Solved Slow computer, Adware, Spyware, popups

[Solved] Slow computer, Adware, Spyware, popups

made a new account on here, received a message i couldn't have 2 accounts so i had to enable my old account i made a thread the other day but i cant post in it cause only thread starters can post in it and this is a new account so here are my logs

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16545 BrowserJavaVersion: 10.45.2
Run by sixlove at 23:10:45 on 2014-04-16
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\MyPC Backup\BackupStack.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Mobogenie\MgAssist.exe
C:\Program Files\PCTechHotline\PCTechHotlineSvc.exe
C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe
C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
C:\Program Files\iolo\System Mechanic Professional\System Shield\ioloSSTray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Mobogenie\DaemonProcess.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
C:\Users\sixlove\AppData\Local\Super Backup Online Backup\SMessaging.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\YTDownloader\YTDownloader.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe
C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
C:\Program Files\Super Backup Online Backup\BackupAgent.exe
C:\Program Files\Hoopla\GPlayer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Users\sixlove\AppData\Local\Super Backup Online Backup\Super Backup\SuperBackupApp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\PCTechHotline\PCTechHotline.exe
C:\Program Files\PCTechHotline\PCTHHook.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\msiexec.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k WindowsMobile
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/
uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3071214
uURLSearchHooks: {b7c6e3b0-bb6a-4a3e-a1e5-a23b1ddd32ee} - <orphaned>
uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.8.130\McAfeeMSS_IE.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: WordExtra: {8BA97046-C600-4264-B367-5DEFD9FC505F} - c:\users\sixlove\appdata\roaming\wordextra\temp.dat
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [cdloader] "c:\users\sixlove\appdata\roaming\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [iCloudServices] c:\program files\common files\apple\internet services\iCloudServices.exe
uRun: [ApplePhotoStreams] c:\program files\common files\apple\internet services\ApplePhotoStreams.exe
uRun: [Driver Detective] c:\program files\pc drivers headquarters\driver detective\DriversHQ.DriverDetective.Client.exe /applicationMode:systemTray /showWelcome:false
uRun: [Driver Restore] c:\program files\driver restore\driver restore\DriverRestore.exe /applicationMode:systemTray /showWelcome:false
uRun: [BackupAgent] c:\program files\super backup online backup\BackupAgent.exe
uRun: [Exetender] "c:\program files\hoopla\GPlayer.exe" /runonstartup
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
mRun: [CCUTRAYICON] "c:\program files\intel\inteldh\ccu\CCU_TrayIcon.exe "
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
mRun: [WPCUMI] c:\windows\system32\WpcUmi.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [FileAgent] c:\program files\filecenter\main\FileAgent.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [SigmatelSysTrayApp] c:\program files\sigmatel\c-major audio\wdm\sttray.exe
mRun: [ApnTBMon] "c:\program files\askpartnernetwork\toolbar\updater\TBNotifier.exe "
mRun: [SMessaging] "c:\users\sixlove\appdata\local\super backup online backup\SMessaging.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [YTDownloader] "c:\program files\ytdownloader\YTDownloader.exe" /boot
mRun: [PCTechHotline] "c:\program files\pctechhotline\PCTechHotline.exe" /STARTUP
mRun: [mobilegeni daemon] c:\program files\mobogenie\DaemonProcess.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRunOnce: [ccube_Uninstall_Lock] "c:\programdata\ca\cacu_001.exe" /cleanup /RunOnce
mRunOnce: [Qurb {EBA5BE5C}] <no file>
dRun: [Exetender] "c:\program files\hoopla\GPlayer.exe" /runonstartup
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-001045-0002-0045-ABCDEFFEDCBC} - <orphaned>
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\windows\system32\iavlsp.dll
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 167.206.13.180 167.206.13.181
TCP: Interfaces\{6CC151F6-C8D3-4E5A-BB05-1495966C18CE} : DHCPNameServer = 167.206.13.180 167.206.13.181
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - <orphaned>
Notify: PFW - <no file>
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\sixlove\appdata\roaming\mozilla\firefox\profiles\td5n09eh.default\
FF - prefs.js: browser.search.selectedEngine - Conduit Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3323128&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPEEAE01FF-2049-402D-B7C9-92781BA27477&SSPV=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\hoopla\npExentCtl.dll
FF - plugin: c:\program files\hoopla\npGameTreatWidget.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee security scan\3.8.130\npMcAfeeMSS.dll
FF - plugin: c:\program files\televisionfanatic\bar\1.bin\NP64Stub.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_12_0_0_77.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2014-02-21 19:00; korey@markus.me; c:\users\sixlove\appdata\roaming\mozilla\firefox\profiles\td5n09eh.default\extensions\korey@markus.me
FF - ExtSQL: !HIDDEN! 2012-11-06 12:44; 64ffxtbr@TelevisionFanatic.com; c:\program files\televisionfanatic\bar\1.bin
FF - ExtSQL: !HIDDEN! 2014-02-22 23:54; korey@markus.me; c:\program files\mozilla firefox\browser\extensions\korey@markus.me
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? DHTRACE;Intel(R) DHTrace Controller
R? DQLWinService;DQLWinService
R? KmxAMRT;KmxAMRT
R? KmxCfg;KmxCfg
R? McComponentHostService;McAfee Security Scan Component Host Service
R? MCLServiceATL;Intel(R) Application Tracker
R? NMSCore;Intel(R) NMSCore
R? QualityManager;Intel(R) Quality Manager
R? Ser2rs;Radioshack USB to Serial Driver
R? vseqrts;vseqrts
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
S? AMD External Events Utility;AMD External Events Utility
S? AMP;Active Malware Protection Minifilter Driver
S? AMPSE;Active Malware Protection Support Driver
S? APNMCP;Ask Update Service
S? BackupStack;Computer Backup (MyPC Backup)
S? ElRawDisk;ElRawDisk
S? FontCache;Windows Font Cache Service
S? IntelDH;IntelDH Driver
S? ioloSystemService;iolo System Service
S? KmxAgent;KmxAgent
S? KmxCF;KmxCF
S? KmxFile;KmxFile
S? KmxFw;KmxFw
S? KmxSbx;KmxSbx
S? MBAMSwissArmy;MBAMSwissArmy
S? MgAssistService;MgAssist Service
S? nmsunidr;UniDriver for NMS
S? PCTechHotlineSvc;PCTechHotlineService
S? PDFsFilter;PDFsFilter
S? sbmntr;sbmntr
S? SMUpd;Search Module Update
S? SMUpdd;Search Module UpdateD
S? tStLib;tStLib
S? vseamps;vseamps
S? vsedsps;vsedsps
S? VST_DPV;VST_DPV
S? VSTHWBS2;VSTHWBS2
S? X6XSEx_Pr152;X6XSEx_Pr152
.
=============== File Associations ===============
.
FileExt: .vbe: VBEFile=NOTEPAD.EXE "%1 "
FileExt: .vbs: VBSFile=NOTEPAD.EXE "%1 "
FileExt: .js: JSFile=NOTEPAD.EXE "%1 "
FileExt: .jse: JSEFile=NOTEPAD.EXE "%1 "
FileExt: .wsf: WSFFile=NOTEPAD.EXE "%1 "
.
=============== Created Last 30 ================
.
2014-04-16 19:05:29 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-16 19:05:09 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-16 19:05:09 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-04-16 19:03:54 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-16 19:02:48 -------- d-----w- c:\programdata\Malwarebytes
2014-04-16 19:02:48 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-04-12 23:17:19 -------- d-----w- c:\users\sixlove\appdata\local\visi_coupon
2014-03-22 04:14:07 55232 ----a-w- c:\windows\system32\drivers\tStLib.sys
.
==================== Find3M ====================
.
2014-04-16 18:55:16 702 ----a-w- c:\windows\system32\ff.bin
2014-04-16 18:54:33 530 ----a-w- c:\windows\system32\schtasks.bin
2014-03-12 19:04:06 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-12 19:04:06 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 19:04:03 5777288 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2014-03-07 23:12:00 1806848 ----a-w- c:\windows\system32\jscript9.dll
2014-03-07 23:02:19 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2014-03-07 23:02:07 1129472 ----a-w- c:\windows\system32\wininet.dll
2014-03-07 22:57:17 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2014-03-07 22:56:03 421376 ----a-w- c:\windows\system32\vbscript.dll
2014-03-07 22:52:04 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2014-02-07 10:38:44 2050560 ----a-w- c:\windows\system32\win32k.sys
2014-02-03 10:37:54 505344 ----a-w- c:\windows\system32\qedit.dll
2014-01-30 07:46:58 876032 ----a-w- c:\windows\system32\wer.dll
2014-01-17 21:24:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2014-01-17 21:24:12 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
============= FINISH: 23:11:38.98 ===============

 

