Solved Win32/Toolbar.Montiera invasion - Zone Alarm?

[Solved] Win32/Toolbar.Montiera invasion - Zone Alarm?

I've been having deteriorating speed with my internet connection (internet cable). Although there are clear equipment problems (theirs), it was also suggested I had 'computer' problems. I downloaded the ESET online scanner, which uncovered 12 possible infections, including many Montiera toolbar files that somehow are now allied with my Zone Alarm security suite.

Rather than delete the cited files, I come to Windows BBS to find out if I really have malware. I have a Dell Inspiron 600m laptop, with Windows XP SP3, IE8, SeaMonkey and Opera browsers, with Zone Alarm security suite and Malwarebytes - neither of which detected any problems.

I appreciate any guidance you can give.


The following is the FRST log for the Farbar Recovery Scan Tool:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-06-2015
Ran by G**** (administrator) on ********* on 27-06-2015 18:53:05
Running from C:\Documents and Settings\G****\Desktop
Loaded Profiles: G***** (Available Profiles: G**** & Administrator)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe
(Microsoft Corporation) C:\Program Files\UPHClean\uphclean.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
(Check Point Software Technologies, Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(mozilla.org) C:\Program Files\SeaMonkey\seamonkey.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe
(Mozilla Corporation) C:\Program Files\SeaMonkey\plugin-container.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ATIPTA] => C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2005-11-10] (ATI Technologies, Inc.)
HKLM\...\Run: [ZoneAlarm] => C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-08-13] (Check Point Software Technologies Ltd.)
HKLM\...\Run: [LXCTCATS] => rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2005-11-10] (ATI Technologies Inc.)
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\RunOnce: [FlashPlayerUpdate] => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_18_0_0_160_Plugin.exe [1154736 2015-06-13] (Adobe Systems Incorporated)
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_17_0_0_188_pepper.exe -update pepperplugin
Startup: C:\Documents and Settings\Karen\Start Menu\Programs\Startup\AutorunsDisabled [2014-03-18] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
BootExecute: autocheck autochk *
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toast.net/start/
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.toast.net/start/
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toast.net/start/
SearchScopes: HKU\S-1-5-21-1060284298-1993962763-854245398-1004 -> DefaultScope {FB0D385B-5C61-4AFF-BBB8-A1DC7F93EE0E} URL = https://duckduckgo.com/?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1060284298-1993962763-854245398-1004 -> {FB0D385B-5C61-4AFF-BBB8-A1DC7F93EE0E} URL = https://duckduckgo.com/?q={searchTerms}
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2014-08-12] (Adblock Plus)
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-13] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-21]

Opera:
=======
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera 11.5\Opera.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)
S4 CCALib8; C:\Program Files\Canon\CAL\CALMAIN.exe [96334 2009-09-08] (Canon Inc.) [File not signed]
S4 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [70656 2007-03-19] () [File not signed]
S3 lxct_device; C:\WINDOWS\system32\lxctcoms.exe [537520 2006-11-22] ( )
S3 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S3 NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [356352 2005-03-03] (Dell Inc.) [File not signed]
S3 PSEXESVC; C:\WINDOWS\PSEXESVC.EXE [181064 2013-05-24] (Sysinternals)
R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [2462160 2014-07-21] (Paramount Software UK Ltd)
R2 UPHClean; C:\Program Files\UPHClean\uphclean.exe [241725 2005-04-27] (Microsoft Corporation) [File not signed]
R2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe [3596752 2014-08-13] (Check Point Software Technologies Ltd.)
S4 wltrysvc; C:\WINDOWS\System32\bcmwltry.exe [1253376 2006-11-01] (Dell Inc.) [File not signed]
R2 ZAPrivacyService; C:\Program Files\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [96272 2014-08-13] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [16128 2004-08-18] (Dell Inc) [File not signed]
S3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [1287552 2008-06-02] (Broadcom Corporation)
S3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
R3 eapihdrv; C:\Documents and Settings\Karen\Local Settings\temp\ehdrv.sys [135760 2015-06-27] (ESET)
R3 HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [208384 2005-05-03] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.SYS [1033728 2005-05-03] (Conexant Systems, Inc.)
R0 KL1; C:\WINDOWS\System32\DRIVERS\kl1.sys [135776 2014-06-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [483936 2014-06-11] (Kaspersky Lab ZAO)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MREMPR5; C:\Program Files\Common Files\Motive\MREMPR5.sys [19345 2007-09-28] (Motive, Inc.) [File not signed]
S3 MRENDIS5; C:\Program Files\Common Files\Motive\MRENDIS5.sys [18003 2007-09-28] (Motive, Inc.) [File not signed]
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-13] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2003-03-31] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2003-03-31] (Microsoft Corporation)
S3 OZSCR; C:\WINDOWS\System32\DRIVERS\ozscr.sys [92550 2005-04-21] (O2Micro)
R0 pssnap; C:\WINDOWS\System32\DRIVERS\pssnap.sys [16504 2013-06-28] (Macrium Software)
R3 SRS_SSCFilter; C:\WINDOWS\System32\drivers\srs_sscfilter_i386.sys [268912 2009-12-15] ()
R3 STAC97; C:\WINDOWS\System32\drivers\stac97.sys [264440 2004-11-15] (SigmaTel, Inc.)
R1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
R1 Vsdatant; C:\WINDOWS\System32\vsdatant.sys [534024 2014-08-13] (Check Point Software Technologies Ltd.)
S3 VSTHWICH; C:\WINDOWS\System32\DRIVERS\VSTICH3.SYS [242176 2007-02-08] (Conexant Systems, Inc.) [File not signed]
S3 VST_DPV; C:\WINDOWS\System32\DRIVERS\VSTDPV3.SYS [987648 2007-10-13] (Conexant Systems, Inc.) [File not signed]
U5 AppMgmt; C:\WINDOWS\system32\svchost.exe [14336 2008-04-13] (Microsoft Corporation)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [74336 2014-06-11] (Kaspersky Lab ZAO)
S4 ProcObsrv; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-27 18:53 - 2015-06-27 18:53 - 00010521 _____ C:\Documents and Settings\Karen\Desktop\FRST.txt
2015-06-27 18:51 - 2015-06-27 18:53 - 00000000 ____D C:\FRST
2015-06-27 18:50 - 2015-06-27 18:50 - 01636352 _____ (Farbar) C:\Documents and Settings\Karen\Desktop\FRST.exe
2015-06-27 16:18 - 2015-06-27 16:18 - 00000159 _____ C:\WINDOWS\wiadebug.log
2015-06-27 16:18 - 2015-06-27 16:18 - 00000049 _____ C:\WINDOWS\wiaservc.log
2015-06-27 16:18 - 2015-06-27 16:18 - 00000000 _____ C:\WINDOWS\Sti_Trace.log
2015-06-27 02:28 - 2015-06-27 02:28 - 00000841 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-27 01:33 - 2015-06-27 01:33 - 00000628 _____ C:\WINDOWS\setupapi.log
2015-06-27 01:32 - 2015-06-27 01:32 - 00000000 ____D C:\Program Files\ESET
2015-06-19 12:07 - 2015-06-19 12:07 - 00000000 ____D C:\Documents and Settings\Karen\Desktop\Invoice 38540 from MZ MOVERS, INC
2015-06-18 21:57 - 2015-06-18 21:57 - 00000878 _____ C:\Documents and Settings\Karen\Desktop\speedtests-2015-06-19-014753.csv
2015-06-17 23:46 - 2015-06-18 22:01 - 00000886 _____ C:\Documents and Settings\Karen\Desktop\speedtests-2015-06-18-034529.csv
2015-06-16 22:37 - 2015-06-16 22:37 - 00000190 _____ C:\Documents and Settings\Karen\Desktop\speedtests-2015-06-17-023630.csv
2015-06-16 11:07 - 2015-06-17 23:51 - 00000753 _____ C:\Documents and Settings\Karen\Desktop\speedtests-2015-06-16-150617.csv
2015-06-09 16:54 - 2015-06-09 16:54 - 00000687 _____ C:\Documents and Settings\Karen\Desktop\TextMaker.lnk
2015-06-09 16:43 - 2015-06-09 16:56 - 00000000 ____D C:\Documents and Settings\Karen\Application Data\SoftMaker
2015-06-09 16:43 - 2015-06-09 16:54 - 00000000 ____D C:\Program Files\SoftMaker FreeOffice
2015-06-09 16:43 - 2015-06-09 16:43 - 00000000 ____D C:\Documents and Settings\Karen\Start Menu\Programs\SoftMaker FreeOffice
2015-06-09 16:43 - 2015-06-09 16:43 - 00000000 ____D C:\Documents and Settings\Karen\My Documents\SoftMaker
2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2015-06-05 16:43 - 2015-06-05 16:43 - 00001380 _____ C:\Documents and Settings\Karen\Desktop\Shortcut to ZoomModemConfiguration.lnk
2015-06-05 16:12 - 2015-06-05 16:12 - 00000000 ____D C:\Documents and Settings\Karen\Application Data\WinRAR
2015-06-05 16:08 - 2015-06-05 16:08 - 00000394 _____ C:\Documents and Settings\Karen\Desktop\Zoom Telephonics - Cable Provider Support.url
2015-06-05 15:51 - 2015-06-05 15:51 - 00000000 ____D C:\Documents and Settings\Karen\My Documents\Nye & CompanyAuctionInvoice#391
2015-06-05 15:50 - 2015-06-05 15:50 - 00044095 _____ C:\Documents and Settings\Karen\My Documents\Nye & CompanyAuctionInvoice#391.zip
2015-06-05 12:16 - 2015-06-05 12:16 - 00000000 ____D C:\Documents and Settings\Karen\Desktop\Jackson's International Lot 294
2015-06-04 16:54 - 2015-06-04 16:54 - 00000234 _____ C:\Documents and Settings\Karen\Desktop\Modem Configuration Status - Connection.url
2015-06-02 20:35 - 2015-06-02 20:35 - 01803318 _____ C:\Documents and Settings\Karen\Desktop\PesaventoZoomModemConnectionStatus.bmp
2015-06-01 22:32 - 2015-06-27 18:33 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-27 18:53 - 2013-05-23 22:20 - 00000000 ____D C:\Documents and Settings\Karen\Local Settings\temp
2015-06-27 14:28 - 2014-04-03 16:50 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-06-27 11:33 - 2008-03-17 15:37 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2015-06-27 11:33 - 2003-03-31 08:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2015-06-27 02:29 - 2009-07-04 16:06 - 00032652 _____ C:\WINDOWS\Tasks\SCHEDLGU.TXT
2015-06-27 02:28 - 2008-03-17 15:39 - 00000278 ___SH C:\Documents and Settings\Karen\ntuser.ini
2015-06-23 10:56 - 2008-09-14 12:32 - 00000000 ____D C:\Program Files\Lx_cats
2015-06-13 19:23 - 2014-06-17 15:11 - 00000000 ____D C:\Documents and Settings\Karen\Local Settings\Application Data\Adobe
2015-06-13 19:23 - 2013-06-09 22:23 - 00778416 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-06-13 19:23 - 2013-06-09 22:23 - 00142512 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-06-10 11:08 - 2013-12-14 18:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2015-06-10 11:08 - 2008-03-17 10:16 - 00292480 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-09 22:44 - 2014-04-03 16:49 - 00000777 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-09 22:44 - 2014-04-03 16:49 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-06-09 22:44 - 2014-04-03 16:49 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-09 17:27 - 2009-06-14 15:32 - 00000000 ____D C:\Documents and Settings\Karen\Desktop\Health Docs
2015-06-07 16:35 - 2013-05-23 22:20 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\temp
2015-06-07 16:35 - 2008-07-09 19:05 - 00000178 __SHC C:\Documents and Settings\Administrator\ntuser.ini
2015-06-01 14:32 - 2013-06-30 20:46 - 00000682 _____ C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2015-06-01 14:31 - 2013-06-30 20:45 - 00000000 ____D C:\Program Files\CCleaner

