Need Help!

TRY · November 23, 2011

I GOT VIRUS ON MY COMPUTER CAN YOU GUYS Please HELP ME!:-):-):-):-):grin:

Melvin_Deal · November 23, 2011

Hello Try!

Begin here by following these instructions please!

Click on this link-> Guidelines for requesting malware removal assistance

Sincerely,

-Mel

Live long and prosper!

TRY · November 23, 2011

Dds Wont Work

Melvin_Deal · November 23, 2011

Hello again TRY

So dds downloaded o.k. but won't run?

If so... temporarily disable (turn off and close) any anti-virus, anti-malware, or firewall programs you may be running.

Then try to run dds again.

If it runs... generate the logs and post them here.

Then turn your anti-virus, anti-malware, and firewall back on.

Sincerely,

-Mel

TRY · November 23, 2011

Attach.txt

I Got Dds To Work

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 27/12/2009 4:50:01 PM

System Uptime: 23/11/2011 2:58:20 PM (1 hours ago)

.

Motherboard: eMachines | | eMachines E627

Processor: AMD Athlon Processor TF-20 | Socket S1G1 | 1600/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 137 GiB total, 101.171 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1496: 22/11/2011 2:16:30 PM - Cleaning Tool

RP1497: 23/11/2011 3:30:27 AM - befor reg clean

RP1460: 23/11/2011 3:53:03 AM - Restore Operation

RP1461: 23/11/2011 7:02:26 AM - Device Driver Package Install: COMODO Network Service

RP1462: 23/11/2011 9:37:05 AM - avast! Free Antivirus Setup

RP1463: 23/11/2011 12:25:55 PM - Windows Modules Installer

.

==== Installed Programs ======================

.

Acrobat.com

Adobe Flash Player 11 ActiveX

Advanced SystemCare 5

AMD USB Filter Driver

AMD VISION Engine Control Center

Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver

µTorrent

Auslogics BoostSpeed

Auslogics Disk Defrag

avast! Free Antivirus

Catalyst Control Center Core Implementation

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Comodo Dragon

D3DX10

eMachines Recovery Management

eMachines Registration

eMachines Updater

File Shredder 2.0

FileHippo.com Update Checker

Foxit Reader 5.1

Game Booster 3

GIMP 2.6.11

Google Chrome

Google Earth

Google Update Helper

HiJackThis

IObit Unlocker

Java Auto Updater

Java 6 Update 22

Java 6 Update 29

Junk Mail filter update

Launch Manager

Malwarebytes' Anti-Malware version 1.51.2.1300

Mesh Runtime

Messenger Companion

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Suite Activation Assistant

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 8.0 (x86 en-GB)

Mozilla Thunderbird (8.0)

MSVCRT

MSVCRT_amd64

NirSoft BlueScreenView

Notepad++

OOo-dev 3.4

PDFCreator

Realtek High Definition Audio Driver

Realtek USB 2.0 Card Reader

Remove Empty Directories version 2.2

RuneScape Launcher 1.2

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

ShadowExplorer 0.8

Skype™ 5.5

TeamViewer 6

Tibia

TuneUp Utilities Language Pack (en-US)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Valkyrie Uploader 1.0

VirusTotal Uploader 2.0

Visual Studio 2008 x64 Redistributables

VLC media player 1.1.11

WebM Media Foundation Components

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live Messenger Companion Core

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

.

==== Event Viewer Messages From Past Week ========

.

23/11/2011 3:01:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswSnx BC cjxtpv nckkof tvelms

23/11/2011 3:00:48 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the ShadowExplorer Service service to connect.

23/11/2011 3:00:48 PM, Error: Service Control Manager [7000] - The ShadowExplorer Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

23/11/2011 2:59:31 PM, Error: Service Control Manager [7001] - The Windows Biometric Service service depends on the Credential Manager service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

23/11/2011 2:51:12 PM, Error: bowser [8003] - The master browser has received a server announcement from the computer MCCASKEY-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151}. The master browser is stopping or an election is being forced.

23/11/2011 2:38:15 PM, Error: Service Control Manager [7001] - The Net.Tcp Listener Adapter service depends on the Net.Tcp Port Sharing Service service which failed to start because of the following error: A device attached to the system is not functioning.

23/11/2011 2:38:15 PM, Error: Service Control Manager [7000] - The Net.Pipe Listener Adapter service failed to start due to the following error: A device attached to the system is not functioning.

23/11/2011 2:37:31 PM, Error: Service Control Manager [7000] - The ShadowExplorer Service service failed to start due to the following error: A device attached to the system is not functioning.

23/11/2011 2:37:27 PM, Error: Service Control Manager [7000] - The Net.Tcp Port Sharing Service service failed to start due to the following error: A device attached to the system is not functioning.

23/11/2011 2:34:12 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

23/11/2011 2:02:54 PM, Error: Service Control Manager [7030] - The Advanced SystemCare Service 5 service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

.

==== End Of File ===========================

Logs.zip

TRY · November 23, 2011

DDS.txt (PART1)

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29

Run by Brad at 15:12:18 on 2011-11-23

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.1788.991 [GMT -4:00]

.

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Windows\system32\svchost.exe -k apphost

C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe

C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe

C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Windows\system32\locator.exe

C:\Program Files\eMachines\eMachines Power Management\ePowerTray.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Eraser\Eraser.exe

C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE

C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe

C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe

C:\Windows\system32\svchost.exe -k iissvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe

C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\eMachines\eMachines Power Management\ePowerEvent.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

mStart Page = about:blank

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart

mRun: [LManager] c:\program files (x86)\launch manager\lmanager.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

uPolicies-explorer: NoThumbnailCache = 1 (0x1)

uPolicies-explorer: DisableThumbnailsOnNetworkFolders = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

mPolicies-system: DisableStatusMessages = 1 (0x1)

mPolicies-system: DisableStartupSound = 1 (0x1)

TCP: DhcpNameServer = 192.168.2.1 142.177.2.130

TCP: Interfaces\{4F96B375-E0BA-4CB3-8D4D-369D9686818A} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{7EA15B26-1C81-4787-8908-863F775EAAAF} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151} : NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151} : DhcpNameServer = 192.168.2.1 142.177.2.130

TCP: Interfaces\{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151}\27562656363616 : DhcpNameServer = 192.168.2.1 192.168.2.1

TCP: Interfaces\{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151}\5627E69656 : DhcpNameServer = 192.168.2.1 192.168.2.1

TCP: Interfaces\{B63DCBEB-3FDB-4AB7-86C2-D0EF1CE38151}\D636361637B65697 : DhcpNameServer = 192.168.2.1 192.168.2.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

mRun-x64: [LManager] c:\program files (x86)\launch manager\lmanager.exe

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Brad\AppData\Roaming\Mozilla\Firefox\Profiles\ym3u2kcs.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\Brad\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Users\Brad\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

---- FIREFOX POLICIES ----

# Mozilla User Preferences

/* Do not edit this file.

*

* If you make changes to this file while the application is running,

* the changes will be overwritten when the application exits.

*

* To make a manual change to preferences, you can visit the URL about:config

* For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs

*/

FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1321757050

FF - user.js: app.update.lastUpdateTime.background-update-timer - 1321757290

FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1321757170

FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1321817882

FF - user.js: browser.blink_allowed - false

FF - user.js: browser.bookmarks.restore_default_bookmarks - false

FF - user.js: browser.cache.disk.capacity - 1048576

FF - user.js: browser.cache.disk.smart_size.first_run - false

FF - user.js: browser.cache.disk.smart_size_cached_value - 1048576

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.download.dir - C:\\Users\\Brad\\Downloads

FF - user.js: browser.download.lastDir - C:\\Users\\Brad\\Desktop

FF - user.js: browser.download.useDownloadDir - false

FF - user.js: browser.migration.version - 5

FF - user.js: browser.places.smartBookmarksVersion - 2

FF - user.js: browser.preferences.advanced.selectedTabIndex - 0

FF - user.js: browser.rights.3.shown - true

FF - user.js: browser.startup.homepage - hxxp://www.google.ca/

FF - user.js: browser.startup.homepage_override.buildID - 20111104165243

FF - user.js: browser.startup.homepage_override.mstone - rv:8.0

FF - user.js: browser.syncPromoViewsLeft - 0

FF - user.js: browser.tabs.warnOnClose - false

FF - user.js: browser.taskbar.lastgroupid - Mozilla.Firefox.8.0

FF - user.js: config.trim_on_minimize - false

FF - user.js: extensions.adblockplus.currentVersion - 1.3.10

FF - user.js: extensions.blocklist.pingCountTotal - 3

FF - user.js: extensions.blocklist.pingCountVersion - 3

FF - user.js: extensions.bootstrappedAddons - {}

FF - user.js: extensions.databaseSchema - 6

FF - user.js: extensions.enabledAddons - SkipScreen@SkipScreen:0.6.1.2,{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10,{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20111107,{972ce4c6-7e08-4474-a285-3208198ce6fd}:8.0

FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\C:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1321580143394}}},{\name\:\app-profile\,\addons\:{\SkipScreen@SkipScreen\:{\descriptor\:\C:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\SkipScreen@SkipScreen.xpi\,\mtime\:1321580339478},\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\:{\descriptor\:\C:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\,\mtime\:1321587790256},\{c0c588b6-b11d-4898-af00-079fed05aa32}\:{\descriptor\:\C:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{c0c588b6-b11d-4898-af00-079fed05aa32}.xpi\,\mtime\:1321643858397},\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\C:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1321580339525}}}]

FF - user.js: extensions.lastAppVersion - 8.0

FF - user.js: extensions.lastPlatformVersion - 8.0

FF - user.js: extensions.pendingOperations - false

FF - user.js: extensions.shownSelectionUI - true

FF - user.js: extensions.skipscreen.firstrun - false

FF - user.js: extensions.skipscreen.firstskipdate - Thu Nov 17 2011 21:39:02 GMT-0400 (Atlantic Standard Time)

FF - user.js: extensions.skipscreen.hostMatchStr - hxxp://www.4shared.com/(get|audio|file|document|dir)/.*|http://.*depositfiles.com/(([a-z]{2})/files/|auth-).*|http://(www.)*digg.com/(.{5}|.{6})$|http://www.divshare.com/.*|http://(www.)*filesonic.com/file/.*|http://www.filestube.com/(.*?/details.html|[a-z0-9A-Z]{20}.*)|http://(www.)*hotfile.com/dl/.*|http://(www.)*letitbit.net/download(/.*|[0-9].php)|http://(www.)*limelinx.com/files/.*|http://(([a-zA-Z0-9]){6}.)*link-protector.com/.*|http://lix.in.*|http://(www.)*mediafire.com/(download.php|file)|http://(www.)*mediafire.com/?.*|http://(www.)*megaporn.com/?.*|http://(www.)*megashare.com/.*|http://(www.)*megashares.com/.*|http://(www.)*megaupload.com/?.*|http://(www.)*multiupload.com/?.*|https?://(www.)*rapidshare.com/(files/|#!download).*|http://(www.)*remixshare.com/(download|dl|container)/.*|http://www.sendspace.com/.*|http://sharebee.com/.*|http://(www.)*storage.to/get/.*|http://uploaded.to/file/.*|http://uploaded.to/?view.*|http://uploading.com/files/(get/)*[a-z0-9A-Z]{8}/.*|http://(www.)*vip-file.com/downloadl/.*|http://(www.)*zshare.net/(download|audio)/.*