.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
Adobe Acrobat 4.0
Adobe AIR
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Common File Installer
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 12 ActiveX
Adobe Flash Player 12 Plugin
Adobe Help Viewer CS3
Adobe Media Player
Adobe PDF Library Files
Adobe Photoshop Elements 6.0
Adobe Premiere Elements 4.0
Adobe Premiere Elements 4.0 Templates
Adobe Reader XI (11.0.06)
Adobe Setup
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Soundbooth CS3 Scores
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
ATI Catalyst Control Center
AVSDK5
Bonjour
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help English
CCC Help French
CCC Help German
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Polish
CCC Help Portuguese
CCC Help Spanish
CCC Help Thai
CCC Help Turkish
Cisco Connect
Compatibility Pack for the 2007 Office system
Dell DataSafe Online
Dell Getting Started Guide
Digital Line Detect
Driver Detective
Driver Restore
FileCenter 8.0.0.23
Flash Player Pro V5.4
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
HiDef Media Player 1.1.12
Hoopla
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Photosmart Essential
HP Product Detection
HP Update
HP_Network_UserGuide
HPDiagnosticAlert
HPSSupply
iCloud
iMesh
Intel(R) PRO Network Connections 12.1.12.4
Intel(R) Viiv(TM) Software
iolo technologies' System Mechanic Professional
iPhone Configuration Utility
iTunes
Java 7 Update 45
Java Auto Updater
Java(TM) SE Runtime Environment 6
magicJack
Malwarebytes Anti-Malware version 2.0.1.1004
McAfee Security Scan Plus
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4.5.1
Microsoft Office XP Professional
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MobileMe Control Panel
Mobogenie
Mozilla Firefox 26.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music, Photos & Videos Launcher
My Dell
MyPC Backup
PC Tech Hotline
PDF-XChange 4
PDF-XChange Lite 4
Product Documentation Launcher
QuickTime 7
Roxio Activation Module
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator Premier
Roxio Creator Tools
Roxio EasyArchive
Roxio Express Labeler
Roxio MyDVD Premier
Roxio Update Manager
Safari
Search module
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Skins
Sonic CinePlayer Decoder Pack
Sprint Desktop Sync
Super Backup Online Backup
System Checkup 3.3
TouchCopy 09
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
User's Guides
WinZip 11.1
Wizard101
WordExtra
XPS MiniView Gadget
Yahoo! Toolbar
YTDownloader
.
==== End Of File ===========================

 

accidently ran a custom scan on the whole c drive the first time it found 202 results but the log shows up empty was instructed to complete another scan in this is the log of the 2nd

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/17/2014
Scan Time: 11:46:03 PM
Logfile: mbam 2.txt
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.16.10
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: sixlove

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 297518
Time Elapsed: 2 hr, 22 min, 11 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.PCFixSpeed, HKU\S-1-5-21-3249766445-722992797-2274620919-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\PCFixSpeed, Quarantined, [d33724072c4f38fe733ae3b2ba49c739],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Conduit.A, C:\Users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\prefs.js, Good: (), Bad: (user_pref( "browser.startup.homepage ", "http://search.conduit.com/?ctid=CT3323128&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPEEAE01FF-2049-402D-B7C9-92781BA27477&SSPV= "), Replaced,[7397b07bd0ab6fc7170d96bb63a1857b]

Physical Sectors: 0
(No malicious items detected)


(end)

 

ok installed avast and uninstalled all the programs you told me too

 

¤¤¤ Bad processes : 2 ¤¤¤
[SUSP PATH] SMessaging.exe -- C:\Users\sixlove\AppData\Local\Super Backup Online Backup\SMessaging.exe [7] -> KILLED [TermProc]
[SUSP PATH] SuperBackupApp.exe -- C:\Users\sixlove\AppData\Local\Super Backup Online Backup\Super Backup\SuperBackupApp.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 3 ¤¤¤
[RUN][SUSP PATH] HKLM\[...]\Run : SMessaging ( "C:\Users\sixlove\AppData\Local\Super Backup Online Backup\SMessaging.exe" [7]) -> DELETED
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 1 ¤¤¤
[sixlove][SUSP PATH] SuperBackupApp.lnk : C:\Users\sixlove\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SuperBackupApp.lnk @C:\Users\sixlove\AppData\Local\SUPERB~1\SUPERB~1\SUPERB~1.EXE [-][7] -> DELETED

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 3 ¤¤¤
[FF][PUP] td5n09eh.default : Yahoo Toolbar
[FF][PUP] td5n09eh.default : TelevisionFanatic
[FF][PUP] td5n09eh.default : Shopper-Pro

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤
-> D:\windows\system32\config\SYSTEM | DRVINFO [Drv - D:] | SYSTEMINFO [Sys - x:] [Sys32 - FOUND] | USERINFO [Startup - NOT_FOUND]
-> D:\windows\system32\config\SOFTWARE | DRVINFO [Drv - D:] | SYSTEMINFO [Sys - x:] [Sys32 - FOUND] | USERINFO [Startup - NOT_FOUND]
-> D:\windows\system32\config\SECURITY | DRVINFO [Drv - D:] | SYSTEMINFO [Sys - x:] [Sys32 - FOUND] | USERINFO [Startup - NOT_FOUND]
-> D:\Users\Default\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [Sys - x:] [Sys32 - FOUND] | USERINFO [Startup - NOT_FOUND]

¤¤¤ Infection : PUP ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost
::1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3320620AS ATA Device +++++
--- User ---
[MBR] b5b93b6bf125e297dea1eb0131ffb6e9
[BSP] bdf99326810b3ea5b3c85f61013cb3ba : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 112640 | Size: 15360 MB
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31569920 | Size: 289829 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_04182014_233245.txt >>
RKreport[0]_S_04182014_233026.txt

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2013.10.02.12

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
sixlove :: SIXLOVE-PC [administrator]

4/18/2014 11:35:53 PM
mbar-log-2014-04-18 (23-35-53).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 254328
Time elapsed: 9 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.992000 GHz
Memory total: 3486547968, free: 2255867904

Initializing...
======================
------------ Kernel report ------------
04/18/2014 23:35:49
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\intelide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\e1e6032.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\VSTBS23.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\VSTDPV3.SYS
\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\ohci1394.sys
\SystemRoot\system32\DRIVERS\1394BUS.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\System32\Drivers\IntelDH.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\stwrt.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\drivers\aswTdi.sys
\SystemRoot\system32\drivers\tStLib.sys
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\??\C:\Windows\system32\drivers\ElRawDsk.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\WinUSB.SYS
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\aswHwid.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\DRIVERS\nmsunidr.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\PROGRA~1\YTDOWN~1\sbmntr.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\drivers\tcpipreg.sys
\??\C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys
\??\C:\Windows\system32\TrueSight.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85be93f8
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xffffffff854c1b98
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85be93f8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8564cd18, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85be93f8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff854c1b98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 30000000

Partition information:

Partition 0 type is Other (0xde)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 112392

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 112640 Numsec = 31457280

Partition 2 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 31569920 Numsec = 593569792
Partition is not bootable

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-2-31569920-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

 