==================== Files in the root of some directories =======

2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2012-10-19 14:27 - 2012-10-19 14:27 - 1445888 _____ (Option^Explicit Software Solutions) C:\Program Files\WinsockxpFix.exe
2011-05-29 13:31 - 2015-03-29 16:12 - 0000004 ____C () C:\Documents and Settings\Karen\Application Data\QSWWShare
2014-09-09 22:47 - 2014-09-09 22:47 - 0129479 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\ars.cache
2014-09-09 22:47 - 2014-09-09 22:47 - 0144386 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\census.cache
2009-10-11 07:11 - 2009-10-11 07:11 - 0003584 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-28 20:09 - 2014-07-28 20:09 - 20025623 ____C () C:\Documents and Settings\All Users\SPL226.tmp
2015-02-26 18:14 - 2015-02-26 18:14 - 1471164 _____ () C:\Documents and Settings\All Users\SPL23F.tmp
2014-02-13 21:14 - 2014-02-13 21:14 - 0446381 ____C () C:\Documents and Settings\All Users\SPL4E1.tmp
2013-12-19 09:55 - 2013-12-19 09:55 - 1629351 ____C () C:\Documents and Settings\All Users\SPL78.tmp

Some files in TEMP:
====================
C:\Documents and Settings\Karen\Local Settings\temp\rarext.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



Here follows the Farber Addition log:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-06-2015
Ran by G**** at 2015-06-27 18:55:26
Running from C:\Documents and Settings\G****\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1060284298-1993962763-854245398-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
ASPNET (S-1-5-21-1060284298-1993962763-854245398-1005 - Limited - Enabled)
Guest (S-1-5-21-1060284298-1993962763-854245398-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-1060284298-1993962763-854245398-1000 - Limited - Disabled)
G**** (S-1-5-21-1060284298-1993962763-854245398-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Karen
SUPPORT_388945a0 (S-1-5-21-1060284298-1993962763-854245398-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Antivirus (Enabled - Up to date) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C}
FW: ZoneAlarm Firewall (Disabled) {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.41612 - ABBYY Software House)
Adblock Plus for IE (32-bit) (HKLM\...\{DF0E7912-4A45-4B24-B472-E521C4D2C663}) (Version: 99.9 - Eyeo GmbH)
Adblock Plus for IE (HKLM\...\{fd97d1e2-368a-4cd9-af63-8eeff938044a}) (Version: 1.1 - )
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.160 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.160 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 18.0.0.160 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AM-DeadLink 3.2 (HKLM\...\aignesamdeadlink) (Version: 3.2 - www.aignes.com)
ATI - Software Uninstall Utility (HKLM\...\All ATI Software) (Version: 6.14.10.1014 - )
ATI Control Panel (HKLM\...\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}) (Version: 6.14.10.5173 - )
ATI Display Driver (HKLM\...\ATI Display Driver) (Version: 8.20-051110a1-028793C-Dell - )
Auslogics DiskDefrag (HKLM\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Broadcom Management Programs 2 (Version: 7.82.01 - Broadcom) Hidden
Canon Auto Update Service (HKLM\...\Auto Update Service) (Version: 1.1.2.18 - Canon Inc.)
Canon Camera Access Library (HKLM\...\CAL) (Version: 8.5.0.2 - Canon Inc.)
CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.)
Canon MOV Decoder (HKLM\...\Canon MOV Decoder) (Version: 1.9.0.8 - Canon Inc.)
Canon MOV Encoder (HKLM\...\Canon MOV Encoder) (Version: 1.8.0.1 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 3.9.0.6 - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM\...\CameraWindowDC8) (Version: 8.6.0.11 - Canon Inc.)
Canon Utilities CameraWindow Launcher (HKLM\...\CameraWindowLauncher) (Version: 7.6.0.1 - Canon Inc.)
Canon Utilities Movie Uploader for YouTube (HKLM\...\MovieUploaderForYouTube) (Version: 1.3.0.3 - Canon Inc.)
Canon Utilities MyCamera (HKLM\...\MyCamera) (Version: 7.5.0.1 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.9.0.1 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.6.0.15 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
C-Major Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 42xx - SigmaTel)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Conexant D480 MDC V.92 Modem (HKLM\...\CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1) (Version: - )
Dell Driver Download Manager (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.)
DellSupport (HKLM\...\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}) (Version: 6.0.3075 - Dell)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
HD Tune 2.55 (HKLM\...\HD Tune_is1) (Version: - EFD Software)
Homeopathy Pro 1.0 (HKLM\...\Homeopathy Pro_is1) (Version: - Homeopathic Software, Inc)
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Processor ID Utility (HKLM\...\{A92A4DB0-CD37-42D1-BE1D-603D53C24328}) (Version: 4.20.0000 - Intel(R) Corporation)
Internal Network Card Power Management (HKLM\...\{1F528948-0E80-4C96-B455-DE4167CB1DF7}) (Version: 1.7.0 - )
Lexmark 5400 Series (HKLM\...\Lexmark 5400 Series) (Version: - Lexmark International, Inc.)
Macrium Reflect Free Edition (HKLM\...\MacriumReflect) (Version: 5.3 - Paramount Software (UK) Ltd.)
Macrium Reflect Free Edition (Version: 5.3.7299 - Paramount Software (UK) Ltd.) Hidden
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Media Player Classic - Home Cinema v. 1.3.1249.0 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: - )
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows Script 5.7 (HKLM\...\Windows Script) (Version: - Microsoft Corporation)
Microsoft Windows XP Video Decoder Checkup Utility (HKLM\...\DECCHECK) (Version: - )
Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\Move Networks Player - IE) (Version: - )
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 6 Service Pack 2 (KB954459) (HKLM\...\{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}) (Version: 6.20.1099.0 - Microsoft Corporation)
MWSnap 3 (HKLM\...\MWSnap 3) (Version: 3.0.0.74 - Mirek Wojtowicz)
O2Micro Smartcard Driver (HKLM\...\InstallShield_{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}) (Version: 2.26.0000 - O2Micro Electronics, Inc.)
O2Micro Smartcard Driver (Version: 2.26.0000 - O2Micro Electronics, Inc.) Hidden
Opera 12.15 (HKLM\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
Posit Science InSight (HKLM\...\Posit Science InSight) (Version: 1.3.12.37120 - )
QuickSet (HKLM\...\{C5074CC4-0E26-4716-A307-960272A90040}) (Version: 3.9.4 - )
Real Alternative 2.0.1 Lite (HKLM\...\RealAlt_is1) (Version: 2.0.1 - )
Revo Uninstaller 1.92 (HKLM\...\Revo Uninstaller) (Version: 1.92 - VS Revo Group)
SeaMonkey 2.33.1 (x86 en-US) (HKLM\...\SeaMonkey 2.33.1 (x86 en-US)) (Version: 2.33.1 - Mozilla)
Sibelius Scorch (ActiveX Only) (HKLM\...\{868291A4-229E-4795-B0B0-E60E87AF53CD}) (Version: 6.2.0 - Sibelius Software)
SoftMaker FreeOffice (HKLM\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3490 - SoftMaker Software GmbH)
Spotify (HKLM\...\Spotify) (Version: 0.5.2 - )
Spotify (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\Spotify) (Version: 0.8.3.222.g317ab79d - Spotify AB)
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
SRS Audio Sandbox (HKLM\...\{542C6F13-6861-4010-9EBC-6F068D397AD8}) (Version: 1.10.0200 - SRS Labs, Inc.)
System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - )
System Requirements Lab for Intel (HKLM\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
User Profile Hive Cleanup Service (HKLM\...\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}) (Version: 1.6.30 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)
Windows Installer Clean Up (HKLM\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Management Framework Core (HKLM\...\KB968930) (Version: - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
Wise Registry Cleaner 8.52 (HKLM\...\Wise Registry Cleaner_is1) (Version: 8.52 - WiseCleaner.com, Inc.)
ZoneAlarm Antivirus (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Antivirus + Firewall (HKLM\...\ZoneAlarm Free Antivirus + Firewall) (Version: 13.3.209.000 - Check Point)
ZoneAlarm Security (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security Toolbar (HKLM\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
ZoneAlarm Security Toolbar (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B4CA0}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{399254F2-670F-11D1-8092-0080ADB44B5C}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{399254F3-670F-11D1-8092-0080ADB44B5C}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{8a087491-5264-11d4-95F6-00A0CC3CCA14}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)

