012/10/04 16:41:24 | 000,155,648 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\SMSPlugin.dll
MOD - [2012/10/04 16:41:24 | 000,135,168 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\LocaleMgrPlugin.dll
MOD - [2012/10/04 16:41:24 | 000,098,304 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\NetInfoPlugin.dll
MOD - [2012/10/04 16:41:24 | 000,090,112 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\FileManager.dll
MOD - [2012/10/04 16:41:24 | 000,061,440 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\XCodec.dll
MOD - [2012/10/04 16:41:24 | 000,032,768 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\NotifyServicePlugin.dll
MOD - [2012/10/04 16:41:24 | 000,014,848 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\isaputrace.dll
MOD - [2012/10/04 16:41:23 | 000,528,384 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\atcomm.dll
MOD - [2012/10/04 16:41:23 | 000,159,744 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\DeviceMgrUIPlugin.dll
MOD - [2012/10/04 16:41:23 | 000,151,552 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\DetectDev.dll
MOD - [2012/10/04 16:41:23 | 000,102,400 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\DeviceMgrPlugin.dll
MOD - [2012/10/04 16:41:23 | 000,086,016 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\DialUpPlugin.dll
MOD - [2012/10/04 16:41:23 | 000,081,920 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\CallPlugin.dll
MOD - [2012/10/04 16:41:23 | 000,061,440 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\DeviceOperate.dll
MOD - [2012/10/04 16:41:23 | 000,057,344 | ---- | M] () -- C:\Program Files\Tata Photon+\Huawei\ConfigFilePlugin.dll
MOD - [2008/01/22 19:28:02 | 000,339,968 | ---- | M] () -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sqlite3.dll
MOD - [2007/08/21 13:32:44 | 000,098,304 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll
MOD - [2007/05/17 14:52:30 | 002,842,624 | ---- | M] () -- C:\WINDOWS\system32\btwicons.dll


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe -- (vToolbarUpdater15.5.0)
SRV - [2013/08/31 23:19:54 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/08/27 00:25:47 | 000,117,656 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/08/14 11:10:26 | 003,291,008 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2013/08/06 05:00:06 | 000,164,816 | ---- | M] (APN LLC.) [Disabled | Stopped] -- C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe -- (APNMCP)
SRV - [2013/07/24 17:54:12 | 000,182,184 | ---- | M] (Oracle Corporation) [Disabled | Stopped] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013/06/21 09:53:36 | 000,162,408 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/05/24 01:41:42 | 000,119,056 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/01/31 15:05:50 | 001,724,192 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2013/01/31 15:05:48 | 000,029,984 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011/11/25 15:21:44 | 000,459,832 | ---- | M] (Sony Corporation) [Disabled | Stopped] -- C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2011/03/18 19:06:54 | 000,204,883 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Samsung\Samsung Networking Wizard\ICM_Service.exe -- (ICM_UpdaterService)
SRV - [2010/12/08 14:31:06 | 000,628,736 | ---- | M] (Nokia) [Disabled | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/08/10 12:43:33 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2010/08/10 12:43:32 | 000,151,297 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2010/07/03 08:07:09 | 000,152,840 | ---- | M] () [Auto | Stopped] -- C:/tibco/administrator/domain/TIBCOBC/bin/tibcoadmin_TIBCOBC.exe -- (TIBCOAdmin-TIBCOBC)
SRV - [2010/03/30 03:21:43 | 000,066,824 | ---- | M] (TIBCO Software Inc) [On_Demand | Stopped] -- C:\WINDOWS\emsntsct.exe -- (tibemsmcd)
SRV - [2010/03/30 03:21:43 | 000,066,824 | ---- | M] (TIBCO Software Inc) [On_Demand | Stopped] -- C:\WINDOWS\emsntsct.exe -- (tibemsd)
SRV - [2010/01/21 16:24:08 | 000,110,592 | ---- | M] (WDC) [Disabled | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)
SRV - [2009/06/16 08:58:08 | 000,020,480 | ---- | M] (Memeo) [Disabled | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe -- (WDSmartWareBackgroundService)
SRV - [2008/10/16 17:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/10/16 17:15:58 | 000,348,160 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe -- (WLANKEEPER)
SRV - [2008/10/16 17:05:38 | 000,905,216 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\WiFi\bin\S24EvMon.exe -- (S24EventMonitor)
SRV - [2008/10/16 16:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/05/07 05:43:42 | 000,058,632 | R--- | M] () [On_Demand | Stopped] -- C:\WINDOWS\rvntsctl.exe -- (rvd)
SRV - [2007/05/10 10:23:50 | 000,094,208 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\WINDOWS\system32\stacsv.exe -- (STacSV)
SRV - [2005/11/04 10:21:28 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Disabled | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vmnetadapter.sys -- (VMnetAdapter)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\taphss.sys -- (taphss)
DRV - File not found [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\Drivers\SYMEVENT.SYS -- (SymEvent)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\HssDrv.sys -- (HssDrv)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\ADMINI~1.ADM\LOCALS~1\Temp\cpuz136\cpuz136_x32.sys -- (cpuz136)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2013/09/01 23:20:09 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/04/04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/29 16:42:28 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2011/07/22 21:57:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/13 03:25:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/06/02 11:17:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011/06/02 11:17:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssadbus.sys -- (ssadbus)
DRV - [2011/06/02 11:17:22 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssadserd.sys -- (ssadserd)
DRV - [2011/06/02 11:17:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV - [2010/12/21 11:25:02 | 000,123,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2010/12/21 11:25:02 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus)