FF - user.js: extensions.skipscreen.version - 0.6.1.2

FF - user.js: extensions.ui.lastCategory - addons://list/theme

FF - user.js: extensions.ui.locale.hidden - true

FF - user.js: font.internaluseonly.changed - false

FF - user.js: idle.lastDailyNotification - 1321827284

FF - user.js: intl.charsetmenu.browser.cache - UTF-16, windows-1252, ISO-8859-15, ISO-8859-1, UTF-8

FF - user.js: network.cookie.prefsMigrated - true

FF - user.js: network.dns.disableIPv6 - true

FF - user.js: network.dnsCacheEntries - 200

FF - user.js: network.dnsCacheExpiration - 240

FF - user.js: network.http.connect.timeout - 60

FF - user.js: network.http.keep-alive.timeout - 300

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 12

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: nglayout.initialpaint.delay - 0

FF - user.js: places.database.lastMaintenance - 1321827284

FF - user.js: places.history.expiration.transient_current_max_pages - 37498

FF - user.js: pref.browser.homepage.disable_button.current_page - false

FF - user.js: privacy.sanitize.migrateFx3Prefs - true

FF - user.js: services.sync.clients.lastSync - 0

FF - user.js: services.sync.clients.lastSyncLocal - 0

FF - user.js: services.sync.migrated - true

FF - user.js: services.sync.tabs.lastSync - 0

FF - user.js: services.sync.tabs.lastSyncLocal - 0

FF - user.js: storage.vacuum.last.index - 1

FF - user.js: storage.vacuum.last.places.sqlite - 1321581736

FF - user.js: toolkit.telemetry.prompted - true

FF - user.js: urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey - 1324172165

FF - user.js: weboftrust.automatic_updates - false

FF - user.js: weboftrust.cookie_updated - 1321835304103

FF - user.js: weboftrust.extension_id - 5cce0b2091356b76ac3b01ce33b2e111a03ee5e9

FF - user.js: weboftrust.firstrun_guide - 2

FF - user.js: weboftrust.last_message - 20110214

FF - user.js: weboftrust.last_version - 20111107

FF - user.js: weboftrust.search.aolsearch.display - AOL Search

FF - user.js: weboftrust.search.aolsearch.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/

FF - user.js: weboftrust.search.aolsearch.pre0.match - 3

FF - user.js: weboftrust.search.aolsearch.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*redir\\\\?.*s_cu=(http.+)(&.*)?

FF - user.js: weboftrust.search.aolsearch.prestyle - .HL [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.aolsearch.style - a.find ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 2px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.aolsearch.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*aol\\.[a-z]{2,}\\/[^\\\\?]*search\\\\?.+

FF - user.js: weboftrust.search.ask.display - Ask.com Web Search

FF - user.js: weboftrust.search.ask.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/

FF - user.js: weboftrust.search.ask.pre0.match - 4

FF - user.js: weboftrust.search.ask.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/(bar|r)\\\\?.*&u=(http[^&]+)

FF - user.js: weboftrust.search.ask.prestyle - .s_binoc2 ~ [ATTR], .nu ~ [ATTR], [ATTR=\safeweb.norton.com\] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.ask.style - a.title ~ [ATTR=\NAME\], a.L4 ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.ask.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*ask\\.com\\/web\\\\?.+

FF - user.js: weboftrust.search.baidu.display - Baidu

FF - user.js: weboftrust.search.baidu.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/

FF - user.js: weboftrust.search.baidu.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.baidu.style - .f a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.baidu.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*baidu\\.com\\/s\\\\?.+

FF - user.js: weboftrust.search.bing.display - Bing

FF - user.js: weboftrust.search.bing.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(msn(scache)?|live|bingj?|microsofttranslator)\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.bing.prestyle - .rc_p [ATTR], .sb_vdl [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.bing.style - .nc_tc a ~ [ATTR=\NAME\], .sb_tlst a ~ [ATTR=\NAME\], .sn_rct a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.bing.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*bing\\.com\\/search\\\\?

FF - user.js: weboftrust.search.dmoz.display - dmoz - Open Directory Project

FF - user.js: weboftrust.search.dmoz.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dmoz\\.org\\/

FF - user.js: weboftrust.search.dmoz.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.dmoz.style - li a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.dmoz.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dmoz\\.org\\/

FF - user.js: weboftrust.search.dogpile.display - Dogpile

FF - user.js: weboftrust.search.dogpile.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/

FF - user.js: weboftrust.search.dogpile.pre0.match - 3

FF - user.js: weboftrust.search.dogpile.pre0.re - ^http(s)?\\:\\/\\/cs\\.(dogpile|infospace)\\.com\\/ClickHandler.+ru=(http[^&]+)

FF - user.js: weboftrust.search.dogpile.prestyle - .paidSearchResult [ATTR] { display: none ! important; } .searchResultsPane { max-width: 44.08em; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.dogpile.style - a.resultTitle ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.dogpile.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*dogpile\\.com\\/(info\\.[^\\/]+/)?(search\\/)?web.+

FF - user.js: weboftrust.search.facebook.display - Facebook

FF - user.js: weboftrust.search.facebook.dynamic - 1

FF - user.js: weboftrust.search.facebook.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(facebook\\.(com|net)|fbcdn\\.net|bing\\.com)\\/

FF - user.js: weboftrust.search.facebook.match0.attribute0.flags - n

FF - user.js: weboftrust.search.facebook.match0.attribute0.name - class

FF - user.js: weboftrust.search.facebook.match0.attribute0.re - mceContentBody

FF - user.js: weboftrust.search.facebook.match0.element - body

FF - user.js: weboftrust.search.facebook.prestyle - .uiHeader [ATTR], a.uiLinkSubtle ~ [ATTR], .profile-picture [ATTR], .HovercardContent td > a ~ [ATTR], .uiAttachmentTitle ~ a ~ [ATTR], a.UIImageBlock_Image ~ [ATTR], .UIMediaItem [ATTR], .UIStoryAttachment_Caption [ATTR], .uiStreamPassive [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.facebook.style - a[onmousedown^=\UntrustedLink\] ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.facebook.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/

FF - user.js: weboftrust.search.facebook.urlign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*facebook\\.com\\/(plugins|extern)\\/

FF - user.js: weboftrust.search.gmail.display - Gmail

FF - user.js: weboftrust.search.gmail.dynamic - 1

FF - user.js: weboftrust.search.gmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.gmail.match0.attribute0.flags - n

FF - user.js: weboftrust.search.gmail.match0.attribute0.name - class

FF - user.js: weboftrust.search.gmail.match0.attribute0.re - editable

FF - user.js: weboftrust.search.gmail.match0.element - body

FF - user.js: weboftrust.search.gmail.pre0.match - 4

FF - user.js: weboftrust.search.gmail.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?googlesyndication\\.com\\/(aclk|pagead).*\\\\?.*adurl=(.+)(&.*)?

FF - user.js: weboftrust.search.gmail.prestyle - .e ~ [ATTR], #gbd [ATTR], #gbi [ATTR], .vd ~ [ATTR], .Ni ~ [ATTR], .mr ~ [ATTR], [ATTR] { position: absolute; visibility: hidden; } .e:last-of-type ~ [ATTR] { position: relative; visibility: visible; } #message-area-container ~ #container .source-link ~ [ATTR], #message-area-container ~ #container .title-link ~ [ATTR] { display: none ! important; }

FF - user.js: weboftrust.search.gmail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-bottom: 2px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.gmail.url - ^http(s)?\\:\\/\\/mail\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(mail|a)\\/.+

FF - user.js: weboftrust.search.gmail.urlign - &(name=htmlcompose|view=(js|cw)&)

FF - user.js: weboftrust.search.google.display - Google

FF - user.js: weboftrust.search.google.dynamic - 1

FF - user.js: weboftrust.search.google.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|profiles|adwords|labs|investor|encrypted|code|services|checkout|trends|plus)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:

FF - user.js: weboftrust.search.google.pre0.match - 9

FF - user.js: weboftrust.search.google.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.google.prestyle - #scTopOfPageRefinementLinks[partner=\wot\] [ATTR], #gb [ATTR], #gbd [ATTR], .g > div > div > div span > a.l ~ [ATTR], .ts td > a ~ [ATTR], .result-image [ATTR], .cite ~ [ATTR], .gl [ATTR], .g > a:not([class]):first-child ~ [ATTR], a.f1 ~ [ATTR], a.fl ~ [ATTR], a[href^=\/\][href*=\&oi=video_result\] ~ [ATTR], a[href^=\/\][href*=\&ct=image\] ~ [ATTR], a[href^=\/\][href*=\&sa=X&\] ~ [ATTR], .slk [ATTR], #gbar [ATTR], #ssb [ATTR], #doc3 [ATTR], #sft [ATTR], .osl [ATTR], #rtr [ATTR], .bc [ATTR], #nycprv [ATTR] { display: none ! important; } a[creator=\SiteAdvisor\] img { position: relative ! important; } [mclinkinfo] a ~ [ATTR], a[creator=\SiteAdvisor\] + [ATTR=\siteadvisor.com\], [id^=\BubbleLayer\] [ATTR] { display: none ! important; } [ATTR] { display: none ! important; }

FF - user.js: weboftrust.search.google.script - if(document.location.protocol==\http:\){if(typeof(contentscript)==\object\){contentscript.update();}else if((!window.parent||window==window.parent)&&typeof(loader)!=\object\){loader={time:Date.now(),maxage:300000,url:\hxxp://api.mywot.com/0.4/script?target=google\};var script=wot_getlastscript();if(!script||script.url.indexOf(loader.url)!=0||script.time<(loader.time-loader.maxage)){wot_loadscript(loader.url+(wot_getapiparams()||\\)+\&_=\+loader.time);}else if(script.status==200&&script.code.length>0){eval(script.code);}}}

FF - user.js: weboftrust.search.google.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; display: inline-block ! important; }

FF - user.js: weboftrust.search.google.url - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/

FF - user.js: weboftrust.search.google.urlign - ^http(s)?\\:\\/\\/((www|encrypted)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(\\+|a\\/|accounts|ad(s|manager|planner|sense|words)|alerts|analytics|apps|appserve|base|calendar|chrome(frame)?|codesearch|comparisonads|corporate|crisisresponse|datacenter|dfp|dictionary|doodle|educators|enterprise|events|experimental|familysafety|finance|flutrends|friendconnect|goog411|googlebooks|googlenotebook|googlevoice|gwt|help|history|hostednews|images|imgres|ime|insights|landing|local|logos|mapmaker|maps|mobile|moon|music|newproducts|news|notebook|patents|phone|postini|powermeter|press|profiles|publicdata|puzzles|onlinechallenge|reader|recaptcha|relief|services|s2|sitesearch|sky|smallbusinessnetwork|squared|submit|support|sync|talk|toolbar|uds|ventures|voice|wallet|web(masters|elements)|intl\\/[^\\/]+\\/.+|search\\\\?.*tbm=isch)

FF - user.js: weboftrust.search.googleimages.display - Google Image Search

FF - user.js: weboftrust.search.googleimages.dynamic - 1

FF - user.js: weboftrust.search.googleimages.ign - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)*(www|g?mail|maps|news|groups|books|scholar|video|images|blogsearch|translate|sites|docs|picasaweb|adwords|labs|investor)\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|q=(cache|related)\\:

FF - user.js: weboftrust.search.googleimages.pre0.match - 5

FF - user.js: weboftrust.search.googleimages.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/imgres\\\\?.*img(ref)?url=(.+)(&.*)?