==================== Restore Points =========================

09-06-2015 16:43:20 Installed SoftMaker FreeOffice
12-06-2015 22:06:33 System Checkpoint
14-06-2015 01:11:43 System Checkpoint
17-06-2015 17:12:04 System Checkpoint
19-06-2015 13:57:36 System Checkpoint
20-06-2015 14:03:50 System Checkpoint
21-06-2015 15:38:57 System Checkpoint
23-06-2015 12:03:19 System Checkpoint
24-06-2015 17:16:21 System Checkpoint
26-06-2015 11:05:46 System Checkpoint
27-06-2015 13:21:39 System Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2003-03-31 08:00 - 2013-05-23 22:18 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_18_0_0_160_pepper.exe

==================== Loaded Modules (Whitelisted) ==============

2014-11-06 18:43 - 2015-03-21 23:33 - 00150528 _____ () C:\Program Files\SeaMonkey\NSLDAP32V60.dll
2014-11-06 18:43 - 2015-03-21 23:33 - 00014848 _____ () C:\Program Files\SeaMonkey\NSLDAPPR32V60.dll
2015-06-13 19:16 - 2015-06-13 19:16 - 17321648 _____ () C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll
2004-08-04 00:56 - 2008-04-13 20:11 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
2004-08-04 00:56 - 2008-04-13 20:11 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => " "= "Service "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => " "= "Service "

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\hola.org -> hxxp://hola.org

IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1001movie.com -> 1001movie.com

There are 6127 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Karen\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 209.18.47.61 - 209.18.47.62

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Documents and Settings^Karen^Start Menu^Programs^Startup^Secunia PSI.lnk => C:\WINDOWS\pss\Secunia PSI.lnkStartup
MSCONFIG\startupreg: LXCTCATS => rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

DomainProfile\AuthorizedApplications: [C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe] => Enabled:True Vector
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\fxsclnt.exe] => Enabled:Microsoft Fax Console
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\lxctcoms.exe] => Enabled:Lexmark Communications System
StandardProfile\AuthorizedApplications: [C:\Program Files\Opera 11.5\opera.exe] => Enabled:Opera Internet Browser
StandardProfile\AuthorizedApplications: [C:\Program Files\Spotify\spotify.exe] => Enabled:Spotify
StandardProfile\AuthorizedApplications: [C:\Program Files\VideoLAN\VLC\vlc.exe] => Enabled:VLC media player
StandardProfile\AuthorizedApplications: [C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe] => Enabled:True Vector
StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabledxpsp2res.dll,-22007
StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabledxpsp2res.dll,-22008
StandardProfile\GloballyOpenPorts: [5985:TCP] => Disabled:Windows Remote Management
StandardProfile\GloballyOpenPorts: [135:TCP] => EnabledCOM(135)

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 1370 WLAN Mini-PCI Card
Description: Dell Wireless 1370 WLAN Mini-PCI Card
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Broadcom
Service: BCM43XX
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action ", and then click "Enable Device ". This starts the Enable Device wizard. Follow the instructions.

Name: TSSTcorp CDRW/DVD TSL462C
Description: CD-ROM Drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action ", and then click "Enable Device ". This starts the Enable Device wizard. Follow the instructions.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver ", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/05/2015 10:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application plugin-container.exe, version 36.0.4.5558, faulting module mozalloc.dll, version 36.0.4.5558, fault address 0x00001295.
Processing media-specific event for [plugin-container.exe!ws!]

Error: (06/05/2015 10:18:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application plugin-container.exe, version 36.0.4.5558, faulting module mozalloc.dll, version 36.0.4.5558, fault address 0x00001295.
Processing media-specific event for [plugin-container.exe!ws!]

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.


System errors:
=============
Error: (06/26/2015 09:13:53 PM) (Source: Dhcp) (EventID: 1000) (User: )
Description: Your computer has lost the lease to its IP address 192.168.100.10 on the
Network Card with network address 001422D0C73D.

Error: (06/26/2015 09:13:08 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 74.72.153.185 for the Network Card with network address 001422D0C73D has been
denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

Error: (06/26/2015 11:25:13 AM) (Source: DCOM) (EventID: 10005) (User: HOME-63967577F9)
Description: DCOM got error "%%1058" attempting to start the service BITS with arguments " "
in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

Error: (06/26/2015 11:25:00 AM) (Source: DCOM) (EventID: 10005) (User: HOME-63967577F9)
Description: DCOM got error "%%1058" attempting to start the service BITS with arguments " "
in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

Error: (06/26/2015 10:40:04 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.

Error: (06/25/2015 03:12:18 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.

Error: (06/24/2015 01:57:44 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.

Error: (06/24/2015 10:41:09 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.

Error: (06/23/2015 06:32:35 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.

Error: (06/23/2015 10:49:31 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The IPv6 Helper Service service hung on starting.


Microsoft Office:
=========================
Error: (06/05/2015 10:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe36.0.4.5558mozalloc.dll36.0.4.555800001295

Error: (06/05/2015 10:18:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe36.0.4.5558mozalloc.dll36.0.4.555800001295

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtA connection with the server could not be established

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.


==================== Memory info ===========================

Processor: Intel(R) Celeron(R) M processor 1.40GHz
Percentage of memory in use: 90%
Total physical RAM: 1023.23 MB
Available physical RAM: 100.7 MB
Total Pagefile: 2459.48 MB
Available Pagefile: 944 MB
Total Virtual: 2047.88 MB
Available Virtual: 1939.52 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:74.53 GB) (Free:47.53 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: FB67FB67)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)

 

Broni:

Thanks for the instructions.

1) I deleted the registry cleaner.

2) I ran Rogue Killer and attach the report. There were some bad things!

3) I ran Malwarebytes; it didn't find anything (per usual).

I will continue on tomorrow and post results.



