dslreports logo
site
    All Forums Hot Topics Gallery
spc
Search Topic:
uniqs
1180
share rss forum feed

brandieewine

join:2013-07-27

[Malware] Help Please.

Purchased a new computer last week. I already have a computer which I think may be infected. Checked my router firewall and multiple attempts were made to enter after changing my password. Eventually they successfully accessed my router. Installed Malwarebytes and it returned no problems. I installed ZoneAlarm and it reported multiple attempts to send outbound information had been blocked. It was being sent to a blacklisted ISP in California. After running the required programs for assistance Norton gave a virus warning. I will include the log as well. Thanks for any help you can provide.

Norton

Full Path: c:\oem\preload\autorun\drv\amd chipset generic driver\packages\drivers\sbdrv\hseries\raid\w864a\ahcix64s.sys
Threat: Trojan.Gen
____________________________
____________________________

On computers as of
Not Available

Last Used
7/27/2013 at 6:48:16 PM

Startup Item
No

Launched
No

____________________________
____________________________
Unknown
Number of users in the Norton Community that have used this file: Unknown
____________________________
Unknown
This file release is currently not known.
____________________________
High
This file risk is high.
____________________________
Threat Details
Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.
____________________________

file origin tree

____________________________
File Actions

Avg. Resource Usage:
Unknown

Avg. CPU Usage:
Unknown

Avg. Memory Usage:
Unknown

____________________________
File Thumbprint - SHA:
3bf414bd12c005d2c464297f64cd35bc013998db65a00d39812c288b6ad41e01
____________________________
File Thumbprint - MD5:
075bb9d1b6a3d27602f87bc2f18423ee
________________________

Thread was too big will reply with required programs

brandieewine

join:2013-07-27



Malwarebytes

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.27.04

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16384
Proverbs 31 :: BEE [administrator]

Protection: Enabled

7/27/2013 6:44:31 PM
mbam-log-2013-07-27 (18-44-31).txt

Scan type: Full scan (C:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 307476
Time elapsed: 46 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


brandieewine

join:2013-07-27
reply to brandieewine

# AdwCleaner v2.306 - Logfile created 07/27/2013 at 18:22:13
# Updated 19/07/2013 by Xplode
# Operating system : Windows 8 (64 bits)
# User : Proverbs 31 - BEE
# Boot Mode : Normal
# Running from : C:\Users\Proverbs 31\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\boost_interprocess
File Deleted : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16384

[OK] Registry is clean.

*************************

AdwCleaner[S1].txt - [2444 octets] - [27/07/2013 18:22:13]

########## EOF - C:\AdwCleaner[S1].txt - [2504 octets] ##########


brandieewine

join:2013-07-27

OTL logfile created on: 7/27/2013 6:29:17 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Proverbs 31\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16384)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.71 Gb Total Physical Memory | 2.77 Gb Available Physical Memory | 74.70% Memory free
7.09 Gb Paging File | 6.10 Gb Available in Paging File | 86.14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 441.95 Gb Total Space | 417.72 Gb Free Space | 94.52% Space Free | Partition Type: NTFS

Computer Name: BEE | User Name: Proverbs 31 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2013/07/27 18:26:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Proverbs 31\Desktop\OTL.exe
PRC - [2013/06/19 23:13:16 | 002,445,304 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2013/06/19 22:41:38 | 000,073,832 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2013/06/18 03:34:34 | 000,054,160 | ---- | M] (Check Point Software Technologies, Ltd.) -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/07/05 18:50:26 | 000,553,616 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe
PRC - [2012/07/04 10:57:44 | 000,990,320 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
PRC - [2012/06/22 11:00:59 | 000,744,184 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\SymSilent\SymSilentBootstrap.exe
PRC - [2012/06/14 13:46:42 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe
PRC - [2011/11/25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe

[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2012/05/29 23:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\wincfi39.dll