FF - user.js: weboftrust.search.googleimages.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.googleimages.style - a.rg_l ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 5px; left: 5px; position: absolute; visibility: visible; } #ImgContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; top: 0px; margin-left: -20px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.googleimages.url - ^http(s)?\\:\\/\\/(www|images)\\.google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(images\\\\?.+|search\\\\?.*tbm=isch)

FF - user.js: weboftrust.search.hotmail.display - Windows Live Hotmail

FF - user.js: weboftrust.search.hotmail.dynamic - 1

FF - user.js: weboftrust.search.hotmail.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(live|(imagine-)?msn|microsoft)\\.com\\/

FF - user.js: weboftrust.search.hotmail.match0.element - #mp0_msgPartBody

FF - user.js: weboftrust.search.hotmail.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.hotmail.style - .MsgPartBody a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.hotmail.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*mail\\.live\\.com\\/mail\\/

FF - user.js: weboftrust.search.ixquick.display - Ixquick

FF - user.js: weboftrust.search.ixquick.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/?

FF - user.js: weboftrust.search.ixquick.pre0.match - 6

FF - user.js: weboftrust.search.ixquick.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?

FF - user.js: weboftrust.search.ixquick.pre1.match - 4

FF - user.js: weboftrust.search.ixquick.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/highlight.*&u=(http[^&]*)

FF - user.js: weboftrust.search.ixquick.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.ixquick.style - a.title ~ [ATTR=\NAME\], a.title2 ~ [ATTR=\NAME\], .result h3 > a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.ixquick.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*(ixquick|startpage|startingpage)\\.com\\/do\\/metasearch

FF - user.js: weboftrust.search.mailru.display - Mail.Ru

FF - user.js: weboftrust.search.mailru.ign - ^http(s)?\\:\\/\\/(.+\\.)?mail\\.ru\\/

FF - user.js: weboftrust.search.mailru.pre0.match - 9

FF - user.js: weboftrust.search.mailru.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.mailru.prestyle - a ~ [ATTR] ~ a ~ [ATTR], .video-thumb [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.mailru.style - .res-head a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.mailru.url - ^http(s)?\\:\\/\\/go\\.mail\\.ru\\/search\\?.+

FF - user.js: weboftrust.search.naver.display - Naver

FF - user.js: weboftrust.search.naver.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/

FF - user.js: weboftrust.search.naver.prestyle - .thumb_wrap [ATTR], .thumb [ATTR], .mov_thumb [ATTR], .btn_area [ATTR], .txt_block [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.naver.style - #content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.naver.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*naver\\.com\\/search.*\\\\?.+

FF - user.js: weboftrust.search.rambler.display - Rambler

FF - user.js: weboftrust.search.rambler.ign - ^http(s)?\\:\\/\\/(.+\\.)?rambler\\.ru\\/

FF - user.js: weboftrust.search.rambler.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.rambler.style - .search-results a.title ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.rambler.url - ^http(s)?\\:\\/\\/nova\\.rambler\\.ru\\/(search|srch)\\?.+

FF - user.js: weboftrust.search.reddit.display - reddit

FF - user.js: weboftrust.search.reddit.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/

FF - user.js: weboftrust.search.reddit.prestyle - .thumbnail ~ [ATTR], .footer [ATTR], #ad [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.reddit.style - .content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.reddit.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*reddit\\.com\\/

FF - user.js: weboftrust.search.reddit.urlign - ^http(s)?\\:\\/\\/blog\\.reddit\\.com\\/

FF - user.js: weboftrust.search.searchcom.display - Search.com

FF - user.js: weboftrust.search.searchcom.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*search\\.com\\/.+

FF - user.js: weboftrust.search.searchcom.pre0.match - 3

FF - user.js: weboftrust.search.searchcom.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?search\\.com\\/click.*\\\\?.*,(http.*)$

FF - user.js: weboftrust.search.searchcom.pre1.match - 6

FF - user.js: weboftrust.search.searchcom.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/(url|pagead|interstitial|aclk).*\\\\?.*(q|adurl|url)=(.+)(&.*)?

FF - user.js: weboftrust.search.searchcom.prestyle - .attrib [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.searchcom.style - .title a ~ [ATTR=\NAME\], .savvyad_unit a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; } .savvyad_unit a ~ [ATTR] { float: right; margin-top: -16px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.searchcom.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*search\\.com\\/search(\\\\?|\\/).+

FF - user.js: weboftrust.search.seznam.display - Seznam

FF - user.js: weboftrust.search.seznam.ign - ^http(s)?\\:\\/\\/(.+\\.)?(seznam|sklik)\\.cz\\/

FF - user.js: weboftrust.search.seznam.pre0.match - 3

FF - user.js: weboftrust.search.seznam.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)?sklik\\.cz\\/click.*url=([^&]+)

FF - user.js: weboftrust.search.seznam.prestyle - .limiter > a ~ [ATTR], .hintImage a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.seznam.style - .result a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.seznam.url - ^http(s)?\\:\\/\\/search\\.seznam\\.cz\\/

FF - user.js: weboftrust.search.twitter.display - Twitter

FF - user.js: weboftrust.search.twitter.dynamic - 1

FF - user.js: weboftrust.search.twitter.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/

FF - user.js: weboftrust.search.twitter.prestyle - .meta a ~ [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.twitter.style - #content a ~ [ATTR=\NAME\], .tweet-text a ~ [ATTR=\NAME\], .message-content a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.twitter.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*twitter\\.com\\/

FF - user.js: weboftrust.search.twitter.urlign - ^http(s)?\\:\\/\\/platform\\.twitter\\.com\\/widgets\\/

FF - user.js: weboftrust.search.vkontakte.display - VKontakte

FF - user.js: weboftrust.search.vkontakte.dynamic - 1

FF - user.js: weboftrust.search.vkontakte.ign - ^http(s)?\\:\\/\\/(.+\\.)?(vk\\.com|vkontakte\\.ru)\\/

FF - user.js: weboftrust.search.vkontakte.match0.attribute0.flags - n

FF - user.js: weboftrust.search.vkontakte.match0.attribute0.name - class

FF - user.js: weboftrust.search.vkontakte.match0.attribute0.re - editor_body

FF - user.js: weboftrust.search.vkontakte.match0.element - body

FF - user.js: weboftrust.search.vkontakte.pre0.match - 5

FF - user.js: weboftrust.search.vkontakte.pre0.re - http(s)?\\:\\/\\/(vk\\.com|vkontakte\\.ru)\\/away\\.php\\?.*(to)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.vkontakte.style - #content a ~ [ATTR=NAME], #pv_box a ~ [ATTR=NAME], #wk_box a ~ [ATTR=NAME], a.lnk ~ [ATTR=NAME] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.vkontakte.url - ^http(s)?\\:\\/\\/(vkontakte\\.ru|vk\\.com)\\/

FF - user.js: weboftrust.search.webde.display - WEB.DE

FF - user.js: weboftrust.search.webde.ign - ^http(s)?\\:\\/\\/(.+\\.)?web\\.de\\/

FF - user.js: weboftrust.search.webde.pre0.match - 9

FF - user.js: weboftrust.search.webde.pre0.re - ^http(s)?\\:\\/\\/(([\\w\\-]+\\.)?google\\.(com?\\.[a-z]{2}|[a-z]{2,})|([\\w\\-]+\\.)*start3\\.mozilla\\.com)\\/(url|pagead|interstitial|aclk|product_url).*\\\\?.*(q|adurl|url)(=|%3D)(https?(\\:|%3A)[^&]+)(&.*)?

FF - user.js: weboftrust.search.webde.prestyle - [ATTR] { position: absolute; visibility: hidden; } .sponsoredLink a { display: inline ! important; }

FF - user.js: weboftrust.search.webde.style - .resultContent h3 a ~ [ATTR=\NAME\], .sponsoredLink h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.webde.url - ^http(s)?\\:\\/\\/suche\\.web\\.de\\/search\\/(web|dir)

FF - user.js: weboftrust.search.wikipedia.display - Wikipedia

FF - user.js: weboftrust.search.wikipedia.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.wikipedia.style - #bodyContent a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat ! important; margin-left: 4px ! important; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.wikipedia.url - ^http(s)?\\:\\/\\/.+\\.wiki(pedia|news)\\.org\\/

FF - user.js: weboftrust.search.wikipedia.urlign - \\/w\\/extensions\\/|&action=(edit|submit)

FF - user.js: weboftrust.search.yahoo.display - Yahoo!

FF - user.js: weboftrust.search.yahoo.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/|^http(s)?\\:\\/\\/.+\\/search\\/cache\\\\?