RogueKiller V10.8.6.0 [Jun 22 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Karen [Administrator]
Started from : C:\Documents and Settings\Karen\Desktop\RogueKiller.exe
Mode : Delete -- Date : 06/28/2015 14:01:23

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 7 ¤¤¤
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.toast.net/start/ -> Not selected
[PUM.HomePage] HKEY_USERS\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.toast.net/start/ -> Not selected
[PUM.SearchPage] HKEY_USERS\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.toast.net/start/ -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6F8B9387-4479-459B-8923-754EF11BEB77} | DhcpNameServer : 192.168.14.1 66.233.172.12 75.94.255.12 [-][UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6F8B9387-4479-459B-8923-754EF11BEB77} | DhcpNameServer : 192.168.14.1 66.233.172.12 75.94.255.12 [-][UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{6F8B9387-4479-459B-8923-754EF11BEB77} | DhcpNameServer : 192.168.14.1 66.233.172.12 75.94.255.12 [-][UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{6F8B9387-4479-459B-8923-754EF11BEB77} | DhcpNameServer : 192.168.14.1 66.233.172.12 75.94.255.12 [-][UNITED STATES (US)][UNITED STATES (US)] -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 1 ¤¤¤
[C:\WINDOWS\system32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS541680J9AT00 +++++
--- User ---
[MBR] eab71050ccd955f628319aa4ecd3e106
[BSP] eba2cebbdc06cde3da4432c02aba36d6 : Windows XP|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 76316 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_06282015_135502.log

 

Broni:

Attached is the log for AdwCleaner. You will note that I unchecked Check Point Technologies, as that is the parent for Zone Alarm, my anti-virus and firewall suite. Please let me know if this is all right before I proceed further.

# AdwCleaner v4.207 - Logfile created 29/06/2015 at 22:27:44
# Updated 21/06/2015 by Xplode
# Database : 2015-06-29.1 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : G***** - HOME-************
# Running from : C:\Documents and Settings\G****\Desktop\adwcleaner_4.207.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

[x] Not Deleted : C:\Program Files\Check Point Software Technologies LTD
[x] Not Deleted : C:\Documents and Settings\Karen\Application Data\Check Point Software Technologies LTD
Folder Deleted : C:\Documents and Settings\Karen\Favorites\Search
Folder Deleted : C:\Documents and Settings\Karen\Favorites\radio
File Deleted : C:\Documents and Settings\G****\Application Data\QSWWShare

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F1963E76-845B-474C-8C7F-D69A96D8AA34}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

***** [ Web browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Opera v0.0.0.0


*************************

AdwCleaner[R0].txt - [5212 bytes] - [29/06/2015 21:59:50]
AdwCleaner[S0].txt - [5247 bytes] - [29/06/2015 22:27:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5306 bytes] ##########

 

Broni:

Attached is the Junkware Removal Tool log. You'll notice that there was an error message during Process checking; I don't know if that makes a problem or not. Please advise!


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.3 (06.30.2015:1)
OS: Microsoft Windows XP x86
Ran by G**** on Tue 06/30/2015 at 14:59:03.91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{FB0D385B-5C61-4AFF-BBB8-A1DC7F93EE0E}



~~~ Files



~~~ Informational

C:\WINDOWS\system32\tasklist.exe doesn't exist [Process check skipped . Windows XP Home Edition?]



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 06/30/2015 at 15:11:40.34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Broni:

Before I run Combofix, I have some questions.

After I ran Junkware Remover Tool, some basic things on my system have been altered. I lost my desktop background picture, which I was able to re-install. However, I also lost my preferred browser (Duckduckgo) in IE8, and now can't re-install it. All the discussions online of problems (IE updates, etc.) do not apply to my system as Microsoft no longer supports XP, and I have turned off Automatic Updates.

Is this normal after running JRT, or is something else going on? I'd like to know before proceeding with Combofix, which in my experience also can make significant changes.

Thanks.

 

Broni:

Re: JRT removed unknown IE search engine - that was probably my Duckduckgo (sigh).

Re: Combofix - I installed and started running the program. A box popped up saying I needed to shut off my Avast anti-virus. However, I uninstalled Avast over 9 months ago. I did an Explorer 'Search', and ran Autoruns, to see if I had leftover Avast files, but couldn't find anything. I restarted Combofix and got the same message, so I aborted it.

There still must be Avast fragments in my registry which Combofix can't tolerate. What should I do? Please advise. Thanks.

 

Broni:

I re-ran Combofix, ignoring it's problem w/the Avast fragments.

Here is the log:


ComboFix 15-06-30.01 - G**** 07/03/2015 13:50:07.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.502 [GMT -4:00]
Running from: c:\documents and settings\G****\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Prevx 2.0 *Disabled/Updated* {557C3342-BC52-4508-AC25-4441BDF5C04C}
AV: ZoneAlarm Antivirus *Disabled/Updated* {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\SPL226.tmp
c:\documents and settings\All Users\SPL23F.tmp
c:\documents and settings\All Users\SPL4E1.tmp
c:\documents and settings\All Users\SPL78.tmp
c:\documents and settings\Karen\My Documents\~WRD2755.tmp
c:\documents and settings\Karen\My Documents\~WRL1452.tmp
c:\program files\Internet Explorer\SET24B.tmp
c:\program files\Internet Explorer\SET24D.tmp
c:\program files\Internet Explorer\SETFD.tmp
c:\program files\Internet Explorer\SETFF.tmp
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\SET238.tmp
c:\windows\system32\SET239.tmp
c:\windows\system32\SET23A.tmp
c:\windows\system32\SET23E.tmp
c:\windows\system32\SET23F.tmp
c:\windows\system32\SET240.tmp
c:\windows\system32\SET242.tmp
c:\windows\system32\SET244.tmp
c:\windows\system32\SET245.tmp
c:\windows\system32\SET246.tmp
c:\windows\system32\SET249.tmp
c:\windows\system32\SETDB.tmp
c:\windows\system32\SETDC.tmp
c:\windows\system32\SETEB.tmp
c:\windows\system32\SETEC.tmp
c:\windows\system32\SETED.tmp
c:\windows\system32\SETF1.tmp
c:\windows\system32\SETF2.tmp
c:\windows\system32\SETF3.tmp
c:\windows\system32\SETF7.tmp
c:\windows\system32\SETF8.tmp
c:\windows\system32\SETF9.tmp
c:\windows\wininit.ini
c:\windows\system32\drivers\etc\lmhosts . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2015-06-03 to 2015-07-03 )))))))))))))))))))))))))))))))
.
.
2015-06-30 18:59 . 2015-06-30 18:59 -------- d-----w- C:\RegBackup
2015-06-30 01:59 . 2015-06-30 02:28 -------- d-----w- C:\AdwCleaner
2015-06-28 17:43 . 2015-06-28 17:43 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-06-28 17:43 . 2015-06-28 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\RogueKiller
2015-06-28 00:10 . 2015-06-28 00:10 -------- d-----w- c:\program files\Speccy
2015-06-27 22:51 . 2015-06-27 22:58 -------- d-----w- C:\FRST
2015-06-27 05:32 . 2015-06-27 05:32 -------- d-----w- c:\program files\ESET
2015-06-09 20:43 . 2015-06-09 20:56 -------- d-----w- c:\documents and settings\Karen\Application Data\SoftMaker
2015-06-09 20:43 . 2015-06-09 20:54 -------- d-----w- c:\program files\SoftMaker FreeOffice
2015-06-09 19:44 . 2015-06-09 19:46 61687304 ----a-w- c:\program files\freeofficewindows.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-07-01 16:30 . 2013-06-10 02:23 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-07-01 16:30 . 2013-06-10 02:23 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-06-28 18:08 . 2014-04-03 20:50 98520 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-06-18 12:41 . 2014-04-03 20:49 121560 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-06-18 12:41 . 2014-04-03 20:49 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-10-19 18:27 . 2012-10-19 18:27 1445888 ----a-w- c:\program files\WinsockxpFix.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA "= "c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
"ZoneAlarm "= "c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2014-08-13 137352]
"LXCTCATS "= "c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SoftwareSASGeneration "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro36.sys]
@=" "
.
[HKLM\~\startupfolder\C:^Documents and Settings^Karen^Start Menu^Programs^Startup^Secunia PSI.lnk]
backup=c:\windows\pss\Secunia PSI.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXCTCATS]
2006-11-21 18:27 106496 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\lxcttime.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Fax "=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"LXCTCATS "=rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe "
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\WINDOWS\\system32\\fxsclnt.exe "=
"c:\\WINDOWS\\system32\\lxctcoms.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Opera 11.5\\opera.exe "=
"c:\\Program Files\\Spotify\\spotify.exe "=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe "=
"c:\\Program Files\\CheckPoint\\ZoneAlarm\\vsmon.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP "= 5985:TCP:*isabled:Windows Remote Management
"135:TCP "= 135:TCPCOM(135)
.
R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [6/28/2013 4:02 PM 16504]
R2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [7/21/2014 1:22 PM 2462160]
R2 ZAPrivacyService;ZoneAlarm Privacy Service;c:\program files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [8/13/2014 10:16 AM 96272]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [4/3/2014 4:49 PM 23256]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [4/3/2014 4:49 PM 1133880]
S3 eapihdrv;eapihdrv;\??\c:\docume~1\Karen\LOCALS~1\Temp\ehdrv.sys --> c:\docume~1\Karen\LOCALS~1\Temp\ehdrv.sys [?]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [3/17/2008 6:25 PM 92550]
S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [7/15/2012 9:36 PM 181064]
S3 VST_DPV;VST_DPV;c:\windows\system32\drivers\VSTDPV3.SYS [5/31/2009 3:08 PM 987648]
S3 VSTHWICH;VSTHWICH;c:\windows\system32\drivers\VSTICH3.SYS [5/31/2009 3:08 PM 242176]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - SASKUTIL
*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder
.
2015-07-02 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_18_0_0_194_pepper.exe [2015-06-29 02:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.toast.net/start/
mStart Page = hxxp://www.toast.net/start/
Trusted Zone: hola.org
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil32_17_0_0_188_pepper.exe
Notify-AutorunsDisabled - SDWinLogon.dll
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-07-03 14:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_194_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_18_0_0_194_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"v5Licence0 "= "15-JRW3-QC95-ANW7-73R1-VJEK-EBVTT99 "
"Activated "= "Y "
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(4760)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\UPHClean\uphclean.exe
c:\windows\system32\lxctcoms.exe
.
**************************************************************************
.
Completion time: 2015-07-03 14:10:47 - machine was rebooted
ComboFix-quarantined-files.txt 2015-07-03 18:10
.
Pre-Run: 51,042,992,128 bytes free
Post-Run: 51,287,519,232 bytes free
.
- - End Of File - - 9F8311BECF732489035B8BC34B6DB944
8F558EB6672622401DA993E1E865C861

 

Broni:

Attached is the FRST and Addition logs.