ComboFix 14-04-19.01 - sixlove 04/19/2014 18:59:39.1.2 - x86
Running from: c:\users\sixlove\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\FunWebProducts
c:\program files\TelevisionFanatic
c:\program files\TelevisionFanatic\bar\gen1\COMMON.T8S
c:\program files\TelevisionFanatic\bar\IE9Mesg\COMMON.T8S
c:\program files\TelevisionFanatic\bar\Message\COMMON.T8S
c:\program files\TelevisionFanatic\bar\Settings\s_pid.dat
c:\program files\TelevisionFanaticEI
c:\programdata\PCDr\6426\AddOnDownloaded\51fdf16e-ecb9-4fa4-8469-76fc9a22293b.dll
c:\programdata\PCDr\6426\AddOnDownloaded\57d7325c-8462-4866-a9ca-3f9228775fed.dll
c:\programdata\PCDr\6426\AddOnDownloaded\9a23b885-84bf-4844-bc8c-e1f4c568d95a.dll
c:\programdata\PCDr\6426\AddOnDownloaded\9a4d2a9e-ce47-421d-bbd6-98fd72255fed.dll
c:\programdata\PCDr\6426\AddOnDownloaded\b1cd2350-1a70-4fd2-9b75-98208aace99a.dll
c:\users\House\AppData\Local\Microsoft\Windows\Temporary Internet Files\373595da-77d1-4656-96d5-7141920fdfe9.jpg
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\bootstrap.js
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome.manifest
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\chrome\64ffxtbr.jar
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\install.rdf
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\manifest.mf
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.rsa
c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\64ffxtbr@TelevisionFanatic.com\META-INF\zigbert.sf
c:\users\sixlove\AppData\Roaming\WordExtra\teMP.dat
c:\users\sixlove\g2ax_customer_downloadhelper_win32_x86.exe
c:\users\sixlove\GoToAssistDownloadHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2014-03-19 to 2014-04-19 )))))))))))))))))))))))))))))))
.
.
2014-04-19 22:15 . 2014-04-19 23:00 -------- d-----w- c:\users\sixlove\AppData\Local\CrashDumps
2014-04-19 03:35 . 2014-04-19 03:50 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-04-18 18:37 . 2014-04-18 18:37 -------- d-----w- c:\users\sixlove\AppData\Roaming\AVAST Software
2014-04-18 18:36 . 2014-04-18 18:36 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2014-04-18 18:36 . 2014-04-18 18:36 776976 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-04-18 18:36 . 2014-04-18 18:36 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-04-18 18:36 . 2014-04-18 18:36 411552 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-04-18 18:36 . 2014-04-18 18:36 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-04-18 18:36 . 2014-04-18 18:36 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-04-18 18:36 . 2014-04-18 18:36 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-04-18 18:36 . 2014-04-18 18:36 54832 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2014-04-18 18:36 . 2014-04-18 18:36 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-04-18 18:36 . 2014-04-18 18:36 43152 ----a-w- c:\windows\avastSS.scr
2014-04-18 18:35 . 2014-04-18 18:35 -------- d-----w- c:\program files\AVAST Software
2014-04-18 18:34 . 2014-04-18 18:34 -------- d-----w- c:\programdata\AVAST Software
2014-04-16 19:05 . 2014-04-19 03:35 107224 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-16 19:05 . 2014-04-19 03:35 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-16 19:05 . 2014-04-03 13:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-04-16 19:03 . 2014-04-03 13:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-16 19:02 . 2014-04-16 19:05 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-04-16 19:02 . 2014-04-16 19:02 -------- d-----w- c:\programdata\Malwarebytes
2014-04-12 23:17 . 2014-04-12 23:17 -------- d-----w- c:\users\sixlove\AppData\Local\visi_coupon
2014-03-22 04:14 . 2014-03-22 04:14 55232 ----a-w- c:\windows\system32\drivers\tStLib.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 19:04 . 2012-05-04 22:50 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 19:04 . 2011-08-20 17:27 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-12 19:04 . 2014-02-20 23:04 5777288 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2014-02-07 10:38 . 2014-03-13 08:28 2050560 ----a-w- c:\windows\system32\win32k.sys
2014-02-03 10:37 . 2014-03-13 08:28 505344 ----a-w- c:\windows\system32\qedit.dll
2014-01-30 07:46 . 2014-03-13 08:28 876032 ----a-w- c:\windows\system32\wer.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} "= "c:\program files\Yahoo!\Companion\Installs\cpn2\yt.dll" [2014-02-11 1565464]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-18 18:36 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"cdloader "= "c:\users\sixlove\AppData\Roaming\mjusbsp\cdloader2.exe" [2011-08-23 50592]
"iCloudServices "= "c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-10-31 59720]
"ApplePhotoStreams "= "c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-10-31 59720]
"Driver Detective "= "c:\program files\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe" [2014-01-28 4678040]
"Driver Restore "= "c:\program files\Driver Restore\Driver Restore\DriverRestore.exe" [2013-09-19 3988856]
"BackupAgent "= "c:\program files\Super Backup Online Backup\BackupAgent.exe" [2013-12-13 814976]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-08-07 39408]
"WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON "= "c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 215256]
"AppleSyncNotifier "= "c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2012-02-23 59240]
"APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-06 43848]
"WPCUMI "= "c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"FileAgent "= "c:\program files\FileCenter\Main\FileAgent.exe" [2013-08-17 5766800]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-12 405504]
"ApnTBMon "= "c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-01-01 1778640]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"YTDownloader "= "c:\program files\YTDownloader\YTDownloader.exe" [2013-12-20 2049896]
"PCTechHotline "= "c:\program files\PCTechHotline\PCTechHotline.exe" [2014-02-13 1905000]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"AvastUI.exe "= "c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-04-18 3873704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0???,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0??,\0autocheck autochk *\0system.
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^Users^sixlove^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Sprint media monitor.lnk]
backup=c:\windows\pss\Sprint media monitor.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrazyForCricket_3k Browser Plugin Loader
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gamevance
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InboxToolbar
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCPowerSpeed
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RebateInformer
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TelevisionFanatic Browser Plugin Loader
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2007-05-25 06:03 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-09-12 08:40 405504 ----a-w- c:\program files\Sigmatel\C-Major Audio\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-23 15:24 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-04-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 19:04]
.
2013-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-07 02:56]
.
2013-05-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-07 02:56]
.
2014-04-16 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2014-04-09 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 167.206.13.180 167.206.13.181
FF - ProfilePath - c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\
FF - prefs.js: browser.search.selectedEngine - Conduit Search
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2014-02-21 19:00; korey@markus.me; c:\users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\korey@markus.me
FF - ExtSQL: !HIDDEN! 2012-11-06 12:44; 64ffxtbr@TelevisionFanatic.com; c:\program files\TelevisionFanatic\bar\1.bin
FF - ExtSQL: !HIDDEN! 2014-02-22 23:54; korey@markus.me; c:\program files\Mozilla Firefox\browser\extensions\korey@markus.me
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE "%1 "
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{b7c6e3b0-bb6a-4a3e-a1e5-a23b1ddd32ee} - (no file)
Toolbar-{5043442D-472D-5637-00A7-7A786E7484D7} - (no file)
WebBrowser-{DFFA26BF-27BC-47A0-94E9-00B3B3CCF714} - (no file)
WebBrowser-{5043442D-472D-5637-00A7-7A786E7484D7} - (no file)
Notify-PFW - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-04-19 19:06
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2014-04-19 19:33:59
ComboFix-quarantined-files.txt 2014-04-19 23:33
.
Pre-Run: 180,617,891,840 bytes free
Post-Run: 180,612,911,104 bytes free
.
- - End Of File - - 16013E164DF2B01AE912A651C99C5159
5C616939100B85E558DA92B899A0FC36

 

i have avast i just turned it off to run the scan

 

when i hit clean with adw cleaner the first time it crashed halfway it found 3 things, when i ran it again it showed no infections

# AdwCleaner v3.103 - Report created 21/04/2014 at 21:50:21
# Updated 21/04/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : sixlove - SIXLOVE-PC
# Running from : C:\Users\sixlove\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{48C55AB8-E3A1-4F3F-B7F0-7CC6FDC79A20}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{48C55AB8-E3A1-4F3F-B7F0-7CC6FDC79A20}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{64B1D0DF-F829-47ED-A20A-453A9702BA74}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{64B1D0DF-F829-47ED-A20A-453A9702BA74}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{93C42350-E638-428D-96B8-E80D99994E1D}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93C42350-E638-428D-96B8-E80D99994E1D}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CE0DADF2-56A3-44E9-9B2A-EEC209326344}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CE0DADF2-56A3-44E9-9B2A-EEC209326344}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DiscoveryHelper.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GIFAnimator.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\iMesh.exe
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IMTrProgress.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\IMWeb.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Key Deleted : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery
Key Deleted : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery.1
Key Deleted : HKLM\SOFTWARE\Classes\iMesh.AudioCD
Key Deleted : HKLM\SOFTWARE\Classes\iMesh.Device
Key Deleted : HKLM\SOFTWARE\Classes\iMesh.file
Key Deleted : HKLM\SOFTWARE\Classes\imweb.imwebcontrol
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\inbox
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\IMPlayCDAudioOnArrival
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\IMRipCDAudioOnArrival
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\IMShowCDAudioOnArrival
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\IMShowVolumeOnArrival
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F42C7B47-5234-4BF5-8882-DAAC0D64870D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{05187161-5C36-4324-A734-22BF37509F2D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{05A1D945-A794-44EF-B41A-2F851A117155}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{121EA765-6D3F-4519-9686-A0BA6E5281A2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{13086CD4-88B6-45E3-9182-3BC2664199F7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1F3EFFE4-0E70-47C7-9C48-05EB99E20011}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1FCD7139-C2A3-49AD-8B9E-E82E48AE5DF6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{319FCB76-1568-4EFA-863B-B03A2B16EB5C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3376086C-D6F9-4CE4-8B89-33CD570106B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{368DD7F2-5644-4A88-AC4C-D334B82660B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4796719D-2B92-47BC-920B-77BCDBDBCB6A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5709E326-01D8-49AD-9D08-F8723112D82E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5C769985-C3E1-4F95-BEE7-1101C465F5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5C94FE86-B93B-467F-BFC3-BD6C91416F9B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{64A66B25-A70F-4373-95EF-3A1DB6040B3A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6C5746D3-D309-4988-8694-D435AB86460D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6FC5F7E0-D65A-465C-B8EE-A5F8E008D6DF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7036C2FE-A209-464C-97AB-95B9260EDBF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{731D436C-464C-4F29-BFB2-DE9C458535AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7605E26C-DE38-4B82-ADD8-FE2568CC0B25}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{77E3A6A3-2A24-43FA-B929-00747E4B560B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7C89C8A6-991C-4626-9E26-B12EB4D89C04}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B78032F1-DCC8-4AF4-91AD-FB98E806130D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BF1121D1-8739-45E1-BCD8-90B828F643AB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C9361F5A-3282-4944-9899-6D99CDC5370B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEF00686-CAB8-4885-9CCB-78FF483041AA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FDA55C78-736E-4E8A-996C-4A80FC0396FB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{69D3F709-9DE2-479F-980F-532D46895703}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F42C7B47-5234-4BF5-8882-DAAC0D64870D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F7BEBBB1-7E6B-4561-9444-6F4866D60C7C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EC96F516-51B2-4B46-8451-8665F5A6BA2B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F07FBD3E-2048-44A4-9065-71BF551E2672}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4E42-A125-57C0A11DBCDE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4B5C-9287-DA72D38F4FE6}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A531D99C-5A22-449B-83DA-872725C6D0ED}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A5B9C0F5-5616-47CD-A95F-E43B488FACCF}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4B5C-9287-DA72D38F4FE6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A5B9C0F5-5616-47CD-A95F-E43B488FACCF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\AskPartnerNetwork
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\GOffers
Key Deleted : HKCU\Software\ParetoLogic
Key Deleted : HKCU\Software\WEDLMNGR
Key Deleted : HKCU\Software\AppDataLow\Software\TelevisionFanatic
Key Deleted : HKLM\Software\AskPartnerNetwork
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\ParetoLogic
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Mobogenie
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1A594BF8F3A4D1C4DB72F3A32B6E7636
Key Deleted : HKLM\Software\Classes\Installer\Features\1A594BF8F3A4D1C4DB72F3A32B6E7636
Key Deleted : HKLM\Software\Classes\Installer\Products\1A594BF8F3A4D1C4DB72F3A32B6E7636