FF - user.js: weboftrust.search.yahoo.pre0.match - 4

FF - user.js: weboftrust.search.yahoo.pre0.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*http.+yahoo\\.[a-z]{2,}.+fu=(http.+)

FF - user.js: weboftrust.search.yahoo.pre1.match - 4

FF - user.js: weboftrust.search.yahoo.pre1.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/.+\\*\\*(http.+)

FF - user.js: weboftrust.search.yahoo.pre2.match - 4

FF - user.js: weboftrust.search.yahoo.pre2.re - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/click\\\\?u=(http.+)

FF - user.js: weboftrust.search.yahoo.prestyle - .bbox [ATTR], .right [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yahoo.style - a.yschttl ~ [ATTR=\NAME\], .active a ~ [ATTR=\NAME\], .hd h3 a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; padding-top: 1px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.yahoo.url - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yahoo\\.(com?\\.[a-z]{2}|[a-z]{2,})\\/search[;\\\\?].+

FF - user.js: weboftrust.search.yahoomail.display - Yahoo! Mail

FF - user.js: weboftrust.search.yahoomail.dynamic - 1

FF - user.js: weboftrust.search.yahoomail.ign - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*(yahoo\\.(com|net)|ymailupdates\\.com)\\/

FF - user.js: weboftrust.search.yahoomail.match0.condition - or

FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.name - class

FF - user.js: weboftrust.search.yahoomail.match0.match0.attribute0.re - msg-body

FF - user.js: weboftrust.search.yahoomail.match0.match0.element - div

FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.name - id

FF - user.js: weboftrust.search.yahoomail.match0.match1.attribute0.re - ^(messageAreaIframe|ViewArea_.*)$

FF - user.js: weboftrust.search.yahoomail.match0.match1.element - $frame

FF - user.js: weboftrust.search.yahoomail.prestyle - [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yahoomail.style - a ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.search.yahoomail.url - ^http(s)?\\:\\/\\/([\\w\\-]*\\.)*mail\\.yahoo\\.(com|net)\\/(dc|neo|om\\/api)\\/

FF - user.js: weboftrust.search.yandex.display - Yandex

FF - user.js: weboftrust.search.yandex.ign - ^http(s)?\\:\\/\\/([\\w\\-]+\\.)*yandex\\.([a-z]{2,}|com\\.[a-z]{2})\\/

FF - user.js: weboftrust.search.yandex.prestyle - .redirect [ATTR], .show-player ~ [ATTR], .moreInfo [ATTR], .l-head [ATTR] { display: none ! important; } [ATTR] { position: absolute; visibility: hidden; }

FF - user.js: weboftrust.search.yandex.style - .b-serp-item__title-link ~ [ATTR=\NAME\], .b-serp-item__title__link ~ [ATTR=\NAME\], .agp ~ [ATTR=\NAME\], .title ~ [ATTR=\NAME\], .domain ~ [ATTR=\NAME\] { background: url(IMAGE) right no-repeat; margin-left: 0px; margin-right: 4px; position: relative; visibility: visible; }

FF - user.js: weboftrust.shared.1 - 4sq.com,abcn.ws,aol.it,apne.ws,bbc.in,bzfd.it,clck.ru,cs.pn,d3w.io,dlvr.it,eca.sh,engt.co,es.pn,exm.nr,f.ast.ly,fa.by,flpbd.it,gd.is,ht.ly,huff.to,ind.pn,is.gd,j.mp,lat.ms,lnkd.in,migre.me,n.pr,nblo.gs,nyr.kr,nyti.ms,on.cnn.com,on.mash.to,on.msnbc.com,ow.ly,pep.si,ping.fm,politi.co,post.ly,rww.to,su.pr,t.co,tcrn.ch,tgr.ph,thkpr.gs,tiny.ly,tinyurl.com,tl.gd,tldr.us,tr.im,twitter.com,usat.me,wapo.st,wp.me,x.co,yhoo.it

FF - user.js: weboftrust.shared.2 - bit.ly,bitly.com,goo.gl,gu.com,sites.google.com

FF - user.js: weboftrust.show_rating_frame - false

FF - user.js: weboftrust.status_level - c0a90e52b9eb578d70e9cc9c0aa2fedfc89c9647

FF - user.js: weboftrust.update_checked - 1321825588322

FF - user.js: weboftrust.witness_id - 3b6f343831d7ec0b92f1e3819778eb41e6aed35f

FF - user.js: weboftrust.witness_key - 009183b09cb96501c2d17145c773303fbfc45ce8

FF - user.js: xpinstall.whitelist.add -

FF - user.js: xpinstall.whitelist.add.36 -

.

TRY · November 23, 2011

DDS.txt (PART2)

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]

R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]

R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]

R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-23 490840]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-10-13 361984]

R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]

R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]

R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-11-23 44768]

R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\eMachines\eMachines Power Management\ePowerSvc.exe [2009-8-21 844320]

R2 Greg_Service;GRegService;C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [2009-6-4 1150496]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-11-21 366152]

R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-6 2358656]

R2 Updater Service;Updater Service;C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [2009-8-21 240160]

R2 vseamps;vseamps;C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe [2010-4-8 149544]

R2 vsedsps;vsedsps;C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe [2010-4-8 148008]

R2 vseqrts;vseqrts;C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe [2010-4-8 205352]

R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 136176]

S2 sesvc;ShadowExplorer Service;C:\Program Files (x86)\ShadowExplorer\sesvc.exe [2011-11-22 9216]

S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]

S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 136176]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

S3 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

S4 IObitUnlocker;IObitUnlocker;C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [2011-11-22 35256]

.

=============== File Associations ===============

.

JSEFile=NOTEPAD.EXE %1

.

=============== Created Last 30 ================

.

2011-11-23 18:45:56 -------- d-----w- C:\Users\Brad\AppData\Local\temp

2011-11-23 18:02:47 -------- d-----w- C:\Users\Brad\AppData\Roaming\IObit

2011-11-23 17:19:45 -------- d-----w- C:\MGtools

2011-11-23 16:26:36 -------- d-----w- C:\Windows\ehome

2011-11-23 15:28:34 98816 ----a-w- C:\Windows\sed.exe

2011-11-23 15:28:34 518144 ----a-w- C:\Windows\SWREG.exe

2011-11-23 15:28:34 256000 ----a-w- C:\Windows\PEV.exe

2011-11-23 15:28:34 208896 ----a-w- C:\Windows\MBR.exe

2011-11-23 15:00:25 -------- d-----w- C:\ProgramData\Comodo

2011-11-23 14:52:48 -------- d-----w- C:\_OTL

2011-11-23 14:10:52 -------- d-----w- C:\Users\Brad\AppData\Roaming\SpeedyPC Software

2011-11-23 14:10:52 -------- d-----w- C:\Users\Brad\AppData\Roaming\DriverCure

2011-11-23 14:10:41 -------- d-----w- C:\ProgramData\SpeedyPC Software

2011-11-23 13:38:13 65368 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys

2011-11-23 13:38:13 601944 ----a-w- C:\Windows\System32\drivers\aswSnx.sys

2011-11-23 13:37:28 -------- d-----w- C:\ProgramData\AVAST Software

2011-11-23 13:37:28 -------- d-----w- C:\Program Files\AVAST Software

2011-11-23 11:27:02 -------- d-----w- C:\Users\Brad\AppData\Local\COMODO

2011-11-23 11:01:11 -------- d-----w- C:\ProgramData\Comodo Downloader

2011-11-23 07:52:18 -------- d-----w- C:\Users\Brad\AppData\Local\ElevatedDiagnostics

2011-11-23 06:39:28 -------- d-----w- C:\WinDVD2

2011-11-22 18:28:37 -------- d-----w- C:\Windows\System32\wbem\Logs

2011-11-22 18:18:33 -------- d-----w- C:\Windows\System32\wbem\MOF\good

2011-11-22 18:18:33 -------- d-----w- C:\Windows\System32\wbem\MOF\bad

2011-11-22 18:18:33 -------- d-----w- C:\Windows\System32\wbem\MOF

2011-11-22 18:10:01 -------- d-----w- C:\Users\Brad\AppData\Local\Remove_Empty_Directories

2011-11-22 17:57:38 -------- d-----w- C:\Users\Brad\AppData\Local\Eraser 6

2011-11-22 17:05:08 -------- d-----w- C:\Users\Brad\AppData\Roaming\KoshyJohn.com

2011-11-22 16:26:30 -------- d-----w- C:\Program Files\Eraser

2011-11-22 16:22:01 -------- d-----w- C:\Program Files (x86)\File Shredder

2011-11-22 16:09:16 -------- d-----w- C:\ProgramData\IObit

2011-11-22 16:09:16 -------- d-----w- C:\Program Files (x86)\IObit

2011-11-22 16:04:37 -------- d-----w- C:\Program Files (x86)\Remove Empty Directories

2011-11-22 07:07:25 -------- d-----w- C:\Users\Brad\VirtualBox VMs

2011-11-22 06:44:35 -------- d-----w- C:\Users\Brad\.VirtualBox

2011-11-22 06:43:48 224048 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys

2011-11-22 06:43:37 130864 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys

2011-11-22 06:43:32 -------- d-----w- C:\Program Files\Oracle

2011-11-22 06:26:05 -------- d-----w- C:\Users\Brad\AppData\Roaming\www.shadowexplorer.com

2011-11-22 06:24:30 -------- d-----w- C:\Program Files (x86)\ShadowExplorer

2011-11-22 06:20:45 388096 ----a-r- C:\Users\Brad\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-22 06:20:45 -------- d-----w- C:\Program Files (x86)\Trend Micro

2011-11-22 03:41:25 -------- d-----w- C:\Users\Brad\AppData\Roaming\Auslogics

2011-11-22 01:25:10 -------- d-----w- C:\Program Files (x86)\COMODO

2011-11-21 11:03:21 25160 ----a-w- C:\Windows\System32\drivers\hitmanpro35.sys

2011-11-21 07:07:00 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2011-11-21 06:41:41 -------- d-----w- C:\Backup

2011-11-21 00:24:33 -------- d-----w- C:\ProgramData\kingsoft

2011-11-20 21:18:30 -------- d-----w- C:\Program Files (x86)\Cisco

2011-11-20 21:10:40 -------- d-----w- C:\Users\Brad\AppData\Local\AMD

2011-11-20 21:04:33 -------- d-----w- C:\Program Files (x86)\AMD APP

2011-11-20 21:04:24 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies

2011-11-20 21:04:20 53376 ----a-w- C:\Windows\System32\drivers\usbfilter.sys

2011-11-20 21:03:24 -------- d-----w- C:\Program Files (x86)\ATI Technologies

2011-11-20 21:03:23 -------- d-----w- C:\ProgramData\AMD

2011-11-20 21:03:17 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys

2011-11-20 21:02:20 -------- d-----w- C:\Program Files\Common Files\ATI Technologies

2011-11-20 21:00:59 9978880 ----a-w- C:\Windows\System32\aticaldd64.dll

2011-11-20 20:43:49 -------- d-----w- C:\Program Files\ATI Technologies

2011-11-20 20:42:08 -------- d-----w- C:\ATI

2011-11-20 20:35:31 -------- d-----w- C:\Windows\SysWow64\RTCOM

2011-11-20 20:33:23 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe

2011-11-19 22:40:43 -------- d-----w- C:\Program Files (x86)\Auslogics

2011-11-19 22:07:11 -------- d-----w- C:\Users\Brad\AppData\Local\Apple Computer

2011-11-19 22:05:28 -------- d-----w- C:\Users\Brad\AppData\Local\Apple

2011-11-19 21:33:55 -------- d-----w- C:\Users\Brad\AppData\Roaming\Mipony

2011-11-19 18:48:12 -------- d-----w- C:\Program Files\Hitman Pro 3.5

2011-11-19 18:48:04 -------- d-----w- C:\ProgramData\Hitman Pro

2011-11-19 18:41:40 -------- d-----w- C:\Program Files (x86)\GIMP-2.0

2011-11-19 18:30:53 -------- d-----w- C:\Program Files\CPUID

2011-11-19 18:27:22 -------- d-----w- C:\Program Files\Speccy

2011-11-19 17:32:46 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll

2011-11-19 17:32:46 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll

2011-11-19 17:32:44 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll

2011-11-19 17:32:44 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll

2011-11-18 18:50:09 -------- d-----w- C:\Program Files\CCleaner

2011-11-17 20:02:20 -------- d-----w- C:\Users\Brad\AppData\Roaming\TuneUp Software