I note that in the Addition log, there are files for Avast, PrevX and Secunia programs, which I uninstalled some time ago. I am particularly worried about the Avast, as it is shown as active, and could be causing conflicts with my present A/V, Zone Alarm. Is it possible to delete these files?


FRST-

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-06-2015 (ATTENTION: ====> FRSTversion is 9 days old and could be outdated)
Ran by G**** (administrator) on HOME-63967577F9 on 03-07-2015 19:31:48
Running from C:\Documents and Settings\G****\Desktop
Loaded Profiles: G**** (Available Profiles: G**** & Administrator)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Paramount Software UK Ltd) C:\Program Files\Macrium\Reflect\ReflectService.exe
(Microsoft Corporation) C:\Program Files\UPHClean\uphclean.exe
(Check Point Software Technologies, Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Check Point Software Technologies Ltd.) C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
( ) C:\WINDOWS\system32\lxctcoms.exe
(mozilla.org) C:\Program Files\SeaMonkey\seamonkey.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ATIPTA] => C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2005-11-10] (ATI Technologies, Inc.)
HKLM\...\Run: [ZoneAlarm] => C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-08-13] (Check Point Software Technologies Ltd.)
HKLM\...\Run: [LXCTCATS] => rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2005-11-10] (ATI Technologies Inc.)
Startup: C:\Documents and Settings\Karen\Start Menu\Programs\Startup\AutorunsDisabled [2014-03-18] ()
BootExecute: autocheck autochk *
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toast.net/start/
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toast.net/start/
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2014-08-12] (Adblock Plus)
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] ()
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-10-21]

Opera:
=======
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera 11.5\Opera.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)
S4 CCALib8; C:\Program Files\Canon\CAL\CALMAIN.exe [96334 2009-09-08] (Canon Inc.) [File not signed]
S4 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [70656 2007-03-19] () [File not signed]
R3 lxct_device; C:\WINDOWS\system32\lxctcoms.exe [537520 2006-11-22] ( )
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [356352 2005-03-03] (Dell Inc.) [File not signed]
S3 PSEXESVC; C:\WINDOWS\PSEXESVC.EXE [181064 2013-05-24] (Sysinternals)
R2 ReflectService.exe; C:\Program Files\Macrium\Reflect\ReflectService.exe [2462160 2014-07-21] (Paramount Software UK Ltd)
R2 UPHClean; C:\Program Files\UPHClean\uphclean.exe [241725 2005-04-27] (Microsoft Corporation) [File not signed]
R2 vsmon; C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe [3596752 2014-08-13] (Check Point Software Technologies Ltd.)
S4 wltrysvc; C:\WINDOWS\System32\bcmwltry.exe [1253376 2006-11-01] (Dell Inc.) [File not signed]
R2 ZAPrivacyService; C:\Program Files\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [96272 2014-08-13] (Check Point Software Technologies, Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [16128 2004-08-18] (Dell Inc) [File not signed]
S3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [1287552 2008-06-02] (Broadcom Corporation)
S3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
R3 HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [208384 2005-05-03] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.SYS [1033728 2005-05-03] (Conexant Systems, Inc.)
R0 KL1; C:\WINDOWS\System32\DRIVERS\kl1.sys [135776 2014-06-11] (Kaspersky Lab ZAO)
R1 KLIF; C:\WINDOWS\System32\DRIVERS\klif.sys [483936 2014-06-11] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MREMPR5; C:\Program Files\Common Files\Motive\MREMPR5.sys [19345 2007-09-28] (Motive, Inc.) [File not signed]
S3 MRENDIS5; C:\Program Files\Common Files\Motive\MRENDIS5.sys [18003 2007-09-28] (Motive, Inc.) [File not signed]
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-13] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2003-03-31] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2003-03-31] (Microsoft Corporation)
S3 OZSCR; C:\WINDOWS\System32\DRIVERS\ozscr.sys [92550 2005-04-21] (O2Micro)
R0 pssnap; C:\WINDOWS\System32\DRIVERS\pssnap.sys [16504 2013-06-28] (Macrium Software)
R3 SRS_SSCFilter; C:\WINDOWS\System32\drivers\srs_sscfilter_i386.sys [268912 2009-12-15] ()
R3 STAC97; C:\WINDOWS\System32\drivers\stac97.sys [264440 2004-11-15] (SigmaTel, Inc.)
R1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
R1 Vsdatant; C:\WINDOWS\System32\vsdatant.sys [534024 2014-08-13] (Check Point Software Technologies Ltd.)
S3 VSTHWICH; C:\WINDOWS\System32\DRIVERS\VSTICH3.SYS [242176 2007-02-08] (Conexant Systems, Inc.) [File not signed]
S3 VST_DPV; C:\WINDOWS\System32\DRIVERS\VSTDPV3.SYS [987648 2007-10-13] (Conexant Systems, Inc.) [File not signed]
U5 AppMgmt; C:\WINDOWS\system32\svchost.exe [14336 2008-04-13] (Microsoft Corporation)
R3 catchme; \??\C:\DOCUME~1\G****\LOCALS~1\Temp\catchme.sys [X]
S3 eapihdrv; \??\C:\DOCUME~1\G****\LOCALS~1\Temp\ehdrv.sys [X]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [74336 2014-06-11] (Kaspersky Lab ZAO)
S4 ProcObsrv; No ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr; No ImagePath
U3 mbr; \??\C:\DOCUME~1\Karen\LOCALS~1\Temp\mbr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-03 14:28 - 2015-07-03 14:28 - 00000159 _____ C:\WINDOWS\wiadebug.log
2015-07-03 14:28 - 2015-07-03 14:28 - 00000048 _____ C:\WINDOWS\wiaservc.log
2015-07-03 14:28 - 2015-07-03 14:28 - 00000000 _____ C:\WINDOWS\Sti_Trace.log
2015-07-03 14:10 - 2015-07-03 14:10 - 00011501 _____ C:\ComboFix.txt
2015-07-03 14:10 - 2015-07-03 14:10 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\temp
2015-07-03 14:10 - 2015-07-03 14:10 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\temp
2015-07-03 14:10 - 2015-07-03 14:10 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\temp
2015-07-03 13:46 - 2011-06-26 02:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2015-07-03 13:46 - 2010-11-07 13:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2015-07-03 13:46 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00098816 _____ C:\WINDOWS\sed.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00080412 _____ C:\WINDOWS\grep.exe
2015-07-03 13:46 - 2000-08-30 20:00 - 00068096 _____ C:\WINDOWS\zip.exe
2015-07-03 00:41 - 2015-07-03 14:05 - 00006579 _____ C:\WINDOWS\WindowsUpdate.log
2015-07-02 14:20 - 2015-07-03 14:10 - 00000000 ____D C:\Qoobox
2015-07-02 14:15 - 2015-07-02 14:15 - 05631262 ____R (Swearware) C:\Documents and Settings\G****\Desktop\ComboFix.exe
2015-06-30 15:12 - 2015-06-30 15:12 - 00000884 _____ C:\Documents and Settings\G****\Desktop\JRT2.txt
2015-06-30 15:11 - 2015-06-30 15:11 - 00000884 _____ C:\Documents and Settings\G****\Desktop\JRT.txt
2015-06-30 14:59 - 2015-06-30 14:59 - 00000000 ____D C:\RegBackup
2015-06-30 14:56 - 2015-06-30 14:56 - 02951929 _____ (Malwarebytes Corporation) C:\Documents and Settings\Karen\Desktop\JRT.exe
2015-06-29 22:31 - 2015-06-29 22:31 - 00005386 _____ C:\Documents and Settings\G****\Desktop\AdwCleaner[S0].txt
2015-06-29 21:59 - 2015-06-29 22:28 - 00000000 ____D C:\AdwCleaner
2015-06-29 21:54 - 2015-06-29 21:53 - 02244096 _____ C:\Documents and Settings\G****\Desktop\adwcleaner_4.207.exe
2015-06-28 14:02 - 2015-06-28 14:02 - 00002716 _____ C:\Documents and Settings\G****\Desktop\RKreport_DEL_06282015_140122.log
2015-06-28 13:43 - 2015-06-28 14:17 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RogueKiller
2015-06-28 13:43 - 2015-06-28 13:43 - 00035064 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2015-06-28 13:38 - 2015-06-28 13:38 - 17679608 _____ C:\Documents and Settings\G****\Desktop\RogueKiller.exe
2015-06-27 20:10 - 2015-06-27 20:10 - 00000654 _____ C:\Documents and Settings\G****\Desktop\Speccy.lnk
2015-06-27 20:10 - 2015-06-27 20:10 - 00000000 ____D C:\Program Files\Speccy
2015-06-27 20:10 - 2015-06-27 20:10 - 00000000 ____D C:\Documents and Settings\G****\Start Menu\Programs\Speccy
2015-06-27 18:55 - 2015-06-27 18:58 - 00031730 _____ C:\Documents and Settings\G****\Desktop\Addition.txt
2015-06-27 18:53 - 2015-07-03 19:32 - 00009791 _____ C:\Documents and Settings\G****\Desktop\FRST.txt
2015-06-27 18:51 - 2015-07-03 19:31 - 00000000 ____D C:\FRST
2015-06-27 18:50 - 2015-06-27 18:50 - 01636352 _____ (Farbar) C:\Documents and Settings\Karen\Desktop\FRST.exe
2015-06-27 01:32 - 2015-06-27 01:32 - 00000000 ____D C:\Program Files\ESET
2015-06-19 12:07 - 2015-06-19 12:07 - 00000000 ____D C:\Documents and Settings\G****\Desktop\Invoice 38540 from MZ MOVERS, INC
2015-06-18 21:57 - 2015-06-18 21:57 - 00000878 _____ C:\Documents and Settings\G****\Desktop\speedtests-2015-06-19-014753.csv
2015-06-17 23:46 - 2015-06-18 22:01 - 00000886 _____ C:\Documents and Settings\G****\Desktop\speedtests-2015-06-18-034529.csv
2015-06-16 22:37 - 2015-06-16 22:37 - 00000190 _____ C:\Documents and Settings\G****\Desktop\speedtests-2015-06-17-023630.csv
2015-06-16 11:07 - 2015-06-17 23:51 - 00000753 _____ C:\Documents and Settings\G****\Desktop\speedtests-2015-06-16-150617.csv
2015-06-09 16:54 - 2015-06-09 16:54 - 00000687 _____ C:\Documents and Settings\G****\Desktop\TextMaker.lnk
2015-06-09 16:43 - 2015-06-09 16:56 - 00000000 ____D C:\Documents and Settings\G****\Application Data\SoftMaker
2015-06-09 16:43 - 2015-06-09 16:54 - 00000000 ____D C:\Program Files\SoftMaker FreeOffice
2015-06-09 16:43 - 2015-06-09 16:43 - 00000000 ____D C:\Documents and Settings\G****\Start Menu\Programs\SoftMaker FreeOffice
2015-06-09 16:43 - 2015-06-09 16:43 - 00000000 ____D C:\Documents and Settings\G****\My Documents\SoftMaker
2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2015-06-05 16:43 - 2015-06-05 16:43 - 00001380 _____ C:\Documents and Settings\G****\Desktop\Shortcut to ZoomModemConfiguration.lnk
2015-06-05 16:12 - 2015-06-05 16:12 - 00000000 ____D C:\Documents and Settings\G****\Application Data\WinRAR
2015-06-05 16:08 - 2015-06-05 16:08 - 00000394 _____ C:\Documents and Settings\G****\Desktop\Zoom Telephonics - Cable Provider Support.url
2015-06-05 15:51 - 2015-06-05 15:51 - 00000000 ____D C:\Documents and Settings\G****\My Documents\Nye & CompanyAuctionInvoice#391
2015-06-05 15:50 - 2015-06-05 15:50 - 00044095 _____ C:\Documents and Settings\G****\My Documents\Nye & CompanyAuctionInvoice#391.zip
2015-06-05 12:16 - 2015-06-05 12:16 - 00000000 ____D C:\Documents and Settings\G****\Desktop\Jackson's International Lot 294
2015-06-04 16:54 - 2015-06-04 16:54 - 00000234 _____ C:\Documents and Settings\G****\Desktop\Modem Configuration Status - Connection.url