[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:64bit: - [2012/08/22 21:02:36 | 000,658,576 | ---- | M] (Acer Incorporated) [On_Demand | Running] -- C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2012/07/25 21:46:56 | 002,366,984 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)
SRV:64bit: - [2012/07/25 20:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
SRV:64bit: - [2012/07/25 20:17:59 | 000,015,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV:64bit: - [2012/07/25 20:08:04 | 001,968,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)
SRV:64bit: - [2012/07/25 20:07:47 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)
SRV:64bit: - [2012/07/25 20:07:42 | 000,263,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)
SRV:64bit: - [2012/07/25 20:07:40 | 000,283,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)
SRV:64bit: - [2012/07/25 20:07:30 | 000,169,984 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)
SRV:64bit: - [2012/07/25 20:07:27 | 000,178,176 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)
SRV:64bit: - [2012/07/25 20:07:25 | 000,012,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)
SRV:64bit: - [2012/07/25 20:06:36 | 000,463,872 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
SRV:64bit: - [2012/07/25 20:06:34 | 000,743,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)
SRV:64bit: - [2012/07/25 20:06:33 | 000,161,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)
SRV:64bit: - [2012/07/25 20:06:33 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)
SRV:64bit: - [2012/07/25 20:06:00 | 000,438,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)
SRV:64bit: - [2012/07/25 20:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
SRV:64bit: - [2012/07/25 20:05:38 | 000,116,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)
SRV:64bit: - [2012/07/25 20:05:34 | 000,037,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)
SRV:64bit: - [2012/07/25 20:05:28 | 000,207,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)
SRV:64bit: - [2012/07/25 20:05:24 | 000,342,016 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)
SRV:64bit: - [2012/07/25 20:05:11 | 000,174,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)
SRV:64bit: - [2012/07/25 20:05:08 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2012/07/25 20:05:08 | 000,122,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AUInstallAgent.dll -- (AllUserInstallAgent)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)
SRV:64bit: - [2012/07/25 17:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)
SRV:64bit: - [2012/07/19 23:01:32 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2012/07/19 07:14:42 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2013/06/19 23:13:16 | 002,445,304 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2013/06/18 03:34:34 | 000,054,160 | ---- | M] (Check Point Software Technologies, Ltd.) [Auto | Running] -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe -- (ZAPrivacyService)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/15 12:44:50 | 003,943,104 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2012/07/25 20:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll -- (PrintNotify)
SRV - [2012/07/25 20:20:04 | 000,018,432 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)
SRV - [2012/07/13 02:02:16 | 002,451,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2012/06/14 13:46:42 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe -- (NIS)
SRV - [2011/11/25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/10/12 10:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:64bit: - [2013/06/13 16:34:16 | 000,451,096 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\vsdatant.sys -- (Vsdatant)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/08/28 05:08:34 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2012/07/25 22:26:46 | 000,025,328 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/07/25 22:26:45 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\condrv.sys -- (condrv)
DRV:64bit: - [2012/07/25 22:00:58 | 000,445,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\USBHUB3.SYS -- (USBHUB3)
DRV:64bit: - [2012/07/25 22:00:58 | 000,337,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\USBXHCI.SYS -- (USBXHCI)
DRV:64bit: - [2012/07/25 22:00:58 | 000,322,800 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS -- (VSTXRAID)
DRV:64bit: - [2012/07/25 22:00:58 | 000,212,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\UCX01000.SYS -- (UCX01000)
DRV:64bit: - [2012/07/25 22:00:58 | 000,106,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\VerifierExt.sys -- (VerifierExt)
DRV:64bit: - [2012/07/25 22:00:58 | 000,097,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\uaspstor.sys -- (UASPStor)
DRV:64bit: - [2012/07/25 22:00:57 | 000,077,040 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\acpiex.sys -- (acpiex)
DRV:64bit: - [2012/07/25 22:00:55 | 000,283,888 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\spaceport.sys -- (spaceport)
DRV:64bit: - [2012/07/25 22:00:55 | 000,120,048 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpioclx.sys -- (GPIOClx0101)
DRV:64bit: - [2012/07/25 22:00:55 | 000,077,552 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\storahci.sys -- (storahci)
DRV:64bit: - [2012/07/25 22:00:55 | 000,064,240 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\mvumis.sys -- (mvumis)
DRV:64bit: - [2012/07/25 22:00:55 | 000,030,960 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2012/07/25 22:00:55 | 000,028,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpiowin32.sys -- (msgpiowin32)
DRV:64bit: - [2012/07/25 22:00:54 | 000,056,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdstor.sys -- (sdstor)
DRV:64bit: - [2012/07/25 22:00:52 | 003,295,984 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2012/07/25 22:00:52 | 000,092,400 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2012/07/25 22:00:52 | 000,081,136 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sss.sys -- (LSI_SSS)
DRV:64bit: - [2012/07/25 22:00:52 | 000,064,752 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2012/07/25 22:00:51 | 000,113,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)
DRV:64bit: - [2012/07/25 22:00:51 | 000,081,136 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\EhStorClass.sys -- (EhStorClass)
DRV:64bit: - [2012/07/25 22:00:49 | 000,539,376 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2012/07/25 22:00:49 | 000,258,288 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2012/07/25 22:00:49 | 000,106,736 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\3ware.sys -- (3ware)
DRV:64bit: - [2012/07/25 22:00:49 | 000,076,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012/07/25 22:00:48 | 000,026,352 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012/07/25 21:59:35 | 000,193,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2012/07/25 21:59:35 | 000,148,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\tpm.sys -- (TPM)
DRV:64bit: - [2012/07/25 21:59:32 | 000,055,024 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\Drivers\dam.sys -- (dam)
DRV:64bit: - [2012/07/25 21:58:00 | 000,068,848 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\pdc.sys -- (pdc)
DRV:64bit: - [2012/07/25 21:57:54 | 000,361,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\clfs.sys -- (CLFS)
DRV:64bit: - [2012/07/25 21:54:34 | 000,096,496 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\wfplwfs.sys -- (WFPLWFS)
DRV:64bit: - [2012/07/25 21:53:16 | 000,067,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpci.sys -- (vpci)
DRV:64bit: - [2012/07/25 21:44:30 | 000,258,288 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdFilter.sys -- (WdFilter)
DRV:64bit: - [2012/07/25 21:36:15 | 000,034,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdBoot.sys -- (WdBoot)
DRV:64bit: - [2012/07/25 20:17:38 | 000,036,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2012/07/25 20:17:38 | 000,027,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/07/25 19:29:14 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mshidumdf.sys -- (mshidumdf)
DRV:64bit: - [2012/07/25 19:29:08 | 000,048,640 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicDisplay.sys -- (BasicDisplay)
DRV:64bit: - [2012/07/25 19:29:03 | 000,024,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\HyperVideo.sys -- (HyperVideo)
DRV:64bit: - [2012/07/25 19:28:52 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicRender.sys -- (BasicRender)
DRV:64bit: - [2012/07/25 19:28:27 | 000,031,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys -- (BthAvrcpTg)
DRV:64bit: - [2012/07/25 19:27:58 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\fxppm.sys -- (FxPPM)
DRV:64bit: - [2012/07/25 19:27:58 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmgencounter.sys -- (gencounter)
DRV:64bit: - [2012/07/25 19:27:41 | 000,018,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kdnic.sys -- (kdnic)
DRV:64bit: - [2012/07/25 19:27:37 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpitime.sys -- (acpitime)
DRV:64bit: - [2012/07/25 19:27:33 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\npsvctrig.sys -- (npsvctrig)
DRV:64bit: - [2012/07/25 19:27:31 | 000,029,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthhfHid.sys -- (bthhfhid)
DRV:64bit: - [2012/07/25 19:27:29 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys -- (WpdUpFltr)
DRV:64bit: - [2012/07/25 19:27:16 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpipagr.sys -- (acpipagr)
DRV:64bit: - [2012/07/25 19:27:01 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hyperkbd.sys -- (hyperkbd)
DRV:64bit: - [2012/07/25 19:26:46 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SerCx.sys -- (SerCx)
DRV:64bit: - [2012/07/25 19:26:43 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SpbCx.sys -- (SpbCx)
DRV:64bit: - [2012/07/25 19:26:34 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/07/25 19:26:13 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\bthhfenum.sys -- (BthHFEnum)
DRV:64bit: - [2012/07/25 19:25:57 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2012/07/25 19:25:56 | 000,057,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/07/25 19:25:54 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hidi2c.sys -- (hidi2c)
DRV:64bit: - [2012/07/25 19:25:13 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\wpcfltr.sys -- (wpcfltr)
DRV:64bit: - [2012/07/25 19:25:01 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys -- (NdisImPlatform)
DRV:64bit: - [2012/07/25 19:23:53 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mslldp.sys -- (MsLldp)
DRV:64bit: - [2012/07/25 19:23:42 | 000,097,792 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\Ndu.sys -- (Ndu)
DRV:64bit: - [2012/07/19 08:19:02 | 010,279,424 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012/07/19 06:13:32 | 000,368,640 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012/07/16 17:59:12 | 000,098,472 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\AtihdW86.sys -- (AtiHDAudioService)
DRV:64bit: - [2012/07/04 20:18:06 | 000,252,048 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2012/06/20 22:12:20 | 000,683,664 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Rt630x64.sys -- (RTL8168)
DRV:64bit: - [2012/06/20 14:27:30 | 000,023,448 | R--- | M] (Symantec Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\SymELAM.sys -- (SymELAM)
DRV:64bit: - [2012/05/25 17:56:14 | 000,168,608 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\NARAx64\0401000.00E\ccSetx64.sys -- (ccSet_NARA)
DRV:64bit: - [2012/05/25 08:56:14 | 000,168,608 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\ccSetx64.sys -- (ccSet_NIS)
DRV:64bit: - [2012/05/24 17:23:10 | 000,485,024 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\SymDS64.sys -- (SymDS)
DRV:64bit: - [2012/05/24 17:01:16 | 000,222,368 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\Ironx64.sys -- (SymIRON)
DRV:64bit: - [2012/05/24 16:54:58 | 000,753,312 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2012/05/21 10:25:20 | 001,129,120 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\SymEFA64.sys -- (SymEFA)
DRV:64bit: - [2012/05/09 11:04:26 | 000,431,224 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\symnets.sys -- (SymNetS)
DRV:64bit: - [2012/01/11 11:11:54 | 000,037,496 | R--- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\NISx64\1400000.088\srtspx64.sys -- (SRTSPX)
DRV - [2013/07/27 08:43:48 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130727.004\ex64.sys -- (NAVEX15)
DRV - [2013/07/27 08:43:48 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2013/07/27 08:43:48 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2013/07/27 08:43:48 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20130727.004\eng64.sys -- (NAVENG)
DRV - [2013/07/26 15:27:36 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20130726.001\IDSviA64.sys -- (IDSVia64)
DRV - [2013/07/15 22:58:54 | 001,393,240 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20130715.001\BHDrvx64.sys -- (BHDrvx64)

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]

[color=#E56717]========== Internet Explorer ==========[/color]

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{2BDBA4CA-E2FE-4E85-B335-A1C3E5919D8C}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAGWJS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{2BDBA4CA-E2FE-4E85-B335-A1C3E5919D8C}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAGWJS

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-249487183-3276952955-2055839612-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer13.msn.com
IE - HKU\S-1-5-21-249487183-3276952955-2055839612-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.zonealarm.com/?src=hp&tbid=goughDev3&Lan=en&gu=3713999a2d6a469192b66eef88516283&tu=10G9y009F2B0CO0&sku=&tstsId=&ver=&
IE - HKU\S-1-5-21-249487183-3276952955-2055839612-1002\..\SearchScopes,DefaultScope = {7DFAD943-8A56-44F2-9C84-C9D8161AB697}
IE - HKU\S-1-5-21-249487183-3276952955-2055839612-1002\..\SearchScopes\{7DFAD943-8A56-44F2-9C84-C9D8161AB697}: "URL" = http://search.zonealarm.com/search?src=sp&tbid=goughDev3&Lan=en&q={searchTerms}&gu=3713999a2d6a469192b66eef88516283&tu=10G9y009F2B0CO0&sku=&tstsId=&ver=&&r=182
IE - HKU\S-1-5-21-249487183-3276952955-2055839612-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn\ [2013/07/27 08:22:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn\ [2013/07/27 18:26:05 | 000,000,000 | ---D | M]

[2013/07/27 08:33:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

O1 HOSTS File: ([2012/07/25 22:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2 - BHO: (Zonealarm Helper Object) - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.21.15\bh\zonealarm.dll (Check Point Software Technologies LTD)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\IPS\IPSBHO.dll (Symantec Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.21.15\zonealarmTlbr.dll (Check Point Software Technologies LTD)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F774F5B7-6F43-4CB5-8B05-D13304E9A2E2}: DhcpNameServer = 75.75.75.75 75.75.76.76
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2013/07/27 18:26:19 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Proverbs 31\Desktop\OTL.exe
[2013/07/27 18:10:22 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Proverbs 31\Desktop\TFC.exe
[2013/07/27 14:48:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2013/07/27 14:48:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013/07/27 14:48:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2013/07/27 14:35:59 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Malwarebytes
[2013/07/27 14:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/07/27 14:35:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/07/27 14:35:45 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/07/27 14:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/07/27 14:35:33 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Local\Programs
[2013/07/27 08:53:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2013/07/27 08:39:29 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Macromedia
[2013/07/27 08:35:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point
[2013/07/27 08:33:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Check Point Software Technologies LTD
[2013/07/27 08:33:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/07/27 08:33:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CheckPoint
[2013/07/27 08:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\CheckPoint
[2013/07/27 08:23:30 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013/07/27 08:23:30 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Searches
[2013/07/27 08:23:30 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013/07/27 08:23:29 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Contacts
[2013/07/27 08:23:29 | 000,000,000 | -H-D | C] -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2013/07/27 08:23:26 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Identities
[2013/07/27 08:22:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OEM
[2013/07/27 08:22:11 | 000,000,000 | ---D | C] -- C:\Program Files\Accessory Store
[2013/07/27 08:22:04 | 000,000,000 | ---D | C] -- C:\ProgramData\OEM_E471269A730D
[2013/07/27 08:22:00 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Adobe
[2013/07/27 08:21:52 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Uninstall Information
[2013/07/27 08:20:42 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Local\VirtualStore
[2013/07/27 08:20:29 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Local\Packages
[2013/07/27 08:20:22 | 000,000,000 | --SD | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Videos
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Saved Games
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Pictures
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Music
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Links
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Favorites
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Downloads
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Documents
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\Desktop
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013/07/27 08:20:22 | 000,000,000 | R--D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\AppData\Local\Temporary Internet Files
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Templates
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Start Menu
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\SendTo
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Recent
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\PrintHood
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\NetHood
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Documents\My Videos
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Documents\My Pictures
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Documents\My Music
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\My Documents
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Local Settings
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\AppData\Local\History
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Cookies
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\Application Data
[2013/07/27 08:20:22 | 000,000,000 | -HSD | C] -- C:\Users\Proverbs 31\AppData\Local\Application Data
[2013/07/27 08:20:22 | 000,000,000 | -H-D | C] -- C:\Users\Proverbs 31\AppData
[2013/07/27 08:20:22 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Local\Temp
[2013/07/27 08:20:22 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Local\Microsoft
[2013/07/27 08:20:22 | 000,000,000 | ---D | C] -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013/07/27 06:08:52 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2013/07/27 18:28:11 | 000,848,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/07/27 18:28:11 | 000,718,176 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/07/27 18:28:11 | 000,132,542 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/07/27 18:26:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Proverbs 31\Desktop\OTL.exe
[2013/07/27 18:25:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/27 18:23:36 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
[2013/07/27 18:23:34 | 3187,687,424 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/27 18:22:41 | 000,000,101 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/27 18:21:04 | 000,666,633 | ---- | M] () -- C:\Users\Proverbs 31\Desktop\adwcleaner.exe
[2013/07/27 18:10:22 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Proverbs 31\Desktop\TFC.exe
[2013/07/27 14:48:55 | 000,001,289 | ---- | M] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/07/27 14:48:55 | 000,001,265 | ---- | M] () -- C:\Users\Proverbs 31\Desktop\Spybot - Search & Destroy.lnk
[2013/07/27 14:35:48 | 000,001,140 | ---- | M] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
[2013/07/27 14:35:48 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/27 08:38:41 | 000,417,513 | ---- | M] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2013/07/27 08:35:34 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013/07/27 08:26:46 | 000,001,431 | ---- | M] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/07/27 08:22:11 | 000,001,738 | ---- | M] () -- C:\Users\Public\Desktop\Buy Online.lnk
[2013/07/27 08:22:05 | 000,001,967 | ---- | M] () -- C:\Users\Public\Desktop\Netflix.lnk

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2013/07/27 18:22:22 | 000,000,101 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013/07/27 18:21:04 | 000,666,633 | ---- | C] () -- C:\Users\Proverbs 31\Desktop\adwcleaner.exe
[2013/07/27 14:48:55 | 000,001,289 | ---- | C] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2013/07/27 14:48:55 | 000,001,265 | ---- | C] () -- C:\Users\Proverbs 31\Desktop\Spybot - Search & Destroy.lnk
[2013/07/27 14:35:48 | 000,001,140 | ---- | C] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
[2013/07/27 14:35:48 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/07/27 08:36:01 | 000,417,513 | ---- | C] () -- C:\Windows\SysNative\drivers\vsconfig.xml
[2013/07/27 08:35:34 | 000,000,762 | ---- | C] () -- C:\Users\Public\Desktop\ZoneAlarm Security.lnk
[2013/07/27 08:26:46 | 000,001,431 | ---- | C] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/07/27 08:22:21 | 000,000,000 | ---- | C] () -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013/07/27 08:22:11 | 000,001,738 | ---- | C] () -- C:\Users\Public\Desktop\Buy Online.lnk
[2013/07/27 08:22:05 | 000,001,967 | ---- | C] () -- C:\Users\Public\Desktop\Netflix.lnk
[2013/07/27 08:21:59 | 000,001,437 | ---- | C] () -- C:\Users\Proverbs 31\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013/07/27 08:20:22 | 000,000,352 | ---- | C] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2013/07/27 08:20:22 | 000,000,334 | ---- | C] () -- C:\Users\Proverbs 31\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2013/07/27 06:08:52 | 268,435,456 | -HS- | C] () -- C:\swapfile.sys
[2013/07/27 06:08:51 | 3187,687,424 | -HS- | C] () -- C:\hiberfil.sys
[2013/01/30 00:12:24 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012/08/28 05:47:39 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012/08/28 05:47:39 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012/08/28 05:47:39 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012/07/26 01:13:10 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2012/07/26 01:13:09 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2012/07/26 00:21:26 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2012/07/25 18:17:42 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2012/07/25 17:48:53 | 000,083,968 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll
[2012/07/25 13:37:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2012/07/25 13:28:31 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2012/06/02 07:31:19 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2012/05/10 17:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