2011-11-17 17:10:39 -------- d-----w- C:\Users\Brad\AppData\Local\{422A3319-4DD3-4E03-9B93-F1CDBD444068}

2011-11-17 17:10:32 -------- d-----w- C:\Users\Brad\AppData\Local\{7C3D7488-8A4C-4F11-B09A-7819671B2DAC}

2011-11-17 16:36:36 74 ----a-w- C:\Users\Brad\AppData\Roaming\Microsoft\Windows\SendTo\listfiles.bat

2011-11-16 22:31:11 -------- d-----w- C:\Users\Brad\AppData\Roaming\SUPERAntiSpyware.com

2011-11-16 22:31:02 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2011-11-16 22:31:02 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2011-11-16 22:27:30 -------- d-----w- C:\Program Files (x86)\NirSoft

2011-11-16 20:20:39 -------- d-----w- C:\Program Files (x86)\FileHippo.com

2011-11-16 19:01:35 -------- d-----w- C:\Users\Brad\AppData\Roaming\uTorrent

2011-11-16 19:01:35 -------- d-----w- C:\Users\Brad\AppData\Local\uTorrent

2011-11-16 18:40:32 -------- d-----w- C:\Users\Brad\AppData\Roaming\Systweak

2011-11-16 15:24:46 -------- d-----w- C:\Users\Brad\AppData\Roaming\OOo-dev

2011-11-16 15:23:12 -------- d-----w- C:\Program Files (x86)\OOo-dev 3

2011-11-16 01:37:43 -------- d-----w- C:\Users\Brad\AppData\Roaming\pdfforge

2011-11-16 01:37:39 87040 ----a-w- C:\Windows\System32\pdfcmnnt.dll

2011-11-16 01:37:39 137000 ----a-w- C:\Windows\SysWow64\MSMAPI32.OCX

2011-11-16 01:37:39 1071088 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX

2011-11-16 01:37:36 23552 ----a-w- C:\Windows\SysWow64\MSMPIDE.DLL

2011-11-16 01:37:36 -------- d-----w- C:\Program Files (x86)\PDFCreator

2011-11-10 14:05:58 -------- d-----w- C:\Windows\.jagex_cache_32

2011-11-08 18:44:48 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll

2011-11-08 18:44:48 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll

2011-11-08 18:44:46 1923952 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2011-11-08 18:44:45 3144704 ----a-w- C:\Windows\System32\win32k.sys

2011-11-07 18:56:45 -------- d-----w- C:\Windows\System32\drivers\NISx64\1301010.003

2011-11-07 18:52:07 -------- d-----w- C:\Windows\System32\drivers\NISx64

2011-11-06 06:37:24 -------- d-----w- C:\Program Files (x86)\TeamViewer

2011-11-04 22:14:37 -------- d-s---w- C:\Windows\SysWow64\Microsoft

2011-11-04 16:37:00 165680 ----a-w- C:\Windows\System32\drivers\VBoxNetFlt.sys

2011-11-04 16:37:00 146736 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys

2011-11-04 16:36:58 320816 ----a-w- C:\Windows\System32\VBoxNetFltNobj.dll

2011-11-02 20:31:09 33920 ----a-w- C:\Windows\SysWow64\drivers\fsbts.sys

2011-11-01 17:12:48 24984 ----a-w- C:\Windows\SysWow64\drivers\BC.sys

2011-11-01 14:26:08 -------- d-----w- C:\ProgramData\Systweak

2011-11-01 13:25:33 -------- d-----w- C:\Users\Brad\jagexcache1

2011-10-31 21:46:00 -------- d-----w- C:\Windows\System32\W7NBC

2011-10-30 22:45:45 96338 ----a-w- C:\ProgramData\1320014648.bdinstall.bin

2011-10-30 22:40:38 199793 ----a-w- C:\ProgramData\1320014130.bdinstall.bin

2011-10-30 16:23:45 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\4a6f961c1cc972004\MeshBetaRemover.exe

2011-10-30 16:23:42 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\467006671cc972003\DSETUP.dll

2011-10-30 16:23:42 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\467006671cc972003\DXSETUP.exe

2011-10-30 16:23:42 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\467006671cc972003\dsetup32.dll

2011-10-30 16:23:29 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\40cb23221cc972002\DSETUP.dll

2011-10-30 16:23:29 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\40cb23221cc972002\DXSETUP.exe

2011-10-30 16:23:29 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\40cb23221cc972002\dsetup32.dll

2011-10-30 14:09:38 925184 ----a-w- C:\Windows\expstart.exe

2011-10-30 13:59:28 328704 ----a-w- C:\Windows\System32\uDWM_backup_w7abt.dll

2011-10-30 13:59:28 120320 ----a-w- C:\Windows\System32\dwm_backup_w7abt.exe

2011-10-30 13:58:55 2871808 ----a-w- C:\Windows\explorer.backup.exe

2011-10-30 13:58:54 -------- d-----w- C:\Windows\W7SOC

2011-10-25 04:14:25 -------- d-----r- C:\Program Files (x86)\Skype

.

==================== Find3M ====================

.

2011-11-14 17:46:14 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-11-06 01:51:56 6656 ----a-w- C:\Windows\System32\lpcio.dll

2011-10-20 03:10:14 22872 ----a-w- C:\Windows\System32\RegistryDefragBootTime.exe

2011-10-19 18:05:06 627600 ----a-w- C:\Windows\System32\deployJava1.dll

2011-10-18 23:53:14 2957544 ----a-w- C:\Windows\System32\drivers\RTKVHD64.sys

2011-10-18 22:10:30 99432 ----a-w- C:\Windows\System32\RCoInst64.dll

2011-10-18 17:55:50 331880 ----a-w- C:\Windows\System32\RtlCPAPI64.dll

2011-10-18 17:47:22 1914472 ----a-w- C:\Windows\System32\RtkApi64.dll

2011-10-18 15:05:00 2528872 ----a-w- C:\Windows\System32\RtPgEx64.dll

2011-10-17 21:30:38 3213928 ----a-w- C:\Windows\System32\RtkAPO64.dll

2011-10-14 17:43:48 1873920 ----a-w- C:\Windows\System32\RCoRes64.dat

2011-10-13 21:37:30 10496000 ----a-w- C:\Windows\System32\drivers\atikmdag.sys

2011-10-13 20:57:02 24864768 ----a-w- C:\Windows\System32\atio6axx.dll

2011-10-13 20:53:24 66560 ----a-w- C:\Windows\System32\OpenVideo64.dll

2011-10-13 20:53:18 56832 ----a-w- C:\Windows\SysWow64\OpenVideo.dll

2011-10-13 20:53:10 66560 ----a-w- C:\Windows\System32\OVDecoder64.dll

2011-10-13 20:53:02 56832 ----a-w- C:\Windows\SysWow64\OVDecoder.dll

2011-10-13 20:52:52 16991744 ----a-w- C:\Windows\System32\amdocl64.dll

2011-10-13 20:52:08 13950976 ----a-w- C:\Windows\SysWow64\amdocl.dll

2011-10-13 20:51:20 51200 ----a-w- C:\Windows\System32\OpenCL.dll

2011-10-13 20:51:14 44032 ----a-w- C:\Windows\SysWow64\OpenCL.dll

2011-10-13 20:36:08 18756096 ----a-w- C:\Windows\SysWow64\atioglxx.dll

2011-10-13 20:35:12 159744 ----a-w- C:\Windows\System32\atiapfxx.exe

2011-10-13 20:35:00 748544 ----a-w- C:\Windows\SysWow64\aticfx32.dll

2011-10-13 20:33:48 892416 ----a-w- C:\Windows\System32\aticfx64.dll

2011-10-13 20:31:26 466944 ----a-w- C:\Windows\System32\ATIDEMGX.dll

2011-10-13 20:31:16 516608 ----a-w- C:\Windows\System32\atieclxx.exe

2011-10-13 20:30:44 204288 ----a-w- C:\Windows\System32\atiesrxx.exe

2011-10-13 20:29:44 120320 ----a-w- C:\Windows\System32\atitmm64.dll

2011-10-13 20:29:26 423424 ----a-w- C:\Windows\System32\atipdl64.dll

2011-10-13 20:29:22 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll

2011-10-13 20:29:12 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll

2011-10-13 20:29:08 21504 ----a-w- C:\Windows\System32\atimuixx.dll

2011-10-13 20:29:04 59392 ----a-w- C:\Windows\System32\atiedu64.dll

2011-10-13 20:29:00 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll

2011-10-13 20:25:28 4292096 ----a-w- C:\Windows\SysWow64\atidxx32.dll

2011-10-13 20:20:26 1113088 ----a-w- C:\Windows\System32\atiumd6v.dll

2011-10-13 20:19:52 1828864 ----a-w- C:\Windows\SysWow64\atiumdmv.dll

2011-10-13 20:19:40 4042752 ----a-w- C:\Windows\System32\atiumd6a.dll

2011-10-13 20:16:22 5041664 ----a-w- C:\Windows\System32\atidxx64.dll

2011-10-13 20:10:28 51200 ----a-w- C:\Windows\System32\aticalrt64.dll

2011-10-13 20:10:24 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll

2011-10-13 20:10:16 44544 ----a-w- C:\Windows\System32\aticalcl64.dll

2011-10-13 20:10:14 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll

2011-10-13 20:09:28 4188672 ----a-w- C:\Windows\SysWow64\atiumdva.dll

2011-10-13 20:06:16 8449024 ----a-w- C:\Windows\SysWow64\aticaldd.dll

2011-10-13 20:05:56 4353536 ----a-w- C:\Windows\SysWow64\atiumdag.dll

2011-10-13 20:00:10 5510144 ----a-w- C:\Windows\System32\atiumd64.dll

2011-10-13 19:59:44 58880 ----a-w- C:\Windows\System32\coinst.dll

2011-10-13 19:53:32 486912 ----a-w- C:\Windows\System32\atiadlxx.dll

2011-10-13 19:53:24 339968 ----a-w- C:\Windows\SysWow64\atiadlxy.dll

2011-10-13 19:53:10 17408 ----a-w- C:\Windows\System32\atig6pxx.dll

2011-10-13 19:53:06 14336 ----a-w- C:\Windows\SysWow64\atiglpxx.dll

2011-10-13 19:53:06 14336 ----a-w- C:\Windows\System32\atiglpxx.dll

2011-10-13 19:53:04 39936 ----a-w- C:\Windows\System32\atig6txx.dll

2011-10-13 19:52:56 32768 ----a-w- C:\Windows\SysWow64\atigktxx.dll

2011-10-13 19:52:50 326656 ----a-w- C:\Windows\System32\drivers\atikmpag.sys

2011-10-13 19:52:10 40960 ----a-w- C:\Windows\System32\atiuxp64.dll

2011-10-13 19:52:04 31744 ----a-w- C:\Windows\SysWow64\atiuxpag.dll

2011-10-13 19:52:00 38912 ----a-w- C:\Windows\System32\atiu9p64.dll

2011-10-13 19:51:54 29184 ----a-w- C:\Windows\SysWow64\atiu9pag.dll

2011-10-13 19:51:32 54784 ----a-w- C:\Windows\System32\atimpc64.dll

2011-10-13 19:51:32 54784 ----a-w- C:\Windows\System32\amdpcom64.dll

2011-10-13 19:51:26 53760 ----a-w- C:\Windows\SysWow64\atimpc32.dll

2011-10-13 19:51:26 53760 ----a-w- C:\Windows\SysWow64\amdpcom32.dll

2011-10-13 19:51:22 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll

2011-10-03 08:06:03 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2011-09-27 03:32:28 111408 ----a-w- C:\Windows\System32\drivers\35247947.sys