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-03 19:32 - 2013-05-23 22:20 - 00000000 ____D C:\Documents and Settings\G****\Local Settings\temp
2015-07-03 14:10 - 2008-03-17 15:34 - 00000000 __SHD C:\Documents and Settings\NetworkService
2015-07-03 14:04 - 2008-03-17 15:37 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2015-07-03 14:04 - 2003-03-31 08:00 - 00000227 _____ C:\WINDOWS\system.ini
2015-07-03 14:03 - 2008-03-17 15:39 - 00000278 ___SH C:\Documents and Settings\G****\ntuser.ini
2015-07-03 13:47 - 2009-07-04 16:06 - 00032652 _____ C:\WINDOWS\Tasks\SCHEDLGU.TXT
2015-07-02 14:29 - 2015-06-01 22:32 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-07-02 14:19 - 2008-03-20 19:06 - 00000000 ____D C:\WINDOWS\ERDNT
2015-07-01 12:33 - 2014-06-17 15:11 - 00000000 ____D C:\Documents and Settings\G****\Local Settings\Application Data\Adobe
2015-07-01 12:30 - 2013-06-09 22:23 - 00778416 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-07-01 12:30 - 2013-06-09 22:23 - 00142512 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-07-01 11:25 - 2008-03-17 16:20 - 00078272 ____C C:\Documents and Settings\G****\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2015-06-28 22:47 - 2010-04-18 14:39 - 00000000 ____D C:\Program Files\SpywareBlaster
2015-06-28 22:38 - 2013-06-30 20:46 - 00000682 _____ C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2015-06-28 22:38 - 2013-06-30 20:45 - 00000000 ____D C:\Program Files\CCleaner
2015-06-28 14:08 - 2014-04-03 16:50 - 00098520 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-06-28 14:06 - 2014-04-03 16:49 - 00000777 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-28 14:06 - 2014-04-03 16:49 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-06-28 14:06 - 2014-04-03 16:49 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-28 13:31 - 2011-07-24 14:40 - 00000000 ___RD C:\Documents and Settings\All Users\Start Menu\Programs\Wise Registry Cleaner Free
2015-06-28 13:18 - 2008-09-14 12:32 - 00000000 ____D C:\Program Files\Lx_cats
2015-06-28 13:17 - 2003-03-31 08:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2015-06-18 08:41 - 2014-04-03 16:49 - 00121560 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-06-18 08:41 - 2014-04-03 16:49 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-10 11:08 - 2013-12-14 18:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2015-06-10 11:08 - 2008-03-17 10:16 - 00292480 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-09 17:27 - 2009-06-14 15:32 - 00000000 ____D C:\Documents and Settings\G****\Desktop\Health Docs
2015-06-07 16:35 - 2008-07-09 19:05 - 00000178 __SHC C:\Documents and Settings\Administrator\ntuser.ini

==================== Files in the root of some directories =======

2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2012-10-19 14:27 - 2012-10-19 14:27 - 1445888 _____ (Option^Explicit Software Solutions) C:\Program Files\WinsockxpFix.exe
2014-09-09 22:47 - 2014-09-09 22:47 - 0129479 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\ars.cache
2014-09-09 22:47 - 2014-09-09 22:47 - 0144386 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\census.cache
2009-10-11 07:11 - 2009-10-11 07:11 - 0003584 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