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16545


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\House\AppData\Roaming\Mozilla\Firefox\Profiles\7g389v3f.default\prefs.js ]

Line Deleted : user_pref( "extensions.a2eb528f3950d48a3be4b5d7de6c8331ea41e199b6ca44d23ab8773f2d1973314com35510.35510.internaldb.Resources_meta.value ", "%7B%22handlebars.js%22%3A%7B%22id%22%3A183015%2C%22ver%22%3A2%2[...]

[ File : C:\Users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\prefs.js ]

Line Deleted : user_pref( "browser.search.defaultenginename ", "Conduit Search ");
Line Deleted : user_pref( "browser.search.selectedEngine ", "Conduit Search ");
Line Deleted : user_pref( "extensions.a2eb528f3950d48a3be4b5d7de6c8331ea41e199b6ca44d23ab8773f2d1973314com35510.35510.internaldb.Resources_meta.value ", "%7B%22handlebars.js%22%3A%7B%22id%22%3A183015%2C%22ver%22%3A2%2[...]

-\\ Google Chrome v26.0.1410.64

[ File : C:\Users\House\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ File : C:\Users\sixlove\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [19186 octets] - [21/04/2014 21:31:17]
AdwCleaner[R1].txt - [15404 octets] - [21/04/2014 21:36:26]
AdwCleaner[S0].txt - [4026 octets] - [21/04/2014 21:35:50]
AdwCleaner[S1].txt - [15409 octets] - [21/04/2014 21:50:21]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [15470 octets] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by sixlove on Mon 04/21/2014 at 21:55:58.57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ytdownloader