[color=#E56717]========== ZeroAccess Check ==========[/color]

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/07/25 20:07:16 | 019,779,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/07/25 20:19:59 | 017,559,552 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/07/25 20:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012/07/25 20:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/07/25 20:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== LOP Check ==========[/color]

[color=#E56717]========== Purity Check ==========[/color]

brandieewine

join:2013-07-27

2 edits
reply to brandieewine

OTL Extras logfile created on: 7/27/2013 6:29:17 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Proverbs 31\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16384)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.71 Gb Total Physical Memory | 2.77 Gb Available Physical Memory | 74.70% Memory free
7.09 Gb Paging File | 6.10 Gb Available in Paging File | 86.14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 441.95 Gb Total Space | 417.72 Gb Free Space | 94.52% Space Free | Partition Type: NTFS

Computer Name: BEE | User Name: Proverbs 31 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]

[color=#E56717]========== File Associations ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

[color=#E56717]========== Security Center Settings ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]

[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

[color=#E56717]========== Vista Active Application Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09022E88-9636-4EEC-91F8-570A765B3073}" = dir=out | name=skitch |
"{0D984F66-A26D-4F0B-A438-9DFDD8CBC4AD}" = dir=out | name=@{microsoft.zunevideo_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
"{0F0E901F-2723-417E-9DFD-8669CC246CC3}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe |
"{141EBFD8-8CB3-4938-A66E-5904719EA875}" = dir=out | name=amazon for windows |
"{16AA54DA-178E-440A-98AC-9E60FEACDEF6}" = dir=out | name=ebay |
"{18A66121-343D-41A9-97FF-869072ECBE8A}" = dir=in | name=skype |
"{1F134917-C17E-49DB-972D-7073D814F88B}" = dir=in | name=kindle |
"{2DDC7A8C-2357-4484-A0F5-BDA9A5223A9B}" = dir=out | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{2FE322E6-4840-424A-B670-58ACA41339CB}" = dir=in | name=evernote |
"{32555A4E-733F-4914-AEA3-E19B3B5ED352}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{362A8DC0-463D-43DA-8D51-68F5DB01252A}" = dir=in | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{3C0B2656-9EC0-4338-81C9-396E238DB8D6}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe |
"{40B6DA9D-D212-45DD-A7AF-66CF3A7A602A}" = dir=out | name=windows_ie_ac_001 |
"{45926539-7B26-471D-801A-15183993A3A1}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{45A71FED-B841-4B99-80A0-9B9DC84FCFF7}" = dir=out | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{470A25EA-6D3C-4C32-AE36-7ED12CEAFF03}" = dir=out | name=hulu plus |
"{5135B953-216E-471E-8899-35D0075EB3EC}" = dir=out | name=@{microsoft.bingweather_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{58346FE5-05D1-410B-8862-C8ABF16FFBAE}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{5C0C8EE2-751E-4BA4-8D5C-E9CC58B593D9}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{649AF061-0F76-4E14-85B5-1A91F8DB759F}" = dir=out | name=@{microsoft.bingmaps_1.2.0.136_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{6695A926-0701-48A9-B133-148DBEA74339}" = dir=out | name=@{microsoft.bingnews_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{752754C8-F71A-45D2-8A78-00229CFD0910}" = dir=out | name=evernote |
"{75D00DB3-3DEE-4D82-8ECD-636C23BDEEF0}" = dir=out | name=chacha |
"{76DDF855-2B61-4E80-A0CF-5E1674878CEE}" = dir=out | name=stumbleupon |
"{775304FA-C250-4D41-8A71-3BFE878E53BF}" = dir=out | name=gateway explorer |
"{7952A7BC-57CC-474F-A491-D07BFC672B63}" = dir=in | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{7A1C3F7A-5BDC-4A1B-A2C4-576C6C6198AA}" = dir=out | name=@{microsoft.zunemusic_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
"{7CF2A1B0-5023-432D-8165-3BFF79D0E0AD}" = dir=out | name=@{microsoft.bingsports_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{7FAD793C-6432-441D-8646-ADC7CE6BE207}" = dir=out | name=kindle |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{818B042C-9FBA-4C04-AABF-EA613D482354}" = dir=out | name=@{microsoft.xboxlivegames_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{837974C1-11DE-4F50-8867-0A977E5224DD}" = dir=out | name=@{microsoft.bingtravel_1.2.0.145_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{89442599-1E66-49F7-9477-38B701A6454A}" = dir=out | name=merriam-webster dictionary |
"{8D92BCA1-41AC-45EF-9B69-8195892B5764}" = dir=out | name=cut the rope |
"{9C43AD11-2C0F-4B97-9508-A145B0711C1E}" = dir=out | name=newsxpresso metro |
"{9DB36C08-2DBE-4A45-BD69-0B39B8ACB2C9}" = dir=in | name=ebay |
"{BA2165EB-8463-42EF-83C5-8060F93B6332}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{BF314784-A03A-4405-84F8-009ADD66AC56}" = dir=in | name=amazon for windows |
"{BFE7A909-9F92-4024-BBB1-6E580E58B6F7}" = dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe |
"{C2FF5B03-4021-48AA-B17F-C232CCEA881E}" = dir=out | name=7digital music store |
"{C4629CD6-BF86-4C78-927F-111C2143A859}" = dir=out | name=encyclopaedia britannica |
"{C821A7F4-520A-40A8-8F26-41D7147871EC}" = dir=in | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{CB62180A-30EC-40B0-A097-5A4639A8ADDB}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{D340FF44-856D-41BE-AED5-8401BD034084}" = dir=out | name=netflix |
"{D5350C34-15F6-405A-B74D-3D6F15472A5C}" = dir=out | name=@{microsoft.bingfinance_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
"{D889D786-B504-46DC-995F-5AA4B80F2834}" = dir=out | name=icookbook se |
"{DEC15BDB-C648-4DB5-A01C-BDA3F77538FA}" = dir=out | name=tunein radio |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{EF067289-9683-4EDE-BE05-6BA30F5D1B9B}" = dir=out | name=skype |
"{F1E3C19A-A7D6-4CAB-80B2-29A16031299B}" = dir=out | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |

[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}" = Gateway Recovery Management
"{19CB64EB-ACFE-681D-B571-A8A3398F1943}" = AMD Catalyst Install Manager
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5073FD73-33B5-5056-D2F1-3CECCEE76E37}" = AMD AVIVO64 Codecs
"{91F52DE4-B789-42B0-9311-A349F10E5479}" = Gateway Power Management
"{DB80E09D-CADA-E15F-F26A-25199559FC28}" = AMD Fuel
"{E429154B-6C65-2BE9-AC80-60DF73CB9774}" = AMD Accelerated Video Transcoding
"{FC5E805E-3215-51A0-B658-86CDFA440C47}" = ccc-utility64