Addition-

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-06-2015
Ran by G**** at 2015-07-03 19:33:30
Running from C:\Documents and Settings\G****\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1060284298-1993962763-854245398-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
ASPNET (S-1-5-21-1060284298-1993962763-854245398-1005 - Limited - Enabled)
Guest (S-1-5-21-1060284298-1993962763-854245398-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-1060284298-1993962763-854245398-1000 - Limited - Disabled)
***** (S-1-5-21-1060284298-1993962763-854245398-1004 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\G****
SUPPORT_388945a0 (S-1-5-21-1060284298-1993962763-854245398-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Antivirus (Disabled - Up to date) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C}
FW: ZoneAlarm Firewall (Disabled) {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ABBYY FineReader 6.0 Sprint (HKLM\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.41612 - ABBYY Software House)
Adblock Plus for IE (32-bit) (HKLM\...\{DF0E7912-4A45-4B24-B472-E521C4D2C663}) (Version: 99.9 - Eyeo GmbH)
Adblock Plus for IE (HKLM\...\{fd97d1e2-368a-4cd9-af63-8eeff938044a}) (Version: 1.1 - )
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AM-DeadLink 3.2 (HKLM\...\aignesamdeadlink) (Version: 3.2 - www.aignes.com)
ATI - Software Uninstall Utility (HKLM\...\All ATI Software) (Version: 6.14.10.1014 - )
ATI Control Panel (HKLM\...\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}) (Version: 6.14.10.5173 - )
ATI Display Driver (HKLM\...\ATI Display Driver) (Version: 8.20-051110a1-028793C-Dell - )
Auslogics DiskDefrag (HKLM\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: 5.4.0.0 - Auslogics Labs Pty Ltd)
Broadcom Management Programs 2 (Version: 7.82.01 - Broadcom) Hidden
Canon Auto Update Service (HKLM\...\Auto Update Service) (Version: 1.1.2.18 - Canon Inc.)
Canon Camera Access Library (HKLM\...\CAL) (Version: 8.5.0.2 - Canon Inc.)
CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.)
Canon MOV Decoder (HKLM\...\Canon MOV Decoder) (Version: 1.9.0.8 - Canon Inc.)
Canon MOV Encoder (HKLM\...\Canon MOV Encoder) (Version: 1.8.0.1 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM\...\MovieEditTask) (Version: 3.9.0.6 - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM\...\CameraWindowDC8) (Version: 8.6.0.11 - Canon Inc.)
Canon Utilities CameraWindow Launcher (HKLM\...\CameraWindowLauncher) (Version: 7.6.0.1 - Canon Inc.)
Canon Utilities Movie Uploader for YouTube (HKLM\...\MovieUploaderForYouTube) (Version: 1.3.0.3 - Canon Inc.)
Canon Utilities MyCamera (HKLM\...\MyCamera) (Version: 7.5.0.1 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.9.0.1 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.6.0.15 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform)
C-Major Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 42xx - SigmaTel)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Conexant D480 MDC V.92 Modem (HKLM\...\CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1) (Version: - )
Dell Driver Download Manager (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.)
DellSupport (HKLM\...\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}) (Version: 6.0.3075 - Dell)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
HD Tune 2.55 (HKLM\...\HD Tune_is1) (Version: - EFD Software)
Homeopathy Pro 1.0 (HKLM\...\Homeopathy Pro_is1) (Version: - Homeopathic Software, Inc)
ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Processor ID Utility (HKLM\...\{A92A4DB0-CD37-42D1-BE1D-603D53C24328}) (Version: 4.20.0000 - Intel(R) Corporation)
Internal Network Card Power Management (HKLM\...\{1F528948-0E80-4C96-B455-DE4167CB1DF7}) (Version: 1.7.0 - )
Lexmark 5400 Series (HKLM\...\Lexmark 5400 Series) (Version: - Lexmark International, Inc.)
Macrium Reflect Free Edition (HKLM\...\MacriumReflect) (Version: 5.3 - Paramount Software (UK) Ltd.)
Macrium Reflect Free Edition (Version: 5.3.7299 - Paramount Software (UK) Ltd.) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Media Player Classic - Home Cinema v. 1.3.1249.0 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: - )
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows Script 5.7 (HKLM\...\Windows Script) (Version: - Microsoft Corporation)
Microsoft Windows XP Video Decoder Checkup Utility (HKLM\...\DECCHECK) (Version: - )
Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\Move Networks Player - IE) (Version: - )
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 6 Service Pack 2 (KB954459) (HKLM\...\{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}) (Version: 6.20.1099.0 - Microsoft Corporation)
MWSnap 3 (HKLM\...\MWSnap 3) (Version: 3.0.0.74 - Mirek Wojtowicz)
O2Micro Smartcard Driver (HKLM\...\InstallShield_{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}) (Version: 2.26.0000 - O2Micro Electronics, Inc.)
O2Micro Smartcard Driver (Version: 2.26.0000 - O2Micro Electronics, Inc.) Hidden
Opera 12.15 (HKLM\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
Posit Science InSight (HKLM\...\Posit Science InSight) (Version: 1.3.12.37120 - )
QuickSet (HKLM\...\{C5074CC4-0E26-4716-A307-960272A90040}) (Version: 3.9.4 - )
Real Alternative 2.0.1 Lite (HKLM\...\RealAlt_is1) (Version: 2.0.1 - )
Revo Uninstaller 1.92 (HKLM\...\Revo Uninstaller) (Version: 1.92 - VS Revo Group)
SeaMonkey 2.33.1 (x86 en-US) (HKLM\...\SeaMonkey 2.33.1 (x86 en-US)) (Version: 2.33.1 - Mozilla)
Sibelius Scorch (ActiveX Only) (HKLM\...\{868291A4-229E-4795-B0B0-E60E87AF53CD}) (Version: 6.2.0 - Sibelius Software)
SoftMaker FreeOffice (HKLM\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3490 - SoftMaker Software GmbH)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Spotify (HKLM\...\Spotify) (Version: 0.5.2 - )
Spotify (HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\Spotify) (Version: 0.8.3.222.g317ab79d - Spotify AB)
SpywareBlaster 5.0 (HKLM\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
SRS Audio Sandbox (HKLM\...\{542C6F13-6861-4010-9EBC-6F068D397AD8}) (Version: 1.10.0200 - SRS Labs, Inc.)
System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - )
System Requirements Lab for Intel (HKLM\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
User Profile Hive Cleanup Service (HKLM\...\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}) (Version: 1.6.30 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)
Windows Installer Clean Up (HKLM\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Management Framework Core (HKLM\...\KB968930) (Version: - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
ZoneAlarm Antivirus (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Antivirus + Firewall (HKLM\...\ZoneAlarm Free Antivirus + Firewall) (Version: 13.3.209.000 - Check Point)
ZoneAlarm Security (Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B4CA0}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{0295691A-D674-4904-805C-BDFE165B771B}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{30291A01-707C-11d0-B457-4446490043BF}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{399254F2-670F-11D1-8092-0080ADB44B5C}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{399254F3-670F-11D1-8092-0080ADB44B5C}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{8a087491-5264-11d4-95F6-00A0CC3CCA14}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\PlanMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{bf608490-5373-11d0-8efb-4446490043bf}\localserver32 -> C:\Program Files\SoftMaker FreeOffice\TextMaker.exe (SoftMaker Software GmbH)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-1060284298-1993962763-854245398-1004_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Documents and Settings\Karen\Application Data\Move Networks\ie_bin\qsp2ie07103010.dll (Move Networks)

==================== Restore Points =========================

14-06-2015 01:11:43 System Checkpoint
17-06-2015 17:12:04 System Checkpoint
19-06-2015 13:57:36 System Checkpoint
20-06-2015 14:03:50 System Checkpoint
21-06-2015 15:38:57 System Checkpoint
23-06-2015 12:03:19 System Checkpoint
24-06-2015 17:16:21 System Checkpoint
26-06-2015 11:05:46 System Checkpoint
27-06-2015 13:21:39 System Checkpoint
28-06-2015 13:30:12 Revo Uninstaller's restore point - Wise Registry Cleaner 8.52
29-06-2015 18:08:38 System Checkpoint
01-07-2015 11:42:03 Revo Uninstaller's restore point - ZoneAlarm Security Toolbar
02-07-2015 17:25:04 System Checkpoint
03-07-2015 17:43:23 System Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2003-03-31 08:00 - 2013-05-23 22:18 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_18_0_0_194_pepper.exe

==================== Loaded Modules (Whitelisted) ==============

2012-03-03 18:35 - 2006-10-18 07:36 - 00045056 _____ () C:\WINDOWS\system32\lxctpmon.dll
2012-03-03 18:34 - 2006-10-18 06:30 - 00032768 _____ () C:\Program Files\Lexmark 5400 Series\ipcmt.dll
2012-03-03 18:36 - 2006-11-13 05:35 - 00118784 _____ () C:\WINDOWS\System32\spool\PRTPROCS\W32X86\lxctdrpp.dll
2014-11-06 18:43 - 2015-03-21 23:33 - 00150528 _____ () C:\Program Files\SeaMonkey\NSLDAP32V60.dll
2014-11-06 18:43 - 2015-03-21 23:33 - 00014848 _____ () C:\Program Files\SeaMonkey\NSLDAPPR32V60.dll
2004-08-04 00:56 - 2013-01-02 02:49 - 01292288 _____ () C:\WINDOWS\system32\quartz.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => " "= "Service "

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\hola.org -> hxxp://hola.org

IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-1060284298-1993962763-854245398-1004\...\1001movie.com -> 1001movie.com

There are 6127 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1060284298-1993962763-854245398-1004\Control Panel\Desktop\\Wallpaper -> C:\Documents and Settings\Karen\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 209.18.47.61 - 209.18.47.62

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Documents and Settings^Karen^Start Menu^Programs^Startup^Secunia PSI.lnk => C:\WINDOWS\pss\Secunia PSI.lnkStartup
MSCONFIG\startupreg: LXCTCATS => rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

DomainProfile\AuthorizedApplications: [C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe] => Enabled:True Vector
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\fxsclnt.exe] => Enabled:Microsoft Fax Console
StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\lxctcoms.exe] => Enabled:Lexmark Communications System
StandardProfile\AuthorizedApplications: [C:\Program Files\Opera 11.5\opera.exe] => Enabled:Opera Internet Browser
StandardProfile\AuthorizedApplications: [C:\Program Files\Spotify\spotify.exe] => Enabled:Spotify
StandardProfile\AuthorizedApplications: [C:\Program Files\VideoLAN\VLC\vlc.exe] => Enabled:VLC media player
StandardProfile\AuthorizedApplications: [C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe] => Enabled:True Vector
StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabledxpsp2res.dll,-22007
StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabledxpsp2res.dll,-22008
StandardProfile\GloballyOpenPorts: [5985:TCP] => Disabled:Windows Remote Management
StandardProfile\GloballyOpenPorts: [135:TCP] => EnabledCOM(135)

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 1370 WLAN Mini-PCI Card
Description: Dell Wireless 1370 WLAN Mini-PCI Card
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Broadcom
Service: BCM43XX
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action ", and then click "Enable Device ". This starts the Enable Device wizard. Follow the instructions.