DRV - [2010/12/21 11:25:02 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010/12/21 11:25:02 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2010/08/10 12:43:38 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/08/10 12:43:33 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2010/08/10 12:43:32 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2010/06/01 12:17:18 | 000,063,616 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV - [2010/06/01 12:17:12 | 000,105,728 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010/06/01 12:17:10 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2009/12/09 09:22:02 | 000,104,704 | ---- | M] (ZTEMT Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CT_ZTEMT_U_USBSER.sys -- (ztemtusbser)
DRV - [2009/02/13 11:02:52 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2008/11/17 07:23:16 | 003,636,864 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32)
DRV - [2008/08/26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/13 16:23:56 | 000,011,904 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2008/07/10 02:49:14 | 000,242,712 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RsFx0102.sys -- (RsFx0102)
DRV - [2008/04/14 16:30:00 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/05/10 10:24:34 | 001,222,840 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2007/05/10 01:01:00 | 000,235,584 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/03/31 13:02:42 | 000,876,384 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2007/03/31 13:02:40 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)
DRV - [2007/03/23 10:50:42 | 000,067,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2007/03/23 10:50:36 | 000,037,280 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2007/03/23 10:50:24 | 000,149,123 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2007/03/23 10:50:08 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2007/03/23 10:49:54 | 000,539,072 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2007/03/05 18:45:00 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007/03/01 10:34:22 | 000,028,352 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/02/13 22:59:04 | 000,019,345 | ---- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMPR5.sys -- (MREMPR5)
DRV - [2007/02/13 22:59:04 | 000,018,003 | ---- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRENDIS5.sys -- (MRENDIS5)
DRV - [2006/11/15 00:16:24 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/14 19:42:46 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/11/04 10:20:40 | 000,303,735 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2005/06/29 19:50:30 | 000,110,080 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2005/05/17 04:51:34 | 000,005,315 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2005/01/26 06:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2001/08/17 12:11:30 | 000,096,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKCU\..\SearchScopes,DefaultScope = {9A39E5F2-A529-4A59-9558-006A6E7272EB}
IE - HKCU\..\SearchScopes\{8541F7A4-0360-402F-A4F2-9376E8E271A2}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}&rlz=1I7GPCK_en
IE - HKCU\..\SearchScopes\{8A1EBE68-29D6-457D-AEB7-3FFA5E2D8A0C}: "URL" = http://in.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=867034&p={searchTerms}
IE - HKCU\..\SearchScopes\{AB79D3B4-AEDB-428a-B504-BAC00521A1C7}: "URL" = http://www.google-feed.net/results.php?q={searchTerms}&amp;cx=002904446094441487865%3Ate-nlsbrcdy&amp;cof=FORID%3A10&amp;ie=UTF-8&amp;said=&amp;do=search&amp;empty=0&amp;from=1&amp;CID=2&amp;PID=STV
IE - HKCU\..\SearchScopes\D362F3023F484BD3AB75975753CBF01E: "URL" = http://www.delta-search.com/?q={searchTerms}&affID=119293&babsrc=SP_ss&mntrId=687B001E4CE1DEED
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.17: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.17: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O1DPlugin: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\plugins\npo1d.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/01 21:26:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\ [2012/12/17 19:32:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ytfmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\ [2012/12/17 19:32:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\xzaoqcuqfm@yiuazyl-.org: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\8nkz9gap.default\extensions\xzaoqcuqfm@yiuazyl-.org
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ai_t@el-tgz.net: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\8nkz9gap.default\extensions\ai_t@el-tgz.net
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\8pp8gcdj@iueeu.com: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\8nkz9gap.default\extensions\8pp8gcdj@iueeu.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/08/27 00:25:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/27 00:25:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\search@helper: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Firefox\Profiles\\extensions\SearchHelper
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\IDM\idmmzcc3

[2011/05/06 23:17:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Mozilla\Extensions
[2013/08/27 10:28:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/08/27 00:25:39 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/08/27 10:45:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/08/27 00:25:38 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/08/27 00:25:48 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/06/01 21:25:58 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll

========== Chrome ==========

CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk\21.51433_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf\1.0.0_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dcillohgikpecbmgioknapdpcjofaafl\1.4_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh\1.0.0_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eiimolhnbbbdagljikeckdkldgemmmlj\1.0.0_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc\1.1.19_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.11.0.13348_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.4.0.5_0\
CHR - Extension: No name found = C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/09/03 08:46:20 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (SBCONVERT Class) - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [Iusage] C:\Program Files\Internet Usage Monitor Lite Edition\netdet.exe (Gaurav Creations)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\WINDOWS\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Fingerprint Reader Suite\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [BitTorrent] C:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent Inc.)