2011-09-20 02:54:44 108656 ----a-w- C:\Windows\System32\drivers\L1C62x64.sys

2011-09-06 21:45:29 41184 ----a-w- C:\Windows\avastSS.scr

2011-09-02 18:21:40 221024 ----a-w- C:\Windows\System32\SFNHK64.dll

2011-09-02 18:21:38 78688 ----a-w- C:\Windows\System32\SFAPO64.dll

2011-09-02 18:21:36 81248 ----a-w- C:\Windows\System32\SFCOM64.dll

2011-09-01 14:15:10 553280 ----a-w- C:\Windows\System32\drivers\avckf.sys

2011-09-01 05:24:07 2309120 ----a-w- C:\Windows\System32\jscript9.dll

2011-09-01 05:17:57 1389056 ----a-w- C:\Windows\System32\wininet.dll

2011-09-01 05:12:04 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2011-09-01 02:35:59 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll

2011-09-01 02:28:15 1126912 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-09-01 02:22:54 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2011-08-31 22:12:00 1698408 ----a-w- C:\Windows\RtlExUpd.dll

2011-08-31 21:00:50 25416 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-08-27 05:37:49 861696 ----a-w- C:\Windows\System32\oleaut32.dll

2011-08-27 05:37:48 331776 ----a-w- C:\Windows\System32\oleacc.dll

2011-08-27 04:26:27 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll

2011-08-27 04:26:27 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll

.

============= FINISH: 15:13:17.65 ===============

Superdave · November 23, 2011

Hello and welcome to IOBit Forums. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.

2. The fixes are specific to your problem and should only be used for this issue on this machine.

3. If you don't know or understand something, please don't hesitate to ask.

4. Please DO NOT run any other tools or scans while I am helping you.

5. It is important that you reply to this thread. Do not start a new topic.

6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

*************************************************************

P2P - I see you have P2P software installed on your machine. (µTorrent)We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

***********************************************

You can also uninstall Java 6 Update 22. It's no longer needed

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)

* Double-click the icon on your desktop to run the installer.

* When asked to Update the program definitions, click Yes

* If you encounter any problems while downloading the updates, manually download and unzip them from here

* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts

* Click the Scanning Control tab.

* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning

•Scan for tracking cookies

•Terminate memory threats before quarantining

•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer

* On the left check the box for the drive you are scanning.

* On the right choose Perform Complete Scan

* Click Next to start the scan. Please be patient while it scans your computer.

* After the scan is complete a summary box will appear. Click OK

* Make sure everything in the white box has a check next to it, then click Next

* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:

•After reboot, double-click the SUPERAntiSpyware icon on your desktop.

•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).

•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)

* Click close and close again to exit the program.

*Copy and Paste the log in your post.

**********************************************

Please download Malwarebytes Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

TRY · November 23, 2011

Malwarebytes' Anti-Malware 1.51.2.1300

http://www.malwarebytes.org

Database version: 8226

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

23/11/2011 4:38:22 PM

mbam-log-2011-11-23 (16-38-22).txt

Scan type: Full scan (C:\|)

Objects scanned: 279637

Time elapsed: 32 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

TRY · November 23, 2011

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 11/23/2011 at 05:27 PM

Application Version : 5.0.1136

Core Rules Database Version : 7982

Trace Rules Database Version: 5794

Scan type : Complete Scan

Total Scan Time : 00:43:53

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC Off - Administrator

Memory items scanned : 783

Memory threats detected : 0

Registry items scanned : 72064

Registry threats detected : 0

File items scanned : 61235

File threats detected : 0

Superdave · November 23, 2011

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1

Link 2

* Double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

*********************************************************

Download ComboFix by sUBs from one of the below links. Be sure to save it to the Desktop.

link # 1

Link # 2

If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab

* Set to "Always ask me where to Save the files".

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Right-click combofix.exe and select Run as Administrator and follow the prompts.

When finished, ComboFix will produce a log for you.

Post the ComboFix login your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

TRY · November 24, 2011

Log: Results of screen317's Security Check version 0.99.28

Windows 7 x64 (UAC is disabled!)

Internet Explorer 9

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

avast! Free Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

TuneUp Utilities Language Pack (en-US)

Java 6 Update 29

Mozilla Firefox (8.0.)

Mozilla Thunderbird (8.0.)

````````````````````````````````

Process Check:

objlist.exe by Laurent

Malwarebytes' Anti-Malware mbamservice.exe

Common Files Authentium AntiVirus5 vsedsps.exe

Common Files Authentium AntiVirus5 vseamps.exe

Common Files Authentium AntiVirus5 vseqrts.exe

AVAST Software Avast AvastSvc.exe

AVAST Software Avast AvastUI.exe

``````````End of Log````````````

TRY · November 24, 2011

Doing ComboFix now 8:)

TRY · November 24, 2011

ComboFix (PART1)

ComboFix 11-11-23.03 - Brad 23/11/2011 22:11:35.2.1 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.1788.1014 [GMT -4:00]

Running from: c:\users\Brad\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2011-10-24 to 2011-11-24 )))))))))))))))))))))))))))))))

.

2011-11-24 02:20 . 2011-11-24 02:24 -------- d-----w- c:\users\Brad\AppData\Local\temp

2011-11-24 02:20 . 2011-11-24 02:20 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp

2011-11-24 02:20 . 2011-11-24 02:20 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-11-23 18:02 . 2011-11-23 18:02 -------- d-----w- c:\users\Brad\AppData\Roaming\IObit

2011-11-23 17:19 . 2011-11-23 17:25 -------- d-----w- C:\MGtools

2011-11-23 16:26 . 2011-11-23 16:26 -------- d-----w- c:\windows\ehome

2011-11-23 16:26 . 2011-11-23 16:26 -------- d-----w- c:\users\Default\AppData\Roaming\Media Center Programs

2011-11-23 15:00 . 2011-11-23 15:00 -------- d-----w- c:\programdata\Comodo

2011-11-23 14:52 . 2011-11-23 14:52 -------- d-----w- C:\_OTL

2011-11-23 14:10 . 2011-11-23 14:10 -------- d-----w- c:\users\Brad\AppData\Roaming\SpeedyPC Software

2011-11-23 14:10 . 2011-11-23 14:10 -------- d-----w- c:\users\Brad\AppData\Roaming\DriverCure

2011-11-23 14:10 . 2011-11-23 14:12 -------- d-----w- c:\programdata\SpeedyPC Software

2011-11-23 13:38 . 2011-09-06 21:38 301912 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-11-23 13:38 . 2011-09-06 21:36 24408 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-11-23 13:38 . 2011-09-06 21:36 42328 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-11-23 13:38 . 2011-09-06 21:36 58200 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-11-23 13:38 . 2011-09-06 21:38 601944 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-11-23 13:38 . 2011-09-06 21:36 65368 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2011-11-23 13:38 . 2011-09-06 21:45 254400 ----a-w- c:\windows\system32\aswBoot.exe

2011-11-23 13:37 . 2011-11-23 13:37 -------- d-----w- c:\programdata\AVAST Software

2011-11-23 13:37 . 2011-11-23 13:37 -------- d-----w- c:\program files\AVAST Software

2011-11-23 11:27 . 2011-11-23 13:31 -------- d-----w- c:\users\Brad\AppData\Local\COMODO

2011-11-23 11:01 . 2011-11-23 11:01 -------- d-----w- c:\programdata\Comodo Downloader

2011-11-23 07:52 . 2011-11-23 08:58 -------- d-----w- c:\users\Brad\AppData\Local\ElevatedDiagnostics

2011-11-23 06:39 . 2011-11-23 07:55 -------- d-----w- C:\WinDVD2

2011-11-22 18:29 . 2011-11-22 18:29 -------- d-----w- c:\windows\Sun

2011-11-22 18:28 . 2011-11-22 18:28 -------- d-----w- c:\windows\system32\wbem\Logs

2011-11-22 18:18 . 2011-11-22 18:18 -------- d-----w- c:\windows\system32\wbem\MOF

2011-11-22 18:10 . 2011-11-22 18:10 -------- d-----w- c:\users\Brad\AppData\Local\Remove_Empty_Directories

2011-11-22 17:57 . 2011-11-22 17:57 -------- d-----w- c:\users\Brad\AppData\Local\Eraser 6

2011-11-22 17:05 . 2011-11-22 17:05 -------- d-----w- c:\users\Brad\AppData\Roaming\KoshyJohn.com

2011-11-22 16:26 . 2011-11-22 16:26 -------- d-----w- c:\program files\Eraser

2011-11-22 16:22 . 2011-11-22 16:22 -------- d-----w- c:\program files (x86)\File Shredder

2011-11-22 16:11 . 2011-11-22 17:35 -------- d-----w- c:\users\Brad\AppData\Roaming\Notepad++

2011-11-22 16:11 . 2011-11-22 16:11 -------- d-----w- c:\program files (x86)\Notepad++

2011-11-22 16:09 . 2011-11-23 18:03 -------- d-----w- c:\programdata\IObit

2011-11-22 16:09 . 2011-11-23 18:02 -------- d-----w- c:\program files (x86)\IObit

2011-11-22 16:04 . 2011-11-22 16:04 -------- d-----w- c:\program files (x86)\Remove Empty Directories