Name: TSSTcorp CDRW/DVD TSL462C
Description: CD-ROM Drive
Class Guid: {4D36E965-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action ", and then click "Enable Device ". This starts the Enable Device wizard. Follow the instructions.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver ", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/05/2015 10:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application plugin-container.exe, version 36.0.4.5558, faulting module mozalloc.dll, version 36.0.4.5558, fault address 0x00001295.
Processing media-specific event for [plugin-container.exe!ws!]

Error: (06/05/2015 10:18:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application plugin-container.exe, version 36.0.4.5558, faulting module mozalloc.dll, version 36.0.4.5558, fault address 0x00001295.
Processing media-specific event for [plugin-container.exe!ws!]

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.


System errors:
=============
Error: (07/03/2015 01:12:44 PM) (Source: Dhcp) (EventID: 1000) (User: )
Description: Your computer has lost the lease to its IP address 192.168.100.10 on the
Network Card with network address 001422D0C73D.

Error: (07/02/2015 01:51:59 PM) (Source: Dhcp) (EventID: 1000) (User: )
Description: Your computer has lost the lease to its IP address 192.168.100.10 on the
Network Card with network address 001422D0C73D.

Error: (07/02/2015 01:51:35 PM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 74.72.153.185 for the Network Card with network address 001422D0C73D has been
denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

Error: (07/01/2015 11:26:54 AM) (Source: DCOM) (EventID: 10005) (User: HOME-63967577F9)
Description: DCOM got error "%%1058" attempting to start the service wuauserv with arguments " "
in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error: (06/29/2015 10:27:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/29/2015 10:27:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The User Profile Hive Cleanup service terminated unexpectedly. It has done this 1 time(s).

Error: (06/29/2015 10:27:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Macrium Reflect Image Mounting Service service terminated unexpectedly. It has done this 1 time(s).

Error: (06/29/2015 10:27:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).

Error: (06/29/2015 08:58:37 PM) (Source: DCOM) (EventID: 10005) (User: HOME-63967577F9)
Description: DCOM got error "%%1058" attempting to start the service BITS with arguments " "
in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

Error: (06/29/2015 08:58:29 PM) (Source: DCOM) (EventID: 10005) (User: HOME-63967577F9)
Description: DCOM got error "%%1058" attempting to start the service BITS with arguments " "
in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}


Microsoft Office:
=========================
Error: (06/05/2015 10:21:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe36.0.4.5558mozalloc.dll36.0.4.555800001295

Error: (06/05/2015 10:18:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe36.0.4.5558mozalloc.dll36.0.4.555800001295

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtA connection with the server could not be established

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/22/2015 03:08:54 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.


==================== Memory info ===========================

Processor: Intel(R) Celeron(R) M processor 1.40GHz
Percentage of memory in use: 81%
Total physical RAM: 1023.23 MB
Available physical RAM: 187.81 MB
Total Pagefile: 2459.43 MB
Available Pagefile: 1689.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1936.73 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:74.53 GB) (Free:47.69 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: FB67FB67)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)

 

Broni:

Here is the Fixlog. You will note that some things did not delete - I think it's because I censored part of the file name to remove my real name. Also, the Avast/Secunia etc. files are protected.


Fix result of Farbar Recovery Scan Tool (x86) Version: 24-06-2015
Ran by G**** at 2015-07-05 16:52:59 Run:1
Running from C:\Documents and Settings\G****\Desktop
Loaded Profiles: G**** (Available Profiles: G**** & Administrator)
Boot Mode: Normal

==============================================

fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
R3 catchme; \??\C:\DOCUME~1\G****\LOCALS~1\Temp\catchme.sys [X]
S3 eapihdrv; \??\C:\DOCUME~1\G****\LOCALS~1\Temp\ehdrv.sys [X]
S4 ProcObsrv; No ImagePath
U3 TlntSvr; No ImagePath
U3 mbr; \??\C:\DOCUME~1\Karen\LOCALS~1\Temp\mbr.sys [X]
2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2012-10-19 14:27 - 2012-10-19 14:27 - 1445888 _____ (Option^Explicit Software Solutions) C:\Program Files\WinsockxpFix.exe
2014-09-09 22:47 - 2014-09-09 22:47 - 0129479 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\ars.cache
2014-09-09 22:47 - 2014-09-09 22:47 - 0144386 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\census.cache
2009-10-11 07:11 - 2009-10-11 07:11 - 0003584 ____C () C:\Documents and Settings\G****\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C}
C:\WINDOWS\pss\Secunia PSI.lnkStartup


*****************

"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
"HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
catchme => Service removed successfully.
eapihdrv => Service removed successfully.
ProcObsrv => Service removed successfully.
TlntSvr => Service removed successfully.
mbr => Service not found.
C:\Program Files\freeofficewindows.exe => moved successfully.
C:\Program Files\WinsockxpFix.exe => moved successfully.
"C:\Documents and Settings\G****\Local Settings\Application Data\ars.cache" => File/Folder not found.
"C:\Documents and Settings\G****\Local Settings\Application Data\census.cache" => File/Folder not found.
"C:\Documents and Settings\G****\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => File/Folder not found.
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D} => The item is protected. Make sure the software is uninstalled and its services are removed.
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C} => The item is protected. Make sure the software is uninstalled and its services are removed.
C:\WINDOWS\pss\Secunia PSI.lnkStartup => moved successfully.

==== End of Fixlog 16:53:17 ====

 

Broni:

Here is the revised Fixlog.


Fix result of Farbar Recovery Scan Tool (x86) Version: 24-06-2015
Ran by Karen at 2015-07-05 19:01:54 Run:2
Running from C:\Documents and Settings\Karen\Desktop
Loaded Profiles: Karen (Available Profiles: Karen & Administrator)
Boot Mode: Normal

==============================================

fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
R3 catchme; \??\C:\DOCUME~1\Karen\LOCALS~1\Temp\catchme.sys [X]
S3 eapihdrv; \??\C:\DOCUME~1\Karen\LOCALS~1\Temp\ehdrv.sys [X]
S4 ProcObsrv; No ImagePath
U3 TlntSvr; No ImagePath
U3 mbr; \??\C:\DOCUME~1\Karen\LOCALS~1\Temp\mbr.sys [X]
2015-06-09 15:44 - 2015-06-09 15:46 - 61687304 _____ (SoftMaker Software GmbH) C:\Program Files\freeofficewindows.exe
2012-10-19 14:27 - 2012-10-19 14:27 - 1445888 _____ (Option^Explicit Software Solutions) C:\Program Files\WinsockxpFix.exe
2014-09-09 22:47 - 2014-09-09 22:47 - 0129479 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\ars.cache
2014-09-09 22:47 - 2014-09-09 22:47 - 0144386 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\census.cache
2009-10-11 07:11 - 2009-10-11 07:11 - 0003584 ____C () C:\Documents and Settings\Karen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C}
C:\WINDOWS\pss\Secunia PSI.lnkStartup


*****************

HKLM\SOFTWARE\Policies\Google => key not found.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found.
HKU\S-1-5-21-1060284298-1993962763-854245398-1004\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found.
catchme => Service not found.
eapihdrv => Service not found.
ProcObsrv => Service not found.
TlntSvr => Service not found.
mbr => Service not found.
"C:\Program Files\freeofficewindows.exe" => File/Folder not found.
"C:\Program Files\WinsockxpFix.exe" => File/Folder not found.
C:\Documents and Settings\Karen\Local Settings\Application Data\ars.cache => moved successfully.
C:\Documents and Settings\Karen\Local Settings\Application Data\census.cache => moved successfully.
C:\Documents and Settings\Karen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully.
AV: avast! Antivirus (Enabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D} => not found
AV: Prevx 2.0 (Disabled - Up to date) {557C3342-BC52-4508-AC25-4441BDF5C04C} => not found
"C:\WINDOWS\pss\Secunia PSI.lnkStartup" => File/Folder not found.

==== End of Fixlog 19:01:55 ====