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7561261EA855B284BA87796570DE5642
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{47053881-2311-4862-8d59-b3fbf8433d8c}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E7F8AFB1-CA74-4F3B-A5A6-488A9190BC54}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{47053881-2311-4862-8d59-b3fbf8433d8c}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\strongvault online backup "



~~~ FireFox

Successfully deleted the following from C:\Users\sixlove\AppData\Roaming\mozilla\firefox\profiles\td5n09eh.default\prefs.js

user_pref( "arcadeparlor.settings.addon_data ", "hxxp://tt.arcadeparlor.com/cmn?p=YTM0NTMxMDgyNzFO9R1joeViM2lC0uSgxOsbzuwxdVrenShbvd5g%2BwClLtuqLle7nS134UvEeiaYIwZ3t%2B6znV9o4U%
Emptied folder: C:\Users\sixlove\AppData\Roaming\mozilla\firefox\profiles\td5n09eh.default\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 04/21/2014 at 21:58:18.58
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

OTL logfile created on: 4/21/2014 10:00:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\sixlove\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.31 Gb Available Physical Memory | 71.07% Memory free
6.68 Gb Paging File | 5.85 Gb Available in Paging File | 87.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.04 Gb Total Space | 168.09 Gb Free Space | 59.39% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 5.30 Gb Free Space | 35.34% Space Free | Partition Type: NTFS
Drive F: | 500.32 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SIXLOVE-PC | User Name: sixlove | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/04/21 21:24:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\sixlove\Desktop\OTL.exe
PRC - [2014/04/18 14:36:03 | 003,873,704 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2014/04/18 14:36:03 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2014/02/13 03:25:46 | 000,701,800 | ---- | M] (Crawler, LLC) -- C:\Program Files\PCTechHotline\PCTechHotlineSvc.exe
PRC - [2014/02/13 03:25:38 | 000,064,360 | ---- | M] (Crawler, LLC) -- C:\Program Files\PCTechHotline\PCTHHook.exe
PRC - [2014/02/13 03:25:30 | 001,905,000 | ---- | M] (Crawler, LLC) -- C:\Program Files\PCTechHotline\PCTechHotline.exe
PRC - [2014/01/28 16:25:38 | 004,678,040 | ---- | M] (PC Drivers Headquarters) -- C:\Program Files\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe
PRC - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/12/20 09:49:12 | 002,049,896 | ---- | M] (YTDownloader) -- C:\Program Files\YTDownloader\YTDownloader.exe
PRC - [2013/10/31 14:47:38 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
PRC - [2013/10/31 14:47:28 | 000,059,720 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
PRC - [2013/09/19 11:10:42 | 003,988,856 | ---- | M] (PC Drivers Headquarters) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
PRC - [2011/11/10 04:11:52 | 000,417,792 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011/11/10 04:11:22 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2007/09/12 04:40:46 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
PRC - [2007/09/12 04:40:44 | 000,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/08/23 16:58:58 | 002,070,000 | ---- | M] () -- C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe
PRC - [2006/11/02 08:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe


========== Modules (No Company Name) ==========

MOD - [2014/04/18 14:36:05 | 019,336,120 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
MOD - [2014/02/22 19:33:02 | 001,810,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\RuleEngine\51550614f492df7b311a7e6e535f17d6\RuleEngine.ni.dll
MOD - [2014/02/22 19:33:00 | 001,241,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Communication\ae17d0c2957659456ed52b7cfd017eba\Agent.Communication.ni.dll
MOD - [2014/02/22 19:32:55 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\ExceptionLogging\3fa01885364bf60060be45cee07a3e1c\ExceptionLogging.ni.dll
MOD - [2014/02/22 19:32:54 | 003,320,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common\f7691ef0b4dabe2b3f3089cdf52a8a19\Common.ni.dll
MOD - [2014/02/22 19:32:51 | 000,987,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Common\ecb1fe70e457e62e094ef06d2daf06a3\Agent.Common.ni.dll
MOD - [2014/02/22 19:32:48 | 008,408,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent\dd56aed6271ab3dfb94c212e5be2edb9\Agent.ni.exe
MOD - [2014/02/14 04:32:11 | 000,119,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\XPBurnComponent\27d8ac63d8140387cb8690e4ff0a2b51\XPBurnComponent.ni.dll
MOD - [2014/02/14 04:32:10 | 000,150,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\625ad11f420e452082e9aac61b8f4d5d\Microsoft.Practices.EnterpriseLibrary.Security.Cryptography.ni.dll
MOD - [2014/02/14 04:32:08 | 000,309,248 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Practices#\8c41017fd9581fbf4bc84d939334628a\Microsoft.Practices.EnterpriseLibrary.Common.ni.dll
MOD - [2014/02/14 04:32:08 | 000,248,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Applicati#\8ec2743abdf73b7470e6a38d3363d2d6\Microsoft.ApplicationBlocks.Updater.ni.dll
MOD - [2014/02/14 04:32:07 | 001,819,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\RuleEngine\329b1d8b78df9cd8c778ad4b25792572\RuleEngine.ni.dll
MOD - [2014/02/14 04:32:06 | 000,357,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Win32.Tas#\380a85b46e899f6f5a3a54b648fbe6ea\Microsoft.Win32.TaskScheduler.ni.dll
MOD - [2014/02/14 04:32:05 | 001,262,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Communication\e4a761061f3477ab9abbba2c9fdfe5e6\Agent.Communication.ni.dll
MOD - [2014/02/14 04:32:04 | 000,202,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.WUApiLib\8556ca7df45b9808de27a6763bc54817\Interop.WUApiLib.ni.dll
MOD - [2014/02/14 04:32:02 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\e3ab5ab0fbb86c36425e6902e54a547b\System.Runtime.Remoting.ni.dll
MOD - [2014/02/14 04:31:53 | 001,840,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\890433199e7e462f76600e3aa64e435e\System.Web.Services.ni.dll
MOD - [2014/02/14 04:31:50 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\c5213af29d521ee19cc55983f8c2037c\System.Management.ni.dll
MOD - [2014/02/14 04:31:49 | 003,331,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Common\0e6bbce027cd440c28c174ba165a2e1e\Common.ni.dll
MOD - [2014/02/14 04:31:49 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\ExceptionLogging\e29e642afbd5c3622b33a77cf5abaa56\ExceptionLogging.ni.dll
MOD - [2014/02/14 04:31:46 | 001,000,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent.Common\ba12c7cd24aafde98fc0200c6d2c894f\Agent.Common.ni.dll
MOD - [2014/02/14 04:31:44 | 009,460,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Agent\0ae740cdf3ea51f30f9f21322a3200ab\Agent.ni.exe
MOD - [2014/02/14 04:31:36 | 000,978,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\d17ceca243fabda73eefb21d9bd072df\System.Configuration.ni.dll
MOD - [2014/02/14 04:30:00 | 005,462,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f87e71868aedbc6c4e8fe7160d17c4ab\System.Xml.ni.dll
MOD - [2014/02/14 04:29:49 | 012,434,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2b605fc7deda872727d1ed37710420e\System.Windows.Forms.ni.dll
MOD - [2014/02/14 04:29:42 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8e6265a54260bddfc05951e764f5bc48\System.Drawing.ni.dll
MOD - [2014/02/14 04:29:31 | 006,622,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\6252b82373099322bef5f577bab408b6\System.Data.ni.dll
MOD - [2014/02/14 04:28:58 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\957628d9dd7b3bf370a56dca7835a997\System.ni.dll
MOD - [2014/02/14 04:28:50 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\694a37a84dee2cd2609a1dfab27c0433\mscorlib.ni.dll
MOD - [2014/02/06 01:52:52 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/06 01:52:32 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2014/01/28 16:25:44 | 000,428,448 | ---- | M] () -- C:\Program Files\PC Drivers HeadQuarters\Driver Detective\Agent.Communication.XmlSerializers.dll
MOD - [2014/01/28 16:25:14 | 000,823,168 | ---- | M] () -- C:\Program Files\PC Drivers HeadQuarters\Driver Detective\ThemePack.Default.dll
MOD - [2013/09/19 11:10:44 | 000,653,704 | ---- | M] () -- C:\Program Files\Driver Restore\Driver Restore\ThemePack.DriverRestore.dll
MOD - [2013/09/19 10:31:26 | 000,412,064 | ---- | M] () -- C:\Program Files\Driver Restore\Driver Restore\Agent.Communication.XmlSerializers.dll
MOD - [2013/09/14 02:51:02 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
MOD - [2013/09/14 02:50:36 | 001,242,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
MOD - [2011/11/10 03:11:08 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll
MOD - [2009/03/30 00:42:17 | 002,933,760 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2007/08/23 16:58:58 | 002,070,000 | ---- | M] () -- C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe


========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe /service -- (SMUpd)
SRV - [2014/04/18 14:36:03 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2014/04/12 22:28:01 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/03/12 15:04:07 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/02/13 03:25:46 | 000,701,800 | ---- | M] (Crawler, LLC) [Auto | Running] -- C:\Program Files\PCTechHotline\PCTechHotlineSvc.exe -- (PCTechHotlineSvc)
SRV - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/11/10 04:11:22 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/14 13:52:24 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007/09/12 04:40:44 | 000,094,208 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/09/11 01:45:04 | 000,124,832 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2007/06/27 11:18:08 | 000,223,448 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe -- (AlertService)
SRV - [2007/06/27 11:17:26 | 000,272,600 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\QualityManager.exe -- (QualityManager)
SRV - [2007/06/27 11:17:12 | 000,446,680 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe -- (Remote UI Service)
SRV - [2007/06/27 11:16:02 | 000,157,912 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe -- (MCLServiceATL)
SRV - [2007/06/27 11:15:28 | 000,039,640 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe -- (DHTRACE)
SRV - [2007/06/27 11:15:14 | 000,059,096 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\issm.exe -- (ISSM)
SRV - [2007/06/27 11:14:46 | 000,317,656 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe -- (NMSCore)
SRV - [2007/06/27 11:13:56 | 000,268,504 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe -- (M1 Server)