2011-11-22 07:07 . 2011-11-22 07:07 -------- d-----w- c:\users\Brad\VirtualBox VMs

2011-11-22 06:44 . 2011-11-23 22:00 -------- d-----w- c:\users\Brad\.VirtualBox

2011-11-22 06:43 . 2011-11-04 16:37 224048 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys

2011-11-22 06:43 . 2011-11-04 16:37 130864 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys

2011-11-22 06:43 . 2011-11-22 06:43 -------- d-----w- c:\program files\Oracle

2011-11-22 06:26 . 2011-11-22 06:26 -------- d-----w- c:\users\Brad\AppData\Roaming\www.shadowexplorer.com

2011-11-22 06:24 . 2011-11-22 06:24 -------- d-----w- c:\program files (x86)\ShadowExplorer

2011-11-22 06:20 . 2011-11-22 06:20 388096 ----a-r- c:\users\Brad\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-22 06:20 . 2011-11-22 06:20 -------- d-----w- c:\program files (x86)\Trend Micro

2011-11-22 03:41 . 2011-11-22 17:13 -------- d-----w- c:\users\Brad\AppData\Roaming\Auslogics

2011-11-22 01:25 . 2011-11-23 11:32 -------- d-----w- c:\program files (x86)\COMODO

2011-11-21 11:03 . 2011-11-23 15:24 25160 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-11-21 07:07 . 2011-11-21 07:07 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-11-21 06:41 . 2011-11-24 02:07 -------- d-----w- C:\Backup

2011-11-21 00:24 . 2011-11-21 01:06 -------- d-----w- c:\programdata\kingsoft

2011-11-20 21:18 . 2011-11-20 21:18 -------- d-----w- c:\program files (x86)\Cisco

2011-11-20 21:10 . 2011-11-20 21:10 -------- d-----w- c:\users\Brad\AppData\Local\AMD

2011-11-20 21:09 . 2011-11-20 21:09 -------- d-----w- c:\programdata\ATI

2011-11-20 21:04 . 2011-11-20 21:04 -------- d-----w- c:\program files (x86)\AMD APP

2011-11-20 21:04 . 2011-11-20 21:04 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies

2011-11-20 21:04 . 2011-08-17 20:44 53376 ----a-w- c:\windows\system32\drivers\usbfilter.sys

2011-11-20 21:03 . 2011-11-20 21:03 -------- d-----w- c:\program files (x86)\ATI Technologies

2011-11-20 21:03 . 2011-11-20 21:03 -------- d-----w- c:\programdata\AMD

2011-11-20 21:03 . 2010-02-18 13:18 46136 ----a-w- c:\windows\system32\drivers\amdiox64.sys

2011-11-20 21:02 . 2011-11-20 21:02 -------- d-----w- c:\program files\Common Files\ATI Technologies

2011-11-20 21:00 . 2011-10-13 21:37 10496000 ----a-w- c:\windows\system32\drivers\atikmdag.sys

2011-11-20 20:43 . 2011-11-20 21:03 -------- d-----w- c:\program files\ATI Technologies

2011-11-20 20:42 . 2011-11-20 20:42 -------- d-----w- C:\ATI

2011-11-20 20:35 . 2011-11-20 20:35 -------- d-----w- c:\windows\SysWow64\RTCOM

2011-11-20 20:33 . 2005-11-14 03:19 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe

2011-11-19 22:40 . 2011-11-23 16:29 -------- d-----w- c:\program files (x86)\Auslogics

2011-11-19 22:10 . 2011-11-23 07:54 -------- d-----w- c:\program files (x86)\Google

2011-11-19 22:07 . 2011-11-19 22:07 -------- d-----w- c:\users\Brad\AppData\Local\Apple Computer

2011-11-19 22:07 . 2011-11-20 06:20 -------- d-----w- c:\users\Brad\AppData\Roaming\Apple Computer

2011-11-19 22:06 . 2011-11-19 22:06 -------- d-----w- c:\programdata\Apple Computer

2011-11-19 22:05 . 2011-11-19 22:05 -------- d-----w- c:\users\Brad\AppData\Local\Apple

2011-11-19 22:05 . 2011-11-19 22:05 -------- d-----w- c:\programdata\Apple

2011-11-19 21:33 . 2011-11-21 01:13 -------- d-----w- c:\users\Brad\AppData\Roaming\Mipony

2011-11-19 18:48 . 2011-11-21 10:57 -------- d-----w- c:\program files\Hitman Pro 3.5

2011-11-19 18:48 . 2011-11-19 18:48 -------- d-----w- c:\programdata\Hitman Pro

2011-11-19 18:41 . 2011-11-19 18:41 -------- d-----w- c:\program files (x86)\GIMP-2.0

2011-11-19 18:30 . 2011-11-19 19:22 -------- d-----w- c:\program files\CPUID

2011-11-19 18:28 . 2011-11-19 18:28 -------- d-----w- c:\program files\Recuva

2011-11-19 18:27 . 2011-11-19 18:27 -------- d-----w- c:\program files\Speccy

2011-11-19 17:32 . 2009-09-04 21:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll

2011-11-19 17:32 . 2009-09-04 21:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll

2011-11-19 17:32 . 2009-09-04 21:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll

2011-11-19 17:32 . 2009-09-04 21:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll

2011-11-18 18:50 . 2011-11-23 17:29 -------- d-----w- c:\program files\CCleaner

2011-11-17 20:02 . 2011-11-17 23:01 -------- d-----w- c:\users\Brad\AppData\Roaming\TuneUp Software

2011-11-17 16:36 . 2011-11-17 16:35 74 ----a-w- c:\users\Brad\AppData\Roaming\Microsoft\Windows\SendTo\listfiles.bat

2011-11-16 22:31 . 2011-11-16 22:31 -------- d-----w- c:\users\Brad\AppData\Roaming\SUPERAntiSpyware.com

2011-11-16 22:31 . 2011-11-16 22:31 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-11-16 22:31 . 2011-11-16 22:31 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2011-11-16 22:27 . 2011-11-16 22:27 -------- d-----w- c:\program files (x86)\NirSoft

2011-11-16 20:20 . 2011-11-16 20:20 -------- d-----w- c:\program files (x86)\FileHippo.com

2011-11-16 19:01 . 2011-11-23 17:29 -------- d-----w- c:\users\Brad\AppData\Roaming\uTorrent

2011-11-16 19:01 . 2011-11-16 19:01 -------- d-----w- c:\users\Brad\AppData\Local\uTorrent

2011-11-16 18:40 . 2011-11-21 08:55 -------- d-----w- c:\users\Brad\AppData\Roaming\Systweak

2011-11-16 15:24 . 2011-11-16 15:24 -------- d-----w- c:\users\Brad\AppData\Roaming\OOo-dev

2011-11-16 15:23 . 2011-11-16 15:23 -------- d-----w- c:\program files (x86)\OOo-dev 3

2011-11-16 01:37 . 2011-11-16 01:37 -------- d-----w- c:\users\Brad\AppData\Roaming\pdfforge

2011-11-16 01:37 . 2005-04-16 00:58 1071088 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX

2011-11-16 01:37 . 2005-03-12 05:07 87040 ----a-w- c:\windows\system32\pdfcmnnt.dll

2011-11-16 01:37 . 1998-06-24 05:00 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX

2011-11-16 01:37 . 2011-11-16 01:37 -------- d-----w- c:\program files (x86)\PDFCreator

2011-11-16 01:37 . 1998-07-06 05:00 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL

2011-11-10 14:05 . 2011-11-23 07:55 -------- d-----w- c:\windows\.jagex_cache_32

2011-11-08 18:44 . 2011-10-01 05:45 886784 ----a-w- c:\program files\Common Files\System\wab32.dll

2011-11-08 18:44 . 2011-10-01 04:37 708608 ----a-w- c:\program files (x86)\Common Files\System\wab32.dll

2011-11-08 18:44 . 2011-09-29 16:29 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-11-08 18:44 . 2011-09-29 04:03 3144704 ----a-w- c:\windows\system32\win32k.sys

2011-11-07 18:52 . 2011-11-07 19:02 -------- d-----w- c:\windows\system32\drivers\NISx64

2011-11-07 11:11 . 2011-11-23 16:26 -------- d-----w- c:\program files\Windows Sidebar

2011-11-06 06:37 . 2011-11-06 06:37 -------- d-----w- c:\program files (x86)\TeamViewer

2011-11-04 22:14 . 2011-11-04 22:14 -------- d-s---w- c:\windows\SysWow64\Microsoft

2011-11-04 16:37 . 2011-11-04 16:37 165680 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys

2011-11-04 16:37 . 2011-11-04 16:37 146736 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys

2011-11-04 16:36 . 2011-11-04 16:36 320816 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll

2011-11-03 00:08 . 2011-11-03 00:10 -------- d-----w- c:\users\Brad\AppData\Roaming\gtk-2.0

2011-11-02 20:31 . 2011-11-02 20:31 33920 ----a-w- c:\windows\SysWow64\drivers\fsbts.sys

2011-11-01 17:12 . 2011-10-20 16:11 24984 ----a-w- c:\windows\SysWow64\drivers\BC.sys

2011-11-01 14:26 . 2011-11-21 08:55 -------- d-----w- c:\programdata\Systweak

2011-11-01 13:25 . 2011-11-01 13:25 -------- d-----w- c:\users\Brad\jagexcache1

2011-10-31 21:46 . 2011-10-31 21:46 -------- d-----w- c:\windows\system32\W7NBC

2011-10-30 22:45 . 2011-10-30 22:45 96338 ----a-w- c:\programdata\1320014648.bdinstall.bin

2011-10-30 22:40 . 2011-10-30 22:40 199793 ----a-w- c:\programdata\1320014130.bdinstall.bin

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-14 17:46 . 2011-06-09 23:25 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-11-06 01:51 . 2011-08-09 22:30 6656 ----a-w- c:\windows\system32\lpcio.dll

2011-10-20 03:10 . 2011-09-08 20:33 22872 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe

2011-10-19 18:05 . 2011-08-05 23:25 627600 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-13 20:53 . 2011-10-13 20:53 66560 ----a-w- c:\windows\system32\OpenVideo64.dll

2011-10-13 20:53 . 2011-10-13 20:53 56832 ----a-w- c:\windows\SysWow64\OpenVideo.dll

2011-10-13 20:53 . 2011-10-13 20:53 66560 ----a-w- c:\windows\system32\OVDecoder64.dll

2011-10-13 20:53 . 2011-10-13 20:53 56832 ----a-w- c:\windows\SysWow64\OVDecoder.dll

2011-10-13 20:52 . 2011-10-13 20:52 16991744 ----a-w- c:\windows\system32\amdocl64.dll

2011-10-13 20:52 . 2011-10-13 20:52 13950976 ----a-w- c:\windows\SysWow64\amdocl.dll

2011-10-13 20:51 . 2011-10-13 20:51 51200 ----a-w- c:\windows\system32\OpenCL.dll

2011-10-13 20:51 . 2011-10-13 20:51 44032 ----a-w- c:\windows\SysWow64\OpenCL.dll

2011-10-13 20:16 . 2009-08-22 02:37 5041664 ----a-w- c:\windows\system32\atidxx64.dll

2011-10-03 08:06 . 2010-05-18 17:10 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll

2011-09-27 03:32 . 2011-09-27 03:32 111408 ----a-w- c:\windows\system32\drivers\35247947.sys

2011-09-21 12:00 . 2011-10-13 04:40 9049936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FFF1F55F-8E47-4CA2-A447-82CA69052051}\mpengine.dll

2011-09-20 02:54 . 2011-09-20 02:54 108656 ----a-w- c:\windows\system32\drivers\L1C62x64.sys

2011-09-18 20:58 . 2010-06-24 14:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2011-09-10 13:43 . 2011-09-10 13:43 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll

2011-09-10 13:42 . 2011-09-10 13:42 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2011-09-10 13:42 . 2011-09-10 13:42 573760 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-09-06 21:45 . 2011-10-19 20:24 41184 ----a-w- c:\windows\avastSS.scr

2011-09-06 21:45 . 2011-10-19 20:24 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe

2011-09-01 14:15 . 2011-09-01 14:15 553280 ----a-w- c:\windows\system32\drivers\avckf.sys

2011-09-01 05:24 . 2011-10-12 09:02 2309120 ----a-w- c:\windows\system32\jscript9.dll

2011-09-01 05:17 . 2011-10-12 09:02 1389056 ----a-w- c:\windows\system32\wininet.dll

2011-09-01 05:12 . 2011-10-12 09:02 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-01 02:35 . 2011-10-12 09:02 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll

2011-09-01 02:28 . 2011-10-12 09:02 1126912 ----a-w- c:\windows\SysWow64\wininet.dll

2011-09-01 02:22 . 2011-10-12 09:02 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb

2011-08-31 22:12 . 2009-08-22 01:50 1698408 ----a-w- c:\windows\RtlExUpd.dll

2011-08-31 21:00 . 2010-10-29 18:25 25416 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-27 05:37 . 2011-10-12 09:00 861696 ----a-w- c:\windows\system32\oleaut32.dll

2011-08-27 05:37 . 2011-10-12 09:00 331776 ----a-w- c:\windows\system32\oleacc.dll

2011-08-27 04:26 . 2011-10-12 09:00 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll

2011-08-27 04:26 . 2011-10-12 09:00 233472 ----a-w- c:\windows\SysWow64\oleacc.dll

.

((((((((((((((((((((((((((((( SnapShot@2011-11-23_18.37.35 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-07-14 04:54 . 2011-11-23 18:40 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-07-14 04:54 . 2011-11-24 01:44 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-07-14 04:54 . 2011-11-24 01:44 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-14 04:54 . 2011-11-23 18:40 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-07-14 04:54 . 2011-11-23 18:40 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 04:54 . 2011-11-24 01:44 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 05:10 . 2011-11-24 02:25 72864 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

- 2009-07-14 05:10 . 2011-11-23 18:40 72864 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2009-12-27 20:51 . 2011-11-24 02:25 51502 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1897117093-3640443674-392562110-1001_UserData.bin

- 2011-11-23 18:36 . 2011-11-23 18:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-11-24 01:40 . 2011-11-24 02:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-11-24 01:40 . 2011-11-24 02:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2011-11-23 18:36 . 2011-11-23 18:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-08-22 02:34 . 2011-11-24 01:44 100268 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2011-10-30 14:02 . 2011-11-23 22:45 649456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

- 2011-10-30 14:02 . 2011-11-23 18:34 649456 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-09-09 00:06 . 2011-11-23 22:45 353220 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2011-09-09 00:06 . 2011-11-23 18:34 353220 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2011-09-09 00:06 . 2011-11-23 22:45 17675004 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1897117093-3640443674-392562110-1001-12288.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-11-12 1647448]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"LManager"="c:\program files (x86)\launch manager\lmanager.exe" [2009-07-27 1157128]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-13 343168]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"DisableStatusMessages"= 1 (0x1)

"DisableStartupSound"= 1 (0x1)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoThumbnailCache"= 1 (0x1)

"DisableThumbnailsOnNetworkFolders"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sasnative64

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

.

R0 cjxtpv;cjxtpv; [x]

R0 nckkof;nckkof; [x]

R0 tvelms;tvelms; [x]

R1 aswSnx;aswSnx; [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 136176]

R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]

R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 136176]

R3 ksfmonsys;ksfmonsys;c:\program files (x86)\Kingsoft\PCDoctor\ksfmonsys64.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver; [x]

R3 SASENUM;SASENUM; [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

R4 IObitUnlocker;IObitUnlocker;c:\program files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [2011-08-26 35256]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]

S1 aswSP;aswSP; [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]

S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]

S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-10 490840]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-10-13 361984]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x]

S2 ePowerSvc;Acer ePower Service;c:\program files\eMachines\eMachines Power Management\ePowerSvc.exe [2009-08-06 844320]

S2 Greg_Service;GRegService;c:\program files (x86)\eMachines\Registration\GregHSRW.exe [2009-06-04 1150496]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

S2 sesvc;ShadowExplorer Service;c:\program files (x86)\ShadowExplorer\sesvc.exe [2011-01-03 9216]

S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]

S2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [2009-07-04 240160]

S2 vseamps;vseamps;c:\program files\Common Files\Authentium\AntiVirus5\vseamps.exe [2010-04-08 149544]

S2 vsedsps;vsedsps;c:\program files\Common Files\Authentium\AntiVirus5\vsedsps.exe [2010-04-08 148008]

S2 vseqrts;vseqrts;c:\program files\Common Files\Authentium\AntiVirus5\vseqrts.exe [2010-04-08 205352]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]

S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]

S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

iissvcs REG_MULTI_SZ w3svc was

apphost REG_MULTI_SZ apphostsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 22:10]

.

2011-11-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-11-19 22:10]

.

2011-11-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1897117093-3640443674-392562110-1001Core.job

- c:\users\Brad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-19 21:58]

.

2011-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1897117093-3640443674-392562110-1001UA.job

- c:\users\Brad\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-19 21:58]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-09-06 21:45 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Acer ePower Management"="c:\program files\emachines\emachines power management\epowertray.exe" [2009-08-06 828960]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]

.

ComodoFix.zip

TRY · November 24, 2011

ComboFix (PART2)

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.2.1 142.177.2.130

TCP: Interfaces\{4F96B375-E0BA-4CB3-8D4D-369D9686818A}: NameServer = 8.26.56.26,156.154.70.22

TCP: Interfaces\{7EA15B26-1C81-4787-8908-863F775EAAAF}: NameServer = 8.26.56.26,156.154.70.22

FF - ProfilePath - c:\users\Brad\AppData\Roaming\Mozilla\Firefox\Profiles\ym3u2kcs.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/

# Mozilla User Preferences

/* Do not edit this file.

*

* If you make changes to this file while the application is running,

* the changes will be overwritten when the application exits.

*

* To make a manual change to preferences, you can visit the URL about:config

* For more information, see hxxp://www.mozilla.org/unix/customizing.html#prefs

*/

FF - user.js: app.update.lastUpdateTime.addon-background-update-timer - 1321757050

FF - user.js: app.update.lastUpdateTime.background-update-timer - 1321757290

FF - user.js: app.update.lastUpdateTime.blocklist-background-update-timer - 1321757170

FF - user.js: app.update.lastUpdateTime.search-engine-update-timer - 1321817882

FF - user.js: browser.blink_allowed - false

FF - user.js: browser.bookmarks.restore_default_bookmarks - false

FF - user.js: browser.cache.disk.capacity - 1048576

FF - user.js: browser.cache.disk.smart_size.first_run - false

FF - user.js: browser.cache.disk.smart_size_cached_value - 1048576

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.download.dir - c:\\Users\\Brad\\Downloads

FF - user.js: browser.download.lastDir - c:\\Users\\Brad\\Desktop

FF - user.js: browser.download.useDownloadDir - false

FF - user.js: browser.migration.version - 5

FF - user.js: browser.places.smartBookmarksVersion - 2

FF - user.js: browser.preferences.advanced.selectedTabIndex - 0

FF - user.js: browser.rights.3.shown - true

FF - user.js: browser.startup.homepage - hxxp://www.google.ca/

FF - user.js: browser.startup.homepage_override.buildID - 20111104165243

FF - user.js: browser.startup.homepage_override.mstone - rv:8.0

FF - user.js: browser.syncPromoViewsLeft - 0

FF - user.js: browser.tabs.warnOnClose - false

FF - user.js: browser.taskbar.lastgroupid - Mozilla.Firefox.8.0

FF - user.js: config.trim_on_minimize - false

FF - user.js: extensions.adblockplus.currentVersion - 1.3.10

FF - user.js: extensions.blocklist.pingCountTotal - 3

FF - user.js: extensions.blocklist.pingCountVersion - 3

FF - user.js: extensions.bootstrappedAddons - {}

FF - user.js: extensions.databaseSchema - 6

FF - user.js: extensions.enabledAddons - SkipScreen@SkipScreen:0.6.1.2,{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10,{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20111107,{972ce4c6-7e08-4474-a285-3208198ce6fd}:8.0

FF - user.js: extensions.installCache - [{\name\:\app-global\,\addons\:{\{972ce4c6-7e08-4474-a285-3208198ce6fd}\:{\descriptor\:\c:\\\\Program Files (x86)\\\\Mozilla Firefox\\\\extensions\\\\{972ce4c6-7e08-4474-a285-3208198ce6fd}\,\mtime\:1321580143394}}},{\name\:\app-profile\,\addons\:{\SkipScreen@SkipScreen\:{\descriptor\:\c:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\SkipScreen@SkipScreen.xpi\,\mtime\:1321580339478},\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\:{\descriptor\:\c:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}\,\mtime\:1321587790256},\{c0c588b6-b11d-4898-af00-079fed05aa32}\:{\descriptor\:\c:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{c0c588b6-b11d-4898-af00-079fed05aa32}.xpi\,\mtime\:1321643858397},\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\:{\descriptor\:\c:\\\\Users\\\\Brad\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\ym3u2kcs.default\\\\extensions\\\\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi\,\mtime\:1321580339525}}}]

FF - user.js: extensions.lastAppVersion - 8.0

FF - user.js: extensions.lastPlatformVersion - 8.0

FF - user.js: extensions.pendingOperations - false

FF - user.js: extensions.shownSelectionUI - true

FF - user.js: extensions.skipscreen.firstrun - false

FF - user.js: extensions.skipscreen.firstskipdate - Thu Nov 17 2011 21:39 GMT-0400 (Atlantic Standard Time)