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0708FF30-78C0-47B0-81F0-C84604DC769C}" = Nero Express Help (CHM)
"{099776E0-A602-8FE6-F0A9-2E9F377EF5BD}" = CCC Help Greek
"{0B311221-05A5-4766-8D03-7A6446794156}" = Nero RescueAgent Help (CHM)
"{0E4630AF-0AB7-440E-A978-1A78FC4F43B9}" = Nero Launcher
"{17B097DD-CF9B-A21F-53CB-B8B21193D96C}" = CCC Help Dutch
"{182728B1-8727-4AB3-A1AE-F1ED2C8B1BAC}" = Catalyst Control Center - Branding
"{192971BE-6FCE-6A65-3921-7C21DAEE0B5D}" = CCC Help Czech
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2128FF2D-7134-3E13-4E80-F6D71AF59BA9}" = Catalyst Control Center Localization All
"{216308F1-6AC9-5F6F-987D-7B4CE983A392}" = CCC Help Finnish
"{21E7D71D-3F2A-3E62-7372-E2215DCBDF35}" = CCC Help Polish
"{296CEBB6-C5EF-0706-62F4-AF621E4CFCEA}" = CCC Help English
"{2E2598F9-5B42-4199-9DA6-249117FC2414}" = CCC Help Thai
"{2F8E3D85-1773-560E-50AB-87DFE61A62A2}" = CCC Help Spanish
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer
"{3D9CB654-99AD-4301-89C6-0D12A790767C}" = Identity Card
"{3E3A2325-7712-454A-AC84-7816C3F69C3D}" = ZoneAlarm Firewall
"{404E5AC6-39FC-0C8B-3E68-87AA7F066982}" = CCC Help Japanese
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{43B3565F-D8A0-2019-EBC4-BF3E2C8FD51B}" = CCC Help Russian
"{5B81F6D8-AFA6-BBD4-0B74-342EE195C4FF}" = Catalyst Control Center InstallProxy
"{5B97339C-5A3D-3563-CAF9-0F7081F06D94}" = CCC Help Chinese Traditional
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-gateway" = WildTangent Games App
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{763163B5-8092-DC95-37AF-8436E7B3D00F}" = CCC Help Chinese Standard
"{7EC5403A-3BE9-0504-4F38-F0E36129D984}" = CCC Help French
"{7FC9C5DC-7742-F1F1-7D77-EADCEB110AC1}" = CCC Help German
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{848A7C68-0ADC-4193-8A89-2CEA78E56A0C}" = Nero Express
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BF0D9FE-9893-4647-81B9-17B7BEA4E6FD}" = Nero 12 Essentials OEM.a01
"{9F9D286C-C66A-A6D9-3801-9310718E4072}" = CCC Help Swedish
"{A2D43081-CF7B-4637-A9F3-E2651AA5C4A8}" = Nero RescueAgent
"{A694AF57-9891-4D62-824C-7E55A1361A14}" = eBay Worldwide
"{A6DC88AD-501A-44BC-884D-57435F972E2C}" = Hotkey Utility
"{A96AFD67-7556-FD6F-BE81-DB694E78C387}" = CCC Help Italian
"{ABC88553-8770-4B97-B43E-5A90647A5B63}" = Nero ControlCenter
"{ADB86C61-74E4-8ED8-35DF-2CA7E33226FC}" = CCC Help Turkish
"{B2B0EC73-AD4A-4716-A3DE-CEA8440B309B}" = Nero BackItUp 12 Essentials OEM.a01
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4E8FA87-32E3-4CAB-5C62-1D5E4D400579}" = CCC Help Portuguese
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components
"{C5E1DE30-1B3A-9006-87E7-7847C0F4F121}" = CCC Help Hungarian
"{C994C746-C6D0-4EBA-B09E-DF7B18381B69}" = Nero ControlCenter Help (CHM)
"{CA34560F-5827-B40F-3EF3-4D2F1D8379E5}" = CCC Help Norwegian
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.5
"{E63014A6-9E7B-46A5-B9FE-6E4B76072D1F}" = ZoneAlarm Security
"{E70B2F2C-94D1-4287-B5B0-CBBE618E2652}" = Nero BackItUp
"{E860214B-76D7-B131-BB7B-57A7BC130C18}" = AMD VISION Engine Control Center
"{EA2FFDFA-0228-9D5D-D451-7E0706184350}" = CCC Help Danish
"{EE26E302-876A-48D9-9058-3129E5B99999}" = Live Updater
"{EF0D1292-8FC1-41BE-9740-DBC134F66415}" = Nero BackItUp Help (CHM)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4A3CD4A-CAF5-A7D0-B870-49D6941D6C1D}" = CCC Help Korean
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"NARA" = Norton Online Backup ARA
"NIS" = Norton Internet Security
"Spotify" = Spotify
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WTA-2625c0b6-2237-4309-9a1e-8063cb1658cd" = Peggle Nights
"WTA-2ba32642-6c34-4fe5-8ea4-8cb3885594ae" = Aloha TriPeaks
"WTA-327e37dc-8a0e-42f8-9087-d89dee3fd7cb" = Polar Golfer
"WTA-3a597353-79e9-4ff6-b23f-da2cb41cc45f" = Jewel Match 3
"WTA-5bd7e1c0-1ecf-494d-9b15-beaad339f313" = Tales of Lagoona
"WTA-77f013e3-3e11-4d4b-a94a-f563feff1b4b" = Penguins!
"WTA-7ade21c0-b25d-4eb8-b01b-3e5cebbb07db" = Plants vs. Zombies - Game of the Year
"WTA-7f2bf24b-855f-4dbd-a500-f0bcc1568773" = Mystery P.I. - Curious Case of Counterfeit Cove
"WTA-9594d1e0-6f3b-4cb0-afd4-60fa99f89ea2" = Delicious: Emily's True Love Premium Edition
"WTA-97980c0b-7975-49e5-a8d7-b613f2500e26" = Cradle Of Egypt Collector's Edition
"WTA-a4504516-89d3-49ac-847f-22d0db490738" = Zuma's Revenge
"WTA-ba009eeb-9c21-4248-8b39-c28dd51d465e" = Polar Bowler
"WTA-bf2463ff-1da5-487a-a396-433cf3b661cf" = Bejeweled 3
"WTA-c15245fa-d28c-4be1-a1b1-43eed965a9cf" = Agatha Christie - Death on the Nile
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall
"ZoneAlarm Security Toolbar" = ZoneAlarm Security Toolbar

[color=#E56717]========== Last 20 Event Log Errors ==========[/color]

[ Application Events ]
Error - 7/27/2013 9:17:50 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0x99c Faulting application start time: 0x01ce8b3045bce78c Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: 84636433-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:18:09 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

Error - 7/27/2013 9:18:17 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0xdac Faulting application start time: 0x01ce8b3056f588cc Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: 94fa26d7-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:18:37 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

Error - 7/27/2013 9:18:41 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0xc48 Faulting application start time: 0x01ce8b3064ed04f1 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: a2f665bf-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:19:01 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

[ System Events ]
Error - 7/27/2013 5:25:23 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:27:34 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

The ESET ran for an hour and a half and then once complete would not allow me to obtain a log file. I tried everything.

Results of screen317's Security Check version 0.99.71
x64 (UAC is enabled)
Internet Explorer 10
[u]``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Disabled!
Windows Defender
Norton Internet Security
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
[u]`````````Anti-malware/Other Utilities Check:`````````[/u]
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
[u]````````Process Check: objlist.exe by Laurent````````[/u]
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
[color=red]Spybot Teatimer.exe is disabled![/color]
Malwarebytes' Anti-Malware mbamscheduler.exe
Symantec Norton Online Backup NOBuAgent.exe
CheckPoint ZoneAlarm vsmon.exe
CheckPoint ZoneAlarm ZAPrivacyService.exe
CheckPoint ZoneAlarm zatray.exe
[u]`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: %
[u]````````````````````End of Log``````````````````````[/u]
Expand your moderator at work


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:56
Reviews:
·Comcast

Re: [Malware] Help Please.

Temp File Cleaner

Temp File Cleaner
OTL Extras logfile created on: 7/27/2013 6:29:17 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Proverbs 31\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16384)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.71 Gb Total Physical Memory | 2.77 Gb Available Physical Memory | 74.70% Memory free
7.09 Gb Paging File | 6.10 Gb Available in Paging File | 86.14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 441.95 Gb Total Space | 417.72 Gb Free Space | 94.52% Space Free | Partition Type: NTFS

Computer Name: BEE | User Name: Proverbs 31 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]

[color=#E56717]========== File Associations ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

[color=#E56717]========== Security Center Settings ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]

[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

[color=#E56717]========== Vista Active Application Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09022E88-9636-4EEC-91F8-570A765B3073}" = dir=out | name=skitch |
"{0D984F66-A26D-4F0B-A438-9DFDD8CBC4AD}" = dir=out | name=@{microsoft.zunevideo_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
"{0F0E901F-2723-417E-9DFD-8669CC246CC3}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe |
"{141EBFD8-8CB3-4938-A66E-5904719EA875}" = dir=out | name=amazon for windows |
"{16AA54DA-178E-440A-98AC-9E60FEACDEF6}" = dir=out | name=ebay |
"{18A66121-343D-41A9-97FF-869072ECBE8A}" = dir=in | name=skype |
"{1F134917-C17E-49DB-972D-7073D814F88B}" = dir=in | name=kindle |
"{2DDC7A8C-2357-4484-A0F5-BDA9A5223A9B}" = dir=out | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{2FE322E6-4840-424A-B670-58ACA41339CB}" = dir=in | name=evernote |
"{32555A4E-733F-4914-AEA3-E19B3B5ED352}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{362A8DC0-463D-43DA-8D51-68F5DB01252A}" = dir=in | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{3C0B2656-9EC0-4338-81C9-396E238DB8D6}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\data\spotifywebhelper.exe |
"{40B6DA9D-D212-45DD-A7AF-66CF3A7A602A}" = dir=out | name=windows_ie_ac_001 |
"{45926539-7B26-471D-801A-15183993A3A1}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{45A71FED-B841-4B99-80A0-9B9DC84FCFF7}" = dir=out | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{470A25EA-6D3C-4C32-AE36-7ED12CEAFF03}" = dir=out | name=hulu plus |
"{5135B953-216E-471E-8899-35D0075EB3EC}" = dir=out | name=@{microsoft.bingweather_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{58346FE5-05D1-410B-8862-C8ABF16FFBAE}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{5C0C8EE2-751E-4BA4-8D5C-E9CC58B593D9}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{649AF061-0F76-4E14-85B5-1A91F8DB759F}" = dir=out | name=@{microsoft.bingmaps_1.2.0.136_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{6695A926-0701-48A9-B133-148DBEA74339}" = dir=out | name=@{microsoft.bingnews_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{752754C8-F71A-45D2-8A78-00229CFD0910}" = dir=out | name=evernote |
"{75D00DB3-3DEE-4D82-8ECD-636C23BDEEF0}" = dir=out | name=chacha |
"{76DDF855-2B61-4E80-A0CF-5E1674878CEE}" = dir=out | name=stumbleupon |
"{775304FA-C250-4D41-8A71-3BFE878E53BF}" = dir=out | name=gateway explorer |
"{7952A7BC-57CC-474F-A491-D07BFC672B63}" = dir=in | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{7A1C3F7A-5BDC-4A1B-A2C4-576C6C6198AA}" = dir=out | name=@{microsoft.zunemusic_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
"{7CF2A1B0-5023-432D-8165-3BFF79D0E0AD}" = dir=out | name=@{microsoft.bingsports_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{7FAD793C-6432-441D-8646-ADC7CE6BE207}" = dir=out | name=kindle |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{818B042C-9FBA-4C04-AABF-EA613D482354}" = dir=out | name=@{microsoft.xboxlivegames_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{837974C1-11DE-4F50-8867-0A977E5224DD}" = dir=out | name=@{microsoft.bingtravel_1.2.0.145_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{89442599-1E66-49F7-9477-38B701A6454A}" = dir=out | name=merriam-webster dictionary |
"{8D92BCA1-41AC-45EF-9B69-8195892B5764}" = dir=out | name=cut the rope |
"{9C43AD11-2C0F-4B97-9508-A145B0711C1E}" = dir=out | name=newsxpresso metro |
"{9DB36C08-2DBE-4A45-BD69-0B39B8ACB2C9}" = dir=in | name=ebay |
"{BA2165EB-8463-42EF-83C5-8060F93B6332}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{BF314784-A03A-4405-84F8-009ADD66AC56}" = dir=in | name=amazon for windows |
"{BFE7A909-9F92-4024-BBB1-6E580E58B6F7}" = dir=in | app=c:\program files (x86)\nero\nero 12\nero backitup\backitup.exe |
"{C2FF5B03-4021-48AA-B17F-C232CCEA881E}" = dir=out | name=7digital music store |
"{C4629CD6-BF86-4C78-927F-111C2143A859}" = dir=out | name=encyclopaedia britannica |
"{C821A7F4-520A-40A8-8F26-41D7147871EC}" = dir=in | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{CB62180A-30EC-40B0-A097-5A4639A8ADDB}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{D340FF44-856D-41BE-AED5-8401BD034084}" = dir=out | name=netflix |
"{D5350C34-15F6-405A-B74D-3D6F15472A5C}" = dir=out | name=@{microsoft.bingfinance_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
"{D889D786-B504-46DC-995F-5AA4B80F2834}" = dir=out | name=icookbook se |
"{DEC15BDB-C648-4DB5-A01C-BDA3F77538FA}" = dir=out | name=tunein radio |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{EF067289-9683-4EDE-BE05-6BA30F5D1B9B}" = dir=out | name=skype |
"{F1E3C19A-A7D6-4CAB-80B2-29A16031299B}" = dir=out | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |

[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}" = Gateway Recovery Management
"{19CB64EB-ACFE-681D-B571-A8A3398F1943}" = AMD Catalyst Install Manager
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5073FD73-33B5-5056-D2F1-3CECCEE76E37}" = AMD AVIVO64 Codecs
"{91F52DE4-B789-42B0-9311-A349F10E5479}" = Gateway Power Management
"{DB80E09D-CADA-E15F-F26A-25199559FC28}" = AMD Fuel
"{E429154B-6C65-2BE9-AC80-60DF73CB9774}" = AMD Accelerated Video Transcoding
"{FC5E805E-3215-51A0-B658-86CDFA440C47}" = ccc-utility64

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0708FF30-78C0-47B0-81F0-C84604DC769C}" = Nero Express Help (CHM)
"{099776E0-A602-8FE6-F0A9-2E9F377EF5BD}" = CCC Help Greek
"{0B311221-05A5-4766-8D03-7A6446794156}" = Nero RescueAgent Help (CHM)
"{0E4630AF-0AB7-440E-A978-1A78FC4F43B9}" = Nero Launcher
"{17B097DD-CF9B-A21F-53CB-B8B21193D96C}" = CCC Help Dutch
"{182728B1-8727-4AB3-A1AE-F1ED2C8B1BAC}" = Catalyst Control Center - Branding
"{192971BE-6FCE-6A65-3921-7C21DAEE0B5D}" = CCC Help Czech
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2128FF2D-7134-3E13-4E80-F6D71AF59BA9}" = Catalyst Control Center Localization All
"{216308F1-6AC9-5F6F-987D-7B4CE983A392}" = CCC Help Finnish
"{21E7D71D-3F2A-3E62-7372-E2215DCBDF35}" = CCC Help Polish
"{296CEBB6-C5EF-0706-62F4-AF621E4CFCEA}" = CCC Help English
"{2E2598F9-5B42-4199-9DA6-249117FC2414}" = CCC Help Thai
"{2F8E3D85-1773-560E-50AB-87DFE61A62A2}" = CCC Help Spanish
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer
"{3D9CB654-99AD-4301-89C6-0D12A790767C}" = Identity Card
"{3E3A2325-7712-454A-AC84-7816C3F69C3D}" = ZoneAlarm Firewall
"{404E5AC6-39FC-0C8B-3E68-87AA7F066982}" = CCC Help Japanese
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{43B3565F-D8A0-2019-EBC4-BF3E2C8FD51B}" = CCC Help Russian
"{5B81F6D8-AFA6-BBD4-0B74-342EE195C4FF}" = Catalyst Control Center InstallProxy
"{5B97339C-5A3D-3563-CAF9-0F7081F06D94}" = CCC Help Chinese Traditional
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-gateway" = WildTangent Games App
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{763163B5-8092-DC95-37AF-8436E7B3D00F}" = CCC Help Chinese Standard
"{7EC5403A-3BE9-0504-4F38-F0E36129D984}" = CCC Help French
"{7FC9C5DC-7742-F1F1-7D77-EADCEB110AC1}" = CCC Help German
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{848A7C68-0ADC-4193-8A89-2CEA78E56A0C}" = Nero Express
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BF0D9FE-9893-4647-81B9-17B7BEA4E6FD}" = Nero 12 Essentials OEM.a01
"{9F9D286C-C66A-A6D9-3801-9310718E4072}" = CCC Help Swedish
"{A2D43081-CF7B-4637-A9F3-E2651AA5C4A8}" = Nero RescueAgent
"{A694AF57-9891-4D62-824C-7E55A1361A14}" = eBay Worldwide
"{A6DC88AD-501A-44BC-884D-57435F972E2C}" = Hotkey Utility
"{A96AFD67-7556-FD6F-BE81-DB694E78C387}" = CCC Help Italian
"{ABC88553-8770-4B97-B43E-5A90647A5B63}" = Nero ControlCenter
"{ADB86C61-74E4-8ED8-35DF-2CA7E33226FC}" = CCC Help Turkish
"{B2B0EC73-AD4A-4716-A3DE-CEA8440B309B}" = Nero BackItUp 12 Essentials OEM.a01
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4E8FA87-32E3-4CAB-5C62-1D5E4D400579}" = CCC Help Portuguese
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components
"{C5E1DE30-1B3A-9006-87E7-7847C0F4F121}" = CCC Help Hungarian
"{C994C746-C6D0-4EBA-B09E-DF7B18381B69}" = Nero ControlCenter Help (CHM)
"{CA34560F-5827-B40F-3EF3-4D2F1D8379E5}" = CCC Help Norwegian
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.5
"{E63014A6-9E7B-46A5-B9FE-6E4B76072D1F}" = ZoneAlarm Security
"{E70B2F2C-94D1-4287-B5B0-CBBE618E2652}" = Nero BackItUp
"{E860214B-76D7-B131-BB7B-57A7BC130C18}" = AMD VISION Engine Control Center
"{EA2FFDFA-0228-9D5D-D451-7E0706184350}" = CCC Help Danish
"{EE26E302-876A-48D9-9058-3129E5B99999}" = Live Updater
"{EF0D1292-8FC1-41BE-9740-DBC134F66415}" = Nero BackItUp Help (CHM)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4A3CD4A-CAF5-A7D0-B870-49D6941D6C1D}" = CCC Help Korean
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}" = CyberLink MediaEspresso 6.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"NARA" = Norton Online Backup ARA
"NIS" = Norton Internet Security
"Spotify" = Spotify
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WTA-2625c0b6-2237-4309-9a1e-8063cb1658cd" = Peggle Nights
"WTA-2ba32642-6c34-4fe5-8ea4-8cb3885594ae" = Aloha TriPeaks
"WTA-327e37dc-8a0e-42f8-9087-d89dee3fd7cb" = Polar Golfer
"WTA-3a597353-79e9-4ff6-b23f-da2cb41cc45f" = Jewel Match 3
"WTA-5bd7e1c0-1ecf-494d-9b15-beaad339f313" = Tales of Lagoona
"WTA-77f013e3-3e11-4d4b-a94a-f563feff1b4b" = Penguins!
"WTA-7ade21c0-b25d-4eb8-b01b-3e5cebbb07db" = Plants vs. Zombies - Game of the Year
"WTA-7f2bf24b-855f-4dbd-a500-f0bcc1568773" = Mystery P.I. - Curious Case of Counterfeit Cove
"WTA-9594d1e0-6f3b-4cb0-afd4-60fa99f89ea2" = Delicious: Emily's True Love Premium Edition
"WTA-97980c0b-7975-49e5-a8d7-b613f2500e26" = Cradle Of Egypt Collector's Edition
"WTA-a4504516-89d3-49ac-847f-22d0db490738" = Zuma's Revenge
"WTA-ba009eeb-9c21-4248-8b39-c28dd51d465e" = Polar Bowler
"WTA-bf2463ff-1da5-487a-a396-433cf3b661cf" = Bejeweled 3
"WTA-c15245fa-d28c-4be1-a1b1-43eed965a9cf" = Agatha Christie - Death on the Nile
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall
"ZoneAlarm Security Toolbar" = ZoneAlarm Security Toolbar

[color=#E56717]========== Last 20 Event Log Errors ==========[/color]

[ Application Events ]
Error - 7/27/2013 9:17:50 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0x99c Faulting application start time: 0x01ce8b3045bce78c Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: 84636433-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:18:09 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

Error - 7/27/2013 9:18:17 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0xdac Faulting application start time: 0x01ce8b3056f588cc Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: 94fa26d7-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:18:37 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

Error - 7/27/2013 9:18:41 PM | Computer Name = Bee | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 10.0.9200.16384,
time stamp: 0x50107ebe Faulting module name: iertutil.dll, version: 10.0.9200.16390,
time stamp: 0x501b55b2 Exception code: 0xc0000005 Fault offset: 0x0000000000172efb
Faulting
process id: 0xc48 Faulting application start time: 0x01ce8b3064ed04f1 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\system32\iertutil.dll
Report
Id: a2f665bf-f723-11e2-be6e-7427ea277a48 Faulting package full name: Faulting package-relative
application ID:

Error - 7/27/2013 9:19:01 PM | Computer Name = Bee | Source = Microsoft-Windows-Immersive-Shell | ID = 2486
Description = App DefaultBrowser_NOPUBLISHERID!Microsoft.InternetExplorer.Default
did not launch within its allotted time.

[ System Events ]
Error - 7/27/2013 5:25:23 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:27:34 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 5:31:57 PM | Computer Name = Bee | Source = Schannel | ID = 36888
Description = A fatal alert was generated and sent to the remote endpoint. This
may result in termination of the connection. The TLS protocol defined fatal error
code is 51. The Windows SChannel error state is 900.

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

Error - 7/27/2013 9:24:00 PM | Computer Name = Bee | Source = DCOM | ID = 10016
Description =

--
~Safe Hex~ Team Discovery ~ Project Hope ~ Like A Hurricane~


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:56
Reviews:
·Comcast
reply to brandieewine

Hi Brandie...

Can you run the ESET Online scan as found in our forum FAQ - and post the results as well

Please use the "post reply vs "new topic" button to ensure all logs and posts are within the same thread for easier analysis. Thanks.
--
~Safe Hex~ Team Discovery ~ Project Hope ~ Like A Hurricane~

Expand your moderator at work

brandieewine

join:2013-07-27
reply to lilhurricane

Re: [Malware] Help Please.

Bit Defender

QuickScan 32-bit v0.9.9.118
---------------------------
Scan date: Sat Jul 27 21:13:03 2013
Machine ID: 28D77F24

No infection found.
-------------------

Processes
---------
(unsigned) MediaEspresso DeviceDetector 1576 C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

(verified) Hotkey Utility 3052 C:\Program Files (x86)\Gateway\Hotkey Utility\HotkeyUtility.exe
(verified) Malwarebytes Anti-Malware 2616 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(verified) Malwarebytes Anti-Malware 1736 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(verified) Malwarebytes Anti-Malware 1784 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(verified) NeroUpdate 3916 C:\Program Files (x86)\Nero\Update\NASvc.exe
(verified) Spybot - Search & Destroy 2024 C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(verified) Symantec Security Technologies 2660 C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe
(verified) Symantec Security Technologies 3156 C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe
(verified) Symantec Shared Component 3508 C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\symerr.exe
(verified) TrueVector Service 1184 C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(verified) Windows® Internet Explorer 964 C:\Program Files (x86)\Internet Explorer\iexplore.exe
(verified) Windows® Internet Explorer 3360 C:\Program Files (x86)\Internet Explorer\iexplore.exe
(verified) ZAPrivacyService 1904 C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(verified) ZoneAlarm 960 C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe

Network activity
----------------
Process iexplore.exe (964) connected on port 80 (HTTP) --> 173.194.37.45
Process iexplore.exe (964) connected on port 80 (HTTP) --> 66.235.142.2
Process iexplore.exe (964) connected on port 80 (HTTP) --> 66.235.142.2

Process ccSvcHst.exe (3156) listens on ports: 49232

Autoruns and critical files
---------------------------
(verified) Catalyst® Control Center C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
(verified) Microsoft® Windows® Operating System C:\Windows\system32\userinit.exe
(verified) Norton Online Backup C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(verified) Realtek HD Audio Manager C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(verified) ZoneAlarm C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe

Browser plugins
---------------
(verified) Bitdefender QuickScan C:\Windows\Downloaded Program Files\qsax.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\mswsock.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\NLAapi.dll
(verified) Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll
(verified) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll
(verified) Norton Confidential c:\program files (x86)\norton internet security\engine\20.0.0.136\coieplg.dll
(verified) NP_wtapp.dll C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
(verified) SDHelper.dll C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
(verified) Symantec Intrusion Detection c:\program files (x86)\norton internet security\engine\20.0.0.136\ips\ipsbho.dll
(verified) Windows® Internet Explorer c:\windows\syswow64\ieframe.dll
(verified) Zonealarm Toolbar c:\program files (x86)\check point software technologies ltd\zonealarm\1.8.21.15\bh\zonealarm.dll
(verified) Zonealarm Toolbar c:\program files (x86)\check point software technologies ltd\zonealarm\1.8.21.15\zonealarmtlbr.dll

Scan
----
MD5: 7ae4d6c70c2d7912ab2b4651df595575 C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
MD5: 55ee846ed0b8f1fd3b6aa4b24fa0bd56 C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\WPDDM.dll
MD5: abefa4bd23329fd9bd47496bf2e58774 C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
MD5: 925dff5207fa63eda39929ff6f157d16 C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
MD5: dc0c37c901b154c3e5739da019fd49b0 C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\452f06494f05cb9d89325460550d1d62\mscorlib.ni.dll
MD5: a5eed7b8cbece422bc7af38a7d996143 C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\bf379bd95b8bdfa0460b3a10ec5f7bf1\System.Core.ni.dll
MD5: 43a689aacba8671130cbef223fcd469c C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\a801272bc1990741b7b2f5dde3a57420\System.Xml.ni.dll
MD5: b53cd342e2991ca92b9475181c558269 C:\Windows\assembly\NativeImages_v2.0.50727_32\System\6124280f8365d6683e54dd99742100f6\System.ni.dll
MD5: 07ea926dc98356ed9434b5853fa9d84a C:\Windows\System32\UIAnimation.dll
MD5: 686b224b4987c22b153fbb545fee9657 C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_cbf21254470d8752\MFC80U.DLL

No file uploaded.

Scan finished - communication took 1 sec
Total traffic - 0.00 MB sent, 0.04 KB recvd
Scanned 683 files and modules - 6 seconds

==============================================================================

The ESET ran for almost two hours and then wouldn't allow me to obtain a log file. I tried everything it wouldn't work.


lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:56
reply to brandieewine

Ok..I think I have you all in the right order now

New user post are sometimes held for approval...so please be patient.
We'll get you looked over as soon as possible.


brandieewine

join:2013-07-27

ok. I thought I was doing something wrong lol.



lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:56
Reviews:
·Comcast

said by brandieewine:

ok. I thought I was doing something wrong lol.

No..you're ok ..(and you did good)


LoPhatPhuud
Premium,VIP,MVM
join:2002-01-06
Albuquerque, NM
kudos:26
Reviews:
·Comcast

1 recommendation

reply to brandieewine

First:
I suspect that the Norton detect is a false positive. Let's check and be sure...

Please go to »www.virustotal.com/

Press the 'Browse' button to the right of the yellow box.

Navigate to the file(s) listed below, one at a time (if more than one file). Press the 'Open' button in the file dialog box or double click on the file name. The file name and path should appear in the yellow box.


Please go to »www.virustotal.com/

Press the 'Browse' button to the right of the yellow box.

Navigate to the file(s) listed below, one at a time (if more than one file). Press the 'Open' button in the file dialog box or double click on the file name. The file name and path should appear in the yellow box.


c:\oem\preload\autorun\drv\amd chipset generic driver\packages\drivers\sbdrv\hseries\raid\w864a\ahcix64s.sys


Click on the Send File button

Note: If you can't find the file, let me know in your next post.

Once the Scan is completed, a Web page will open with the scan results. Copy and paste the address of that webpage from the address bar of your browser into your next post in this thread. Note that you can also copy and paste the contents of the webpage if you find that easier.

If the file has been previously scanned, the results webpage will show:
"File has already been submitted:"

Press the "View Last Report" button then copy and paste the address of that webpage from the address bar of your browser into your next post in this thread.

If there is more than one file listed for scanning, press the Another File button at the bottom of the page. Repeat this procedure until all files listed have been scanned.


Second:
Norton Internet Security contains a firewall. Installing Zone Alarm was dangerous, at best, and your lucky you have not suffered any consequences. Never run more than one firewall on yur computer at any one time.

Use Program Features (Add/Remove Programs) to uninstall ZoneAlarm. Reboot after removal if ZoneAlarm does not do it.

Then download and run the ZoneAlarm Removal Tool:
»www.majorgeeks.com/files/details···all.html

Reboot after running the Removal Tool.

Third:
Finally, run OTL again, and post the new log in this thread. Note that there will not be a new Extras log this time.
--
When angry count four; when very angry, swear.
Microsoft MVP/Consumer Security 2005-2013



lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
kudos:56
reply to brandieewine

Brandie...hopefully you're still there. Can you post back w/ what LPP suggested?

Expand your moderator at work