SRV - [2007/05/31 10:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 10:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/02/12 12:46:34 | 000,208,896 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe -- (DQLWinService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | Auto | Stopped] -- system32\DRIVERS\xaudio.sys -- (XAudio)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys -- (SMUpdd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | Auto | Stopped] -- system32\DRIVERS\mdmxsdk.sys -- (mdmxsdk)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\HSXHWBS2.sys -- (HSXHWBS2)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\HSX_DPV.sys -- (HSF_DPV)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\sixlove\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2014/04/18 14:36:06 | 000,776,976 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2014/04/18 14:36:06 | 000,411,552 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2014/04/18 14:36:06 | 000,180,632 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2014/04/18 14:36:06 | 000,067,824 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2014/04/18 14:36:06 | 000,057,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2014/04/18 14:36:06 | 000,054,832 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2014/04/18 14:36:06 | 000,049,944 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2014/04/18 14:36:06 | 000,024,184 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\aswHwid.sys -- (aswHwid)
DRV - [2014/03/22 00:14:07 | 000,055,232 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\System32\drivers\tStLib.sys -- (tStLib)
DRV - [2012/08/02 11:21:18 | 000,026,248 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\ElRawDsk.sys -- (ElRawDisk)
DRV - [2011/11/10 04:44:14 | 008,913,920 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2011/11/10 04:44:14 | 008,913,920 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2011/11/10 04:44:14 | 008,913,920 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011/11/10 03:12:22 | 000,263,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2009/07/13 19:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2007/12/14 08:41:16 | 000,005,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntelDH.sys -- (IntelDH)
DRV - [2007/09/12 04:44:34 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2007/09/12 04:40:48 | 000,326,656 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/06/27 11:17:46 | 000,014,552 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys -- (TSHWMDTCP)
DRV - [2007/06/25 08:14:32 | 000,076,288 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2rs.sys -- (Ser2rs)
DRV - [2007/02/18 21:34:50 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nmsunidr.sys -- (nmsunidr)
DRV - [2006/11/02 03:41:53 | 000,251,904 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2005/08/17 07:47:48 | 000,073,696 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdserd.sys -- (sscdserd)
DRV - [2005/08/17 07:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
DRV - [2005/08/17 07:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
DRV - [2005/08/17 07:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\..\SearchScopes\{9C5F4D55-F70A-42CD-9B80-79B3140D62CE}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20140206,20028,0,18,0
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.order.1: "Yahoo "
FF - prefs.js..browser.search.order.2: " "
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20140206,20030,0,18,0 "
FF - prefs.js..extensions.enabledAddons: %7BF32E7E42-9AFA-47CA-A0C4-D07EE651D404%7D:1.0
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: 2eb528f3-950d-48a3-be4b-5d7de6c8331e%40a41e199b-6ca4-4d23-ab87-73f2d1973314.com:0.94.253
FF - prefs.js..extensions.enabledAddons: 9321b276-2c2e-4c5f-bd04-b8118e512707%40c0c8a2d6-3275-4cac-a0b2-52e936311db9.com:0.94.179
FF - prefs.js..extensions.enabledAddons: %7B746505DC-0E21-4667-97F8-72EA6BCF5EEF%7D:1.0.0.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..network.proxy.no_proxies_on: "*.local "
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/04/18 14:36:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2014/04/12 22:27:53 | 000,000,000 | ---D | M]

[2011/03/19 17:27:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sixlove\AppData\Roaming\Mozilla\Extensions
[2014/04/21 21:36:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions
[2014/02/02 18:18:32 | 000,000,000 | ---D | M] (ArcadeParlor) -- C:\Users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\{F32E7E42-9AFA-47CA-A0C4-D07EE651D404}
[2014/02/23 00:54:04 | 000,000,000 | ---D | M] (WordExtra) -- C:\Users\sixlove\AppData\Roaming\Mozilla\Firefox\Profiles\td5n09eh.default\extensions\korey@markus.me
[2014/04/12 22:27:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2014/04/12 22:27:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/04/12 22:28:02 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014/04/12 22:27:51 | 000,000,000 | ---D | M] (WordExtra) -- C:\Program Files\Mozilla Firefox\browser\extensions\korey@markus.me
File not found (No name found) -- C:\USERS\SIXLOVE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TD5N09EH.DEFAULT\EXTENSIONS\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}
File not found (No name found) -- C:\USERS\SIXLOVE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TD5N09EH.DEFAULT\EXTENSIONS\2EB528F3-950D-48A3-BE4B-5D7DE6C8331E@A41E199B-6CA4-4D23-AB87-73F2D1973314.COM
File not found (No name found) -- C:\USERS\SIXLOVE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TD5N09EH.DEFAULT\EXTENSIONS\9321B276-2C2E-4C5F-BD04-B8118E512707@C0C8A2D6-3275-4CAC-A0B2-52E936311DB9.COM
[2009/09/12 15:53:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://us.yhs4.search.yahoo.com/web...3i_SP,203,0_0,StartPage,20140206,20033,0,18,0
CHR - plugin: First user (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Error reading preferences file
CHR - Extension: HP Product Detection Plugin = C:\Users\sixlove\AppData\Local\Google\Chrome\User Data\Default\Extensions\aelbknmfcacjffmgnoaaonhgoghlmlkp\2.0.5.6_0\
CHR - Extension: ArcadeParlor = C:\Users\sixlove\AppData\Local\Google\Chrome\User Data\Default\Extensions\bifpegonkcooekdlmlfngpbifliiamoo\1.1.1_0\
CHR - Extension: Yahoo! Toolbar for Chrome = C:\Users\sixlove\AppData\Local\Google\Chrome\User Data\Default\Extensions\eihhgekonheiliaidomffpplfhecmkag\1.0.1.41_0\
CHR - Extension: WordExtra = C:\Users\sixlove\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfmgibapgochmjeecdcjkloehhhcoekj\1_0\

O1 HOSTS File: ([2014/04/19 19:06:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\..\Toolbar\WebBrowser: (no name) - {0123B506-0AD9-43AA-B0CF-916C122AD4C5} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [FileAgent] C:\Program Files\FileCenter\Main\FileAgent.exe (Lucion Technologies, LLC)
O4 - HKLM..\Run: [PCTechHotline] C:\Program Files\PCTechHotline\PCTechHotline.exe (Crawler, LLC)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [ApplePhotoStreams] C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [BackupAgent] C:\Program Files\Super Backup Online Backup\BackupAgent.exe ()
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [cdloader] C:\Users\sixlove\AppData\Roaming\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [Driver Detective] C:\Program Files\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe (PC Drivers Headquarters)
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [Driver Restore] C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe (PC Drivers Headquarters)
O4 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001..\Run: [iCloudServices] C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 167.206.13.180 167.206.13.181
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CC151F6-C8D3-4E5A-BB05-1495966C18CE}: DhcpNameServer = 167.206.13.180 167.206.13.181
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004/06/21 06:15:14 | 000,103,801 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (???)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (??)
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (system.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2014/04/21 21:55:54 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014/04/21 21:31:04 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/04/21 21:30:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\sixlove\Desktop\OTL.exe
[2014/04/21 21:30:35 | 001,016,261 | ---- | C] (Thisisu) -- C:\Users\sixlove\Desktop\JRT.exe
[2014/04/19 19:34:06 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/04/19 19:34:01 | 000,000,000 | ---D | C] -- C:\Users\sixlove\AppData\Local\temp
[2014/04/19 18:57:02 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014/04/19 18:57:02 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014/04/19 18:57:02 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014/04/19 18:56:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/04/19 18:56:26 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014/04/19 18:55:38 | 005,195,329 | R--- | C] (Swearware) -- C:\Users\sixlove\Desktop\ComboFix.exe
[2014/04/19 18:15:15 | 000,000,000 | ---D | C] -- C:\Users\sixlove\AppData\Local\CrashDumps
[2014/04/18 23:35:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014/04/18 23:34:04 | 000,000,000 | ---D | C] -- C:\Users\sixlove\Desktop\mbar
[2014/04/18 23:27:12 | 000,000,000 | ---D | C] -- C:\Users\sixlove\Desktop\RK_Quarantine
[2014/04/18 23:26:49 | 012,589,848 | ---- | C] (Malwarebytes Corp.) -- C:\Users\sixlove\Desktop\mbar-1.07.0.1009.exe
[2014/04/18 14:37:49 | 000,000,000 | ---D | C] -- C:\Users\sixlove\AppData\Roaming\AVAST Software
[2014/04/18 14:36:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
[2014/04/18 14:36:21 | 000,057,672 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2014/04/18 14:36:20 | 000,776,976 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2014/04/18 14:36:19 | 000,411,552 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2014/04/18 14:36:18 | 000,067,824 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2014/04/18 14:36:16 | 000,054,832 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2014/04/18 14:36:14 | 000,271,264 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2014/04/18 14:36:06 | 000,043,152 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2014/04/18 14:35:42 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2014/04/18 14:34:40 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2014/04/18 14:34:23 | 088,882,192 | ---- | C] (AVAST Software) -- C:\Users\sixlove\Desktop\avast_free_antivirus_setup.exe
[2014/04/16 21:54:35 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\sixlove\Desktop\dds.com
[2014/04/16 15:05:29 | 000,107,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys
[2014/04/16 15:05:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/04/16 15:05:09 | 000,075,480 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamchameleon.sys
[2014/04/16 15:05:09 | 000,051,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mwac.sys
[2014/04/16 15:03:54 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2014/04/16 15:02:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
[2014/04/16 15:02:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/04/12 22:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2014/04/21 22:04:16 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/04/21 21:58:21 | 000,642,740 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2014/04/21 21:58:21 | 000,119,932 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2014/04/21 21:52:10 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014/04/21 21:52:10 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014/04/21 21:52:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/04/21 21:52:04 | 3487,502,336 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/21 21:51:27 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2014/04/21 21:24:30 | 001,016,261 | ---- | M] (Thisisu) -- C:\Users\sixlove\Desktop\JRT.exe