O4 - HKCU..\Run: [DriverMax] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [DriverMax_RESTART] C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\MyPC Backup.lnk = C:\Qoobox\Quarantine\C\Program Files\MyPC Backup\MyPC Backup.exe.vir (MyPCBackup.com)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKCU\..Trusted Domains: essar.com ([myequations] https in Trusted sites)
O15 - HKCU\..Trusted Domains: google.co.in ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: google.com ([www] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B37E5AB-AFC9-427A-BD4F-F9CC73CD1919}: DhcpNameServer = 192.168.42.129
O18 - Protocol\Handler\linkscanner - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/07 23:18:37 | 000,000,000 | -HS- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/11/19 18:37:38 | 000,142,336 | R--- | M] () - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2007/11/25 00:41:52 | 000,000,047 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2009/07/03 14:13:04 | 000,000,094 | R--- | M] () - E:\autorun.sh -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/03 09:52:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2013/09/03 09:25:38 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013/09/03 00:43:33 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2013/09/03 00:38:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2013/09/03 00:38:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2013/09/03 00:38:41 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2013/09/03 00:38:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2013/09/03 00:38:21 | 005,119,472 | R--- | C] (Swearware) -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\ComboFix.exe
[2013/09/03 00:36:44 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013/09/03 00:36:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2013/09/02 09:31:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes' Anti-Malware (portable)
[2013/09/02 09:23:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\mbar
[2013/09/02 08:48:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\RK_Quarantine
[2013/09/01 23:21:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Old Firefox Data
[2013/09/01 20:03:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Ace2Three
[2013/09/01 17:37:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Amazon Browser Bar
[2013/08/31 09:16:09 | 004,952,064 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\stacgui.cpl
[2013/08/31 09:16:09 | 001,601,536 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\stlang.dll
[2013/08/31 09:16:09 | 000,405,504 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
[2013/08/31 09:16:09 | 000,094,208 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\stacsv.exe
[2013/08/31 09:15:42 | 000,270,336 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\stacapi.dll
[2013/08/31 08:26:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Sound Issue
[2013/08/31 08:25:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/08/31 08:25:26 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/08/31 08:25:26 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/08/31 00:14:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Dell
[2013/08/28 12:17:23 | 000,142,848 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\staco.dll
[2013/08/28 12:10:53 | 001,222,840 | ---- | C] (SigmaTel, Inc.) -- C:\WINDOWS\System32\drivers\sthda.sys
[2013/08/28 12:10:53 | 000,146,944 | ---- | C] (IDT, Inc.) -- C:\WINDOWS\System32\st325602.dll
[2013/08/28 12:10:53 | 000,000,000 | ---D | C] -- C:\Program Files\SigmaTel
[2013/08/27 10:27:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\CPUID
[2013/08/27 10:27:21 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID
[2013/08/27 00:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/08/26 18:43:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SRSLabs
[2013/08/26 18:36:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\Innovative Solutions
[2013/08/26 18:36:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\DriverMax
[2013/08/26 18:36:56 | 000,000,000 | ---D | C] -- C:\Program Files\Innovative Solutions
[2013/08/26 18:34:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\AVG SafeGuard toolbar
[2013/08/26 18:34:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\AVG SafeGuard toolbar
[2013/08/26 18:34:40 | 000,037,664 | ---- | C] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/08/26 18:34:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVG SafeGuard toolbar
[2013/08/26 18:34:35 | 000,000,000 | ---D | C] -- C:\Program Files\AVG SafeGuard toolbar
[2013/08/25 13:22:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2013/08/19 15:06:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\New Folder
[2013/08/07 00:26:55 | 000,029,984 | ---- | C] (TuneUp Software) -- C:\WINDOWS\System32\uxtuneup.dll
[2013/08/06 00:58:10 | 000,522,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2013/08/04 23:26:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Mozilla
[2013/08/04 23:26:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013/08/04 17:53:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Malwarebytes
[2013/08/04 17:51:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
[2009/09/29 09:38:08 | 001,784,424 | ---- | C] (Igor Pavlov) -- C:\Program Files\DSFP-3.21.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/09/03 09:37:21 | 000,000,294 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1004336348-725345543-1417001333-500.job
[2013/09/03 09:36:42 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_Administrator.job
[2013/09/03 09:36:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/09/03 09:19:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/03 08:47:30 | 000,001,020 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/09/03 08:46:20 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/09/03 00:43:39 | 000,000,384 | RHS- | M] () -- C:\boot.ini
[2013/09/03 00:34:40 | 005,119,472 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\ComboFix.exe