[2014/04/21 21:24:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\sixlove\Desktop\OTL.exe
[2014/04/21 21:24:26 | 001,324,843 | ---- | M] () -- C:\Users\sixlove\Desktop\adwcleaner.exe
[2014/04/19 19:06:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2014/04/19 18:10:02 | 005,195,329 | R--- | M] (Swearware) -- C:\Users\sixlove\Desktop\ComboFix.exe
[2014/04/18 23:35:49 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys
[2014/04/18 23:35:13 | 000,075,480 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamchameleon.sys
[2014/04/18 23:23:50 | 012,589,848 | ---- | M] (Malwarebytes Corp.) -- C:\Users\sixlove\Desktop\mbar-1.07.0.1009.exe
[2014/04/18 23:21:30 | 003,972,608 | ---- | M] () -- C:\Users\sixlove\Desktop\RogueKiller.exe
[2014/04/18 14:36:44 | 000,001,835 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014/04/18 14:36:06 | 000,776,976 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2014/04/18 14:36:06 | 000,411,552 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2014/04/18 14:36:06 | 000,271,264 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2014/04/18 14:36:06 | 000,180,632 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2014/04/18 14:36:06 | 000,067,824 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2014/04/18 14:36:06 | 000,057,672 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2014/04/18 14:36:06 | 000,054,832 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2014/04/18 14:36:06 | 000,049,944 | ---- | M] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2014/04/18 14:36:06 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2014/04/18 14:36:06 | 000,024,184 | ---- | M] () -- C:\Windows\System32\drivers\aswHwid.sys
[2014/04/18 14:32:18 | 088,882,192 | ---- | M] (AVAST Software) -- C:\Users\sixlove\Desktop\avast_free_antivirus_setup.exe
[2014/04/18 14:27:23 | 000,000,408 | ---- | M] () -- C:\Windows\System32\iolo.ini
[2014/04/16 23:35:47 | 000,256,492 | ---- | M] () -- C:\Windows\System32\drivers\KmxAgent.asc
[2014/04/16 21:49:56 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\sixlove\Desktop\dds.com
[2014/04/16 18:00:02 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2014/04/16 15:07:15 | 000,000,126 | ---- | M] () -- C:\Windows\wininit.ini
[2014/04/16 15:05:12 | 000,000,861 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/04/16 14:55:16 | 000,000,702 | ---- | M] () -- C:\Windows\System32\ff.bin
[2014/04/16 14:54:33 | 000,000,530 | ---- | M] () -- C:\Windows\System32\schtasks.bin
[2014/04/13 16:42:01 | 000,103,869 | ---- | M] () -- C:\Windows\hpoins04.dat
[2014/04/12 12:51:29 | 001,243,655 | ---- | M] () -- C:\Users\sixlove\Desktop\ProcessExplorer.zip
[2014/04/09 00:20:00 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2014/04/03 09:51:10 | 000,051,416 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mwac.sys
[2014/04/03 09:50:56 | 000,023,256 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/04/21 21:30:41 | 001,324,843 | ---- | C] () -- C:\Users\sixlove\Desktop\adwcleaner.exe
[2014/04/19 18:57:02 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014/04/19 18:57:02 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014/04/19 18:57:02 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014/04/19 18:57:02 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014/04/19 18:57:02 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014/04/18 23:26:55 | 003,972,608 | ---- | C] () -- C:\Users\sixlove\Desktop\RogueKiller.exe
[2014/04/18 14:36:44 | 000,001,835 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014/04/18 14:36:20 | 000,180,632 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2014/04/18 14:36:18 | 000,049,944 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2014/04/18 14:36:17 | 000,024,184 | ---- | C] () -- C:\Windows\System32\drivers\aswHwid.sys
[2014/04/16 15:07:08 | 000,000,126 | ---- | C] () -- C:\Windows\wininit.ini
[2014/04/16 15:05:12 | 000,000,861 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/04/13 16:38:57 | 000,103,869 | ---- | C] () -- C:\Windows\hpoins04.dat
[2014/04/12 22:05:38 | 001,243,655 | ---- | C] () -- C:\Users\sixlove\Desktop\ProcessExplorer.zip
[2014/02/22 22:01:35 | 000,000,702 | ---- | C] () -- C:\Windows\System32\ff.bin
[2014/02/22 21:54:43 | 000,000,530 | ---- | C] () -- C:\Windows\System32\schtasks.bin
[2014/02/22 19:55:18 | 000,000,066 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2013/09/09 18:59:13 | 000,401,552 | ---- | C] () -- C:\Windows\System32\FCAgent32.dll
[2013/09/09 18:59:13 | 000,002,043 | ---- | C] () -- C:\Windows\System32\FCAgent.ini
[2013/06/09 23:51:45 | 000,000,408 | ---- | C] () -- C:\Windows\System32\iolo.ini
[2012/09/18 15:16:16 | 001,292,255 | ---- | C] () -- C:\Users\sixlove\Library.xml
[2012/08/06 18:12:22 | 000,000,632 | RHS- | C] () -- C:\Users\sixlove\ntuser.pol
[2012/08/06 17:30:35 | 000,074,703 | ---- | C] () -- C:\Windows\System32\mfc45.dat
[2012/08/06 16:09:04 | 000,074,703 | ---- | C] () -- C:\Windows\System32\mfc45.dll
[2012/05/13 14:26:24 | 000,000,680 | ---- | C] () -- C:\Users\sixlove\AppData\Local\d3d9caps.dat
[2009/08/09 20:51:41 | 000,002,950 | ---- | C] () -- C:\Users\sixlove\AppData\Local\.ipc_copyrecord
[2009/08/09 20:49:50 | 000,001,232 | ---- | C] () -- C:\Users\sixlove\AppData\Local\iTunesPrefs
[2009/02/21 23:52:12 | 000,000,048 | ---- | C] () -- C:\Users\sixlove\AppData\Local\84756-11986-27475-00TC1-94865
[2009/02/05 18:53:56 | 000,024,064 | ---- | C] () -- C:\Users\sixlove\AppData\Roaming\UserTile.png
[2007/12/21 23:40:34 | 000,000,000 | ---- | C] () -- C:\Users\sixlove\AppData\Roaming\wklnhst.dat
[2007/12/20 00:49:42 | 000,044,544 | ---- | C] () -- C:\Users\sixlove\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 02:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
" " = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 02:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/09/09 18:01:27 | 000,000,000 | ---D | M] -- C:\Users\House\AppData\Roaming\Image Zone Express
[2012/09/25 03:28:28 | 000,000,000 | ---D | M] -- C:\Users\House\AppData\Roaming\Printer Info Cache
[2014/01/03 17:10:21 | 000,000,000 | ---D | M] -- C:\Users\House\AppData\Roaming\Tracker Software
[2014/04/18 14:37:49 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\AVAST Software
[2014/04/13 16:19:00 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Image Zone Express
[2012/08/06 19:02:53 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\iolo
[2012/03/17 18:01:59 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\mjusbsp
[2013/06/30 02:25:15 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\MusicNet
[2014/02/23 00:53:25 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\PC Tech Hotline
[2011/04/22 21:25:51 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\PCDr
[2008/05/29 17:55:39 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Printer Info Cache
[2008/09/29 18:46:09 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Smith Micro
[2009/07/03 20:16:05 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Sprint Desktop Sync
[2007/12/21 23:42:33 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Template
[2013/09/09 19:00:27 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\Tracker Software
[2014/04/19 19:06:10 | 000,000,000 | ---D | M] -- C:\Users\sixlove\AppData\Roaming\WordExtra

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\sixlove\Desktop\Ghetto Story.mp4:TOC.WMV

< End of report >

 

OTL Extras logfile created on: 4/21/2014 10:00:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\sixlove\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.31 Gb Available Physical Memory | 71.07% Memory free
6.68 Gb Paging File | 5.85 Gb Available in Paging File | 87.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 283.04 Gb Total Space | 168.09 Gb Free Space | 59.39% Space Free | Partition Type: NTFS
Drive D: | 15.00 Gb Total Space | 5.30 Gb Free Space | 35.34% Space Free | Partition Type: NTFS
Drive F: | 500.32 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SIXLOVE-PC | User Name: sixlove | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistHiDefMedia] -- "C:\Program Files\HiDefMedia\HiDefMedia\HiDefMedia.exe" --started-from-file --playlist-enqueue "%1 "
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithHiDefMedia] -- "C:\Program Files\HiDefMedia\HiDefMedia\HiDefMedia.exe" --started-from-file --no-playlist-enqueue "%1 "
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\CA Personal Firewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15CB59B1-B7E7-46F3-B28B-BF688663E271}" = rport=138 | protocol=17 | dir=out | app=system |
"{1FD78B10-E694-4651-BD28-81C0C561B31D}" = rport=139 | protocol=6 | dir=out | app=system |
"{2AD67D76-E57F-4CE6-B9CE-CD1931C27068}" = lport=445 | protocol=6 | dir=in | app=system |
"{32D323CD-B302-4D05-A48B-95F2CDA54A96}" = lport=137 | protocol=17 | dir=in | app=system |
"{8D6BDDF5-CDA8-4AC4-B568-8B2AC67B4A36}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{9F9DA799-7817-4FE2-88E2-C92133460076}" = lport=139 | protocol=6 | dir=in | app=system |
"{A653B80F-2FE7-49ED-9FD2-5043D7A4917C}" = lport=138 | protocol=17 | dir=in | app=system |
"{B249DE5D-1B7A-4F82-994E-3746C8E6EB6D}" = lport=9442 | protocol=17 | dir=in | name=intel(r) viiv(tm) media server discovery |
"{C80687FA-2FDF-41E4-B916-331DA9D2284C}" = rport=445 | protocol=6 | dir=out | app=system |
"{D16DCB5F-EB49-4468-AD2E-16A862A33A4E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{F35D4BF5-0C0E-47F2-90C4-EE4C1FAD3C0C}" = lport=1900 | protocol=17 | dir=in | name=intel(r) viiv(tm) media server upnp discovery |
"{FAEC02D8-827C-433C-BA34-27C0C5764DC7}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{049E5C54-3AC0-4FC3-AC66-2F28374F4EDC}" = protocol=6 | dir=in | app=c:\program files\iolo\system mechanic professional\sysmech.exe |
"{1E9C3342-0932-41B4-A546-A9454D08CC87}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{1F552DBD-598F-4204-885D-180B5A3E9786}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{24E07C88-1FE0-4AD8-8D9C-49FD9CDD032C}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{2AD53221-F7C9-4547-8CDE-E09978A25D17}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{2B194D6C-3B9C-419F-90C9-579D2F1F6281}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{310710D4-3185-4B5C-AC06-01B6210B44E5}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{370649EC-28C8-4A24-B518-467EA06668B8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{41A5B91E-B9BB-4D70-8268-31CD758C495A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{41AFDD03-4BD8-4B6F-AF7A-78C1AE97A699}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{5092CAA6-77E1-473E-B143-201E4587445D}" = protocol=17 | dir=in | app=c:\program files\iolo\system mechanic professional\sysmech.exe |
"{6CA8D266-034C-451B-A505-4C7FE53ED4D2}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{903AF46C-746D-43D3-A33D-3B0EFC4002CA}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{91F757BA-309C-4CBF-84AB-ECA49C65D9C5}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{9AD5E102-C65B-4CDB-B00A-DECD8379F614}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{A0A5C2EC-DC82-4CF8-977D-69B434961388}" = protocol=6 | dir=in | app=c:\users\sixlove\desktop\noi.exe |
"{AF6F98A4-DECD-4535-84A5-66DC69948E88}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B7357DB8-4502-4EA9-97F8-347129549142}" = protocol=17 | dir=in | app=c:\users\sixlove\desktop\noi.exe |
"{CA9D93CA-C6FC-41A6-A87D-794A4E41167C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D02EBA9E-0F79-4868-9A9C-37F476E03599}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DF20ED42-BBDF-49A6-8C49-0A59D47F7E1F}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E22134C7-B913-43F9-8EB1-8EDF6CAB9B55}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{E3F6E17B-D632-4D83-888B-65D634EFB2B4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F368987E-7AFC-49D5-8A62-68948950B9E7}" = dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{6D596F79-BA79-4594-9227-4DCEE2A7280E}C:\users\house\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=6 | dir=in | app=c:\users\house\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |
"TCP Query User{B5BB450C-BD91-491E-BE8A-756696F5DF06}C:\users\sixlove\appdata\roaming\mjusbsp\magicjack.exe" = protocol=6 | dir=in | app=c:\users\sixlove\appdata\roaming\mjusbsp\magicjack.exe |
"TCP Query User{C5EDDD49-A1BE-42C2-B731-BE16F33A5803}C:\users\sixlove\appdata\local\xenocode\sandbox\n.o.i\1.3.0.0\2011.04.19t17.15\virtual\stubexe\8.0.1112\@desktop@\noi.exe" = protocol=6 | dir=in | app=c:\users\sixlove\appdata\local\xenocode\sandbox\n.o.i\1.3.0.0\2011.04.19t17.15\virtual\stubexe\8.0.1112\@desktop@\noi.exe |
"UDP Query User{28B145DF-D6C9-4F4E-854A-8CFBCFA5D84B}C:\users\sixlove\appdata\local\xenocode\sandbox\n.o.i\1.3.0.0\2011.04.19t17.15\virtual\stubexe\8.0.1112\@desktop@\noi.exe" = protocol=17 | dir=in | app=c:\users\sixlove\appdata\local\xenocode\sandbox\n.o.i\1.3.0.0\2011.04.19t17.15\virtual\stubexe\8.0.1112\@desktop@\noi.exe |
"UDP Query User{5370C081-FEC0-49A5-9F0B-E34A87E9B820}C:\users\house\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe" = protocol=17 | dir=in | app=c:\users\house\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe |
"UDP Query User{AA3BA73B-A695-40D7-8D42-EFCA45AA4099}C:\users\sixlove\appdata\roaming\mjusbsp\magicjack.exe" = protocol=17 | dir=in | app=c:\users\sixlove\appdata\roaming\mjusbsp\magicjack.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{0327FA9D-975C-448C-A086-577D57BB25B8}" = Adobe Soundbooth CS3 Codecs
"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools
"{045DB95B-F123-B440-D999-AD083AA55196}" = CCC Help German
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{11CB6E0D-FFB2-7FAE-17FC-CA92BEE8F24A}" = Catalyst Control Center Localization Japanese
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio EasyArchive
"{1400192B-D969-6FD4-8044-E2D07C5ADE3A}" = Catalyst Control Center Localization German
"{14BD87BE-02AA-8E04-602C-B20A43267F5B}" = CCC Help Japanese
"{1662D4E1-B469-D6A3-085B-0B5350BF7CA5}" = Catalyst Control Center Localization Italian
"{168879EE-A348-BFB7-3622-3651449C629F}" = CCC Help Italian
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D47FA1-0440-48D3-A7E0-DA09537FF471}" = Apple Mobile Device Support
"{1A8E3C5D-B772-CB4A-1117-751B5D79787B}" = Catalyst Control Center Graphics Light
"{1B2E11A4-8566-B8C7-3FB6-0D2A6F8D2139}" = CCC Help Portuguese
"{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}" = Adobe Media Player
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{266156C9-F681-A84B-083C-D2052A461583}" = Catalyst Control Center Graphics Full New
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45
"{273130E8-117C-4237-A0FA-83EBBF11E051}" = Driver Restore
"{2A6FFA23-9188-E796-4AFF-196A2004AA39}" = ccc-utility
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{2EE437A9-75E3-10D1-3633-D4E8D6043503}" = CCC Help Spanish
"{2F21564D-DE05-4C6D-B21E-08B9D313FAB3}" = iTunes
"{2F3BCA05-4FD4-9418-1976-32F783E43DF4}" = Catalyst Control Center Graphics Full Existing
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3CE8C77E-8703-B62E-8F7C-31F7AA97F2A7}" = Catalyst Control Center Localization French
"{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
"{4524E7FD-A547-C564-CD8F-A872F7C39029}" = CCC Help French
"{4903D172-DCCB-392F-93A3-34CA9D47FE3D}" = Microsoft .NET Framework 4.5.1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1" = System Checkup 3.3
"{5043442D-472D-5637-00A7-A758B70C0A00}" = Ask Toolbar
"{5A9AA2C0-972F-4239-AA41-E409434194D5}" = MobileMe Control Panel
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D6D605B-E4B7-490B-A794-9284BC3D2A8B}" = Driver Detective
"{5D9B17E4-5C34-45B2-9C95-8B9DB4CF7AF3}" = HP_Network_UserGuide
"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6E4FC36F-A7B5-EE38-2FE4-7D0D94D230F5}" = Catalyst Control Center Localization Portuguese
"{6EF2AFEF-2044-4A85-ED1F-E70A568D7ED9}" = Catalyst Control Center Localization Turkish
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75F8E142-7720-156D-C74C-80AA0974B993}" = CCC Help Polish
"{7727DA6C-A845-890D-2B48-7863A93F167C}" = Catalyst Control Center Localization Korean
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.12.4
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79BD66B2-4DAE-4C3B-B08E-DC72E507C163}" = iCloud
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{84D58782-A2F0-47D4-A557-3041363893CF}" = Adobe Setup
"{87CA11B3-C4CE-D989-42C7-C6197B266EFD}" = CCC Help Chinese Standard
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{8A9FC225-75F6-4B5D-911C-0ED230565643}" = HP Product Detection
"{8BC914BF-F80D-47D9-BD1E-809EB6A7C23C}_is1" = FileCenter 8.0.0.23
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{8F3BE4DF-76F3-443A-A305-A14FC648010C}" = TouchCopy 09
"{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91F2493D-8A65-7BF3-5684-9D6397F8847D}" = Catalyst Control Center Core Implementation
"{92A300C0-E97B-48CC-9702-AB1AAED167E1}" = Adobe Soundbooth CS3 Scores
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update
"{9794B30C-0FCB-3658-B44F-33BDDC788C2D}" = CCC Help English
"{994FCE98-1379-2A33-24BC-F092466CC5C4}" = Catalyst Control Center Localization Thai
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AD1E496-9BE2-4B17-A6F9-0AA193AFB1B0}" = Super Backup Online Backup
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A0B0DA25-DD15-4739-92A3-62D3424F043A}_is1" = PC Tech Hotline
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9}" = Adobe Soundbooth CS3
"{A73BDB2A-E4A7-4FE8-960E-6A5C8BF76FCB}" = XPS MiniView Gadget
"{A7472CEE-6E85-4D43-9C71-BDFC0D471F70}" = Intel(R) Viiv(TM) Software
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}" = Wizard101
"{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}" = Apple Application Support
"{AAC90D5F-B8B1-4A06-B888-F3A241124D0D}" = Roxio MyDVD Premier
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.06)
"{AC7C7307-6324-D891-1E53-77B00E4F0961}" = CCC Help Turkish
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B6EECBB7-BDA4-4E52-2BD6-69D70215AC48}" = Catalyst Control Center Localization Polish
"{B860298B-CE03-4DE2-B92E-422F2C20A2D8}_is1" = PDF-XChange Lite 4
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{C279E4B3-9FCD-9D82-7A83-B773C2D4E526}" = Catalyst Control Center Localization Hungarian
"{C2D192BE-5E2C-92CF-56A0-28C7D9D67B96}" = CCC Help Hungarian
"{C2F3DB53-EF8E-4885-36C4-34C4911FEAE0}" = ccc-core-static
"{C486C7E9-5591-8777-CEB5-FA373AFE6711}" = Catalyst Control Center Localization Spanish
"{C57606D6-7A44-4A99-D6D0-BA07FD3ACCEA}" = Catalyst Control Center Localization Chinese Traditional
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Premier
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}" = WinZip 11.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D379100F-65A2-4B54-D568-CD2BE238C6A3}" = Catalyst Control Center Graphics Previews Vista
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{D973AE1D-ACB1-2C54-92FE-A29E2A7482C0}" = CCC Help Thai
"{E0EFA6E0-2A18-A83B-34EA-8435EFEE1285}" = CCC Help Korean
"{E24EDDF0-93A0-95CC-509A-1C012180F8CB}" = Skins
"{E53C563F-1157-20B2-1276-755A22E814D2}" = Catalyst Control Center Localization Chinese Standard
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA08048C-3823-4DC8-B169-1D5D11FFC19F}_is1" = PDF-XChange 4
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F6B8797E-923E-4902-9698-62937FE80FAB}" = CCC Help Chinese Traditional
"{F818A41D-3535-4949-83BB-E41121697A97}" = Sprint Desktop Sync
"{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
"{FA4C2D53-205F-4245-9717-F3761154824D}" = Safari
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FBF1268D-3323-545E-4DD0-F45AD313E37E}" = Catalyst Control Center Graphics Previews Common
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 12 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe_19c4ee81f9cc4b3dffb9a17d9b648b2" = Adobe Soundbooth CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Avast" = avast! Free Antivirus
"Cisco Connect" = Cisco Connect
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Flash Player Pro_is1" = Flash Player Pro V5.4
"Google Chrome" = Google Chrome
"HiDef Media Player" = HiDef Media Player 1.1.12
"Intel(R) Configuration Center" = Intel(R) Viiv(TM) Software
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.1.1004
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 26.0 (x86 en-US)" = Mozilla Firefox 26.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PC-Doctor for Windows" = My Dell
"PremElem40" = Adobe Premiere Elements 4.0
"PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
"PROSetDX" = Intel(R) PRO Network Connections 12.1.12.4
"Search module" = Search module
"Yahoo! Companion" = Yahoo! Toolbar
"YTDownloader" = YTDownloader

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3249766445-722992797-2274620919-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"magicJack" = magicJack
"WordExtra" = WordExtra

========== Last 20 Event Log Errors ==========

[ iolo Applications Events ]
Error - 8/20/2012 6:39:46 AM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 8/20/2012 6:16:32 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 20
Description =

Error - 8/22/2012 7:09:11 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 9/25/2012 2:02:39 AM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 10/3/2012 5:49:29 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 20
Description =

Error - 10/22/2012 2:12:07 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 4/3/2013 7:58:31 AM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 4/20/2013 8:31:17 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 11
Description =

Error - 5/30/2013 5:45:40 PM | Computer Name = sixlove-PC | Source = System Shield | ID = 12
Description =


< End of report >

 

this computer isnt hooked up to the internet so i cant do eset scanner is there an alternative scan or should i hook up an Ethernet cord to this ?

edit: nvm hooked up the internet doing the scan now