[2013/09/02 21:41:02 | 000,000,462 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_Administrator.job
[2013/09/01 23:20:09 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/09/01 21:40:03 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_Administrator.job
[2013/09/01 20:03:08 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Ace2Three.lnk
[2013/09/01 17:38:12 | 000,000,762 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\MyPC Backup.lnk
[2013/09/01 17:15:44 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\jfcxhg.sys
[2013/08/31 23:19:54 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/08/31 23:19:54 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/08/31 08:25:28 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes Anti-Malware.lnk
[2013/08/31 08:12:26 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\GoforFilesUpdate.job
[2013/08/31 08:12:16 | 000,001,058 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500UA.job
[2013/08/31 08:12:16 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-725345543-1417001333-500Core.job
[2013/08/31 08:06:00 | 000,000,267 | ---- | M] () -- C:\Boot.bak
[2013/08/29 15:00:27 | 000,000,884 | RHS- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\ntuser.pol
[2013/08/27 15:57:15 | 000,000,302 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1004336348-725345543-1417001333-500.job
[2013/08/27 10:27:22 | 000,000,717 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\CPUID CPU-Z.lnk
[2013/08/27 10:26:28 | 000,001,993 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Qtrax Player.lnk
[2013/08/27 10:16:27 | 000,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013/08/27 00:48:10 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/08/26 18:36:59 | 000,000,887 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\DriverMax.lnk
[2013/08/26 18:16:05 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/08/15 13:47:50 | 000,503,614 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/08/15 13:47:50 | 000,093,536 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/08/13 16:16:24 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/08/12 19:35:59 | 001,542,283 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Baby Swing Manual.pdf
[2013/08/07 00:28:58 | 000,726,372 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Nemo.jpg
[2013/08/06 23:42:28 | 000,267,800 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/04 23:26:47 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/08/04 23:26:31 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/09/03 00:43:39 | 000,000,267 | ---- | C] () -- C:\Boot.bak
[2013/09/03 00:43:34 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2013/09/03 00:38:41 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2013/09/03 00:38:41 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2013/09/03 00:38:41 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2013/09/03 00:38:41 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2013/09/03 00:38:41 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2013/09/01 20:03:08 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Ace2Three.lnk
[2013/09/01 17:38:12 | 000,001,020 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\MyPC Backup.lnk
[2013/09/01 17:38:12 | 000,000,762 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\MyPC Backup.lnk
[2013/09/01 17:15:44 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\jfcxhg.sys
[2013/08/31 08:25:28 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Malwarebytes Anti-Malware.lnk
[2013/08/30 19:29:09 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_Administrator.job
[2013/08/30 19:24:24 | 000,000,466 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_Administrator.job
[2013/08/30 19:24:19 | 000,000,462 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_Administrator.job
[2013/08/27 10:27:22 | 000,000,717 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\CPUID CPU-Z.lnk
[2013/08/27 10:26:28 | 000,001,993 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Qtrax Player.lnk
[2013/08/26 18:36:59 | 000,000,887 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\DriverMax.lnk
[2013/08/25 13:22:40 | 000,000,884 | RHS- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\ntuser.pol
[2013/08/13 11:10:57 | 000,000,947 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2013/08/13 11:10:56 | 000,001,762 | -H-- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk
[2013/08/13 11:10:56 | 000,000,637 | -H-- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Bluetooth.lnk
[2013/08/12 19:35:59 | 001,542,283 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Baby Swing Manual.pdf
[2013/08/07 00:28:55 | 000,726,372 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Desktop\Nemo.jpg
[2013/08/06 11:43:14 | 000,001,917 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2013/08/04 23:26:30 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Mozilla Firefox.lnk
[2013/08/04 23:22:10 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2013/08/04 22:29:23 | 000,267,800 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/29 22:41:30 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2012/02/16 19:45:28 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/02 22:13:18 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2011/09/29 20:18:19 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2011/09/29 20:18:18 | 000,189,480 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2010/04/26 00:34:59 | 000,244,224 | ---- | C] () -- C:\Documents and Settings\Administrator.ADMINISTRATOR\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/15 15:07:49 | 000,000,016 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat

========== ZeroAccess Check ==========

[2010/07/02 14:16:30 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shdocvw.dll -- [2010/04/16 21:39:07 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/02/09 17:40:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2008/04/14 16:30:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >