Malware please help

I have some malware on my laptop i need help with please.

Everywhere on my laptop now some words are underlined, when i hover over these underlined words a box pops up with an advertisement, says text enhance in the upper left corner of the ad.

Also ads are all over my facebook page and it says underneath these ads, NOT FACEBOOK ADS.



regards


Last edited by fubar1010 on 11th April 2012, 10:59 am; edited 1 time in total (Reason for editing : malware as not gone)

Hello and welcome to GeekPolice.Net My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*****************************************************************
SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
*********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************
Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.
* If your antivirus or firewall try to block DDS then please allow it to run.
* When finished DDS will open two (2) logs.
* Save both reports to your desktop.
* The instructions here ask you to attach the Attach.txt.



1) DDS.txt
2) Attach.txt
Instead of attaching, please copy/past both logs into your Thread

Note: DDS will instruct you to post the Attach.txt log as an attachment.
Please just post it as you would any other log by copying and pasting it into the reply.

•Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control HERE .Then post your DDS logs. (DDS.txt and Attach.txt )

it will not let me add my super anti spyware log it says i do not have access rights

fubar1010 wrote:

it will not let me add my super anti spyware log it says i do not have access rights

Are you trying to attach it or copy and paste the log?

Superdave wrote:

fubar1010 wrote:

it will not let me add my super anti spyware log it says i do not have access rights

Are you trying to attach it or copy and paste the log?

I have tried both.

it will let me post the bottom half of the log but not the top half
that says that i do not have access rights.


I tried to attach and that said the name was not right.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/12/2012 at 05:42 PM

Application Version : 5.0.1146

Core Rules Database Version : 8445
Trace Rules Database Version: 6257

Scan type : Complete Scan
Total Scan Time : 02:41:27

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned : 642
Memory threats detected : 0
Registry items scanned : 64320
Registry threats detected : 0
File items scanned : 293951
File threats detected : 560

Adware.Tracking Cookie
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\FDRV5WF3.txt [ /enhanceviews.net ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\TJ6LDIJ2.txt [ /specificclick.net ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\PNVU6OC5.txt [ /atdmt.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\WVUMZIIG.txt [ /www.enhanceviews.net ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\W08Y5PM0.txt [ /serving-sys.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\BPQF7L20.txt [ /tacoda.at.atwola.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\2NG49BNR.txt [ /lucidmedia.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\H0A802D3.txt [ /bs.serving-sys.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\T06IYLIZ.txt [ /atwola.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\Q5D999YJ.txt [ /doubleclick.net ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\DQVXLXEI.txt [ /ar.atwola.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\JAD5V5Z9.txt [ /at.atwola.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\Q3TNUNYK.txt [ /statcounter.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\QD09ZST1.txt [ /questionmarket.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\FJSDDJZ3.txt [ /webpower.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\TX2LXLRX.txt [ /accounts.google.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\BOPV1ZNY.txt [ /onesexaday.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\G4QITM50.txt [ /invitemedia.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\PU2UCJXO.txt [ /ru4.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\J5LK44V1.txt [ /apmebf.com ]

C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\9WJPIJMG.txt [ /advertising.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\15D2N44M.txt [ /mediaplex.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\6RZ00FP1.txt [ /imrworldwide.com ]
C:\Users\Jock\AppData\Roaming\Microsoft\Windows\Cookies\Y97XWCOT.txt [ /virginmedia.com ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\GC9ILZ7O.txt [ Cookie:jock@enhanceviews.net/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\L1NJJBDV.txt [ Cookie:jock@atdmt.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\J10BAT3P.txt [ Cookie:jock@www.enhanceviews.net/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\CMN55IXJ.txt [ Cookie:jock@histats.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z5OB7W2E.txt [ Cookie:jock@exoclick.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\VDBMXORT.txt [ Cookie:jock@lucidmedia.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\LWDDGJLP.txt [ Cookie:jock@www.media970.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\X75KP8J2.txt [ Cookie:jock@clickfuse.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\B8JHUNRT.txt [ Cookie:jock@rts.pgmediaserve.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\XYPX9RE3.txt [ Cookie:jock@account.betfair.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\JUB8UCN0.txt [ Cookie:jock@histats.com/stats/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\QJ5ZAUBJ.txt [ Cookie:jock@accounts.google.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\FSZ8X22Q.txt [ Cookie:jock@media6degrees.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\VQGYPDFQ.txt [ Cookie:jock@lfstmedia.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\083TLP19.txt [ Cookie:jock@invitemedia.com/ ]
C:\USERS\JOCK\AppData\Roaming\Microsoft\Windows\Cookies\Low\D0DXW0W4.txt [ Cookie:jock@virginmedia.com/ ]
C:\USERS\JOCK\Cookies\FDRV5WF3.txt [ Cookie:jock@enhanceviews.net/ ]
C:\USERS\JOCK\Cookies\TJ6LDIJ2.txt [ Cookie:jock@specificclick.net/ ]
C:\USERS\JOCK\Cookies\PNVU6OC5.txt [ Cookie:jock@atdmt.com/ ]
C:\USERS\JOCK\Cookies\WVUMZIIG.txt [ Cookie:jock@www.enhanceviews.net/ ]
C:\USERS\JOCK\Cookies\BPQF7L20.txt [ Cookie:jock@tacoda.at.atwola.com/ ]
C:\USERS\JOCK\Cookies\2NG49BNR.txt [ Cookie:jock@lucidmedia.com/ ]
C:\USERS\JOCK\Cookies\T06IYLIZ.txt [ Cookie:jock@atwola.com/ ]
C:\USERS\JOCK\Cookies\Q5D999YJ.txt [ Cookie:jock@doubleclick.net/ ]
C:\USERS\JOCK\Cookies\JAD5V5Z9.txt [ Cookie:jock@at.atwola.com/ ]
C:\USERS\JOCK\Cookies\FJSDDJZ3.txt [ Cookie:jock@webpower.com/ ]
C:\USERS\JOCK\Cookies\TX2LXLRX.txt [ Cookie:jock@accounts.google.com/ ]
C:\USERS\JOCK\Cookies\BOPV1ZNY.txt [ Cookie:jock@onesexaday.com/ ]
C:\USERS\JOCK\Cookies\G4QITM50.txt [ Cookie:jock@invitemedia.com/ ]
C:\USERS\JOCK\Cookies\J5LK44V1.txt [ Cookie:jock@apmebf.com/ ]
C:\USERS\JOCK\Cookies\9WJPIJMG.txt [ Cookie:jock@advertising.com/ ]
C:\USERS\JOCK\Cookies\15D2N44M.txt [ Cookie:jock@mediaplex.com/ ]
C:\USERS\JOCK\Cookies\Y97XWCOT.txt [ Cookie:jock@virginmedia.com/ ]
art.aim4media.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
asset3.countrylife.joyeurs.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
cdn2.baronsmedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
content.yieldmanager.edgesuite.net [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
ds.serving-sys.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
ec.atdmt.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
files.youporn.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
ia.media-imdb.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
media.kyte.tv [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
media.rockstargames.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
media5.wgt.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
msnbcmedia.msn.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
objects.tremormedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
secure-uk.imrworldwide.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
secure-us.imrworldwide.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
spe.atdmt.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
stat.easydate.biz [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
stat.ed.cupidplc.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
stat.upforitnetworks.com [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
tag.mediashakers.hiro.tv [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
www.extrememediasolutions.co.uk [ C:\USERS\JOCK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\RZ3EVQ24 ]
.invitemedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.interclick.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.interclick.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.kantarmedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.legolas-media.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.getclicky.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.static.getclicky.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
in.getclicky.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.lfstmedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.technoratimedia.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]
.histats.com [ C:\USERS\JOCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K7XMNB30.DEFAULT\COOKIES.SQLITE ]

Its letting me do it bit by bit

i am currently running malware bytes and will try to add that log file when it is done.

is what i have posted enough or do you need it all?

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.12.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jock :: JOCK-PC [administrator]

Protection: Enabled

12/04/2012 18:22:07
mbam-log-2012-04-12 (18-22-07).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 462443
Time elapsed: 1 hour(s), 24 minute(s), 18 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Jock at 19:58:02 on 2012-04-12
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4010.930 [GMT 1:00]
.
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files (x86)\Ginger\GingerUpdateService\GingerUpdateService.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\TiltWheelMouse.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\AIM\aim.exe
C:\Users\Jock\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
C:\Program Files (x86)\Ginger\GingerClient.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
C:\Program Files\SRS Labs\SRS Control Panel\srspanel_64.exe
C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Ginger\GingerServices\GingerServices.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\igfxext.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://isearch.avg.com/?cid={48AEED14-1377-413A-A2AF-5014F8DA6763}&mid=1d15d0654f9d47d1ba16653dd932c8da-055f4bebbaaa84848773987d26365bcb1bd81593&lang=en&ds=st011&pr=sa&d=2012-04-07 17:10:55&v=10.0.0.7&sap=hp
uDefault_Page_URL = hxxp://samsung.msn.com
mStart Page = hxxp://samsung.msn.com
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
mWinlogon: Userinit=userinit.exe
BHO: Ginger Grammar & Spell Checker: {0877c1fc-19c6-4fe2-8e3d-699d8edb2964} - C:\Program Files (x86)\Ginger\GingerIEAddin\adxloader.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\IPS\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
BHO: Samsung BHO Class: {aa609d72-8482-4076-8991-8cdae5b93bcb} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
BHO: Codecv Class: {bbc95637-ac5d-4c51-965e-82d984447f2e} - C:\ProgramData\Codecv\bhoclass.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\coIEPlg.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
uRun: [googletalk] C:\Users\Jock\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
uRun: [EnhanceViews_AutoWatched_Program_By_Carbon0x] C:\Users\Jock\Desktop\Enhanceviews Autowatcher v1.93(3).exe
uRun: [Facebook Update] "C:\Users\Jock\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe"
mRun: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\Users\Jock\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Ginger.lnk - C:\Windows\Installer\{1A10532B-CC99-415C-A51F-B8418DE7A395}\NewShortcut1_07A8F5336D4F4AA6858FD2E3E66AF10F.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {328ECD19-C167-40eb-A0C7-16FE7634105E} - {94BB0C4C-B957-479A-85E4-42F53B89F681} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
DPF: {0920DBB1-D098-4ACE-9DDD-7A6F18A9ED66} - hxxps://britishgastopup.paypoint.com/HomeVend.cab
DPF: {283B7DE7-A1ED-4D27-AA59-C6E7427544D2} - hxxps://bg.itronenergypoint.net/IHVConnect/KeyBoxControl.cab
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{71A12470-5355-462F-A8C3-0A5D9E13CAD4} : DhcpNameServer = 194.168.4.100 194.168.8.100
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Ginger Grammar & Spell Checker: {0877c1fc-19c6-4fe2-8e3d-699d8edb2964} - C:\Program Files (x86)\Ginger\GingerIEAddin\adxloader.dll
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\coIEPlg.dll
BHO-X64: Norton Identity Protection - No File
BHO-X64: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\IPS\IPSBHO.DLL
BHO-X64: Norton Vulnerability Protection - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
BHO-X64: Samsung BHO Class: {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
BHO-X64: Samsung BHO Helper - No File
BHO-X64: Codecv Class: {BBC95637-AC5D-4C51-965E-82D984447F2E} - C:\ProgramData\Codecv\bhoclass.dll
BHO-X64: Codecv - No File
BHO-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
BHO-X64: uTorrentBar - No File
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTor.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\coIEPlg.dll
TB-X64: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
mRun-x64: [RemoteControl10] "C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe"
mRun-x64: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
mRun-x64: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun-x64: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Jock\AppData\Roaming\Mozilla\Firefox\Profiles\k7xmnb30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Program Files (x86)\Retrogamer_4wEI\Installr\1.bin\NP4wEISb.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Jock\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Users\Jock\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1306020.00A\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1306020.00A\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1306020.00A\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1306020.00A\SYMEFA64.SYS [?]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120402.001\BHDrvx64.sys [2012-4-3 1160824]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\system32\drivers\NISx64\1306020.00A\ccSetx64.sys --> C:\Windows\system32\drivers\NISx64\1306020.00A\ccSetx64.sys [?]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120411.001\IDSviA64.sys [2012-4-12 488568]
R1 SABI;SAMSUNG Kernel Driver For Windows 7;\??\C:\Windows\system32\Drivers\SABI.sys --> C:\Windows\system32\Drivers\SABI.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1306020.00A\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1306020.00A\Ironx64.SYS [?]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1306020.00A\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1306020.00A\SYMNETS.SYS [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-12 140672]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 GingerUpdateService;GingerUpdateService;C:\Program Files (x86)\Ginger\GingerUpdateService\GingerUpdateService.exe [2012-4-1 170824]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-4-12 654408]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\ccsvchst.exe [2012-3-29 138232]
R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-3-29 138360]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 Sftfs;Sftfs;C:\Windows\system32\DRIVERS\Sftfslh.sys --> C:\Windows\system32\DRIVERS\Sftfslh.sys [?]
R3 Sftplay;Sftplay;C:\Windows\system32\DRIVERS\Sftplaylh.sys --> C:\Windows\system32\DRIVERS\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;C:\Windows\system32\DRIVERS\Sftredirlh.sys --> C:\Windows\system32\DRIVERS\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;C:\Windows\system32\DRIVERS\Sftvollh.sys --> C:\Windows\system32\DRIVERS\Sftvollh.sys [?]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
R3 t_mouse.sys;iBall Advanced Mouse;C:\Windows\system32\DRIVERS\t_mouse.sys --> C:\Windows\system32\DRIVERS\t_mouse.sys [?]
R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-9 253600]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-1 183560]
S3 BTWAMPFL;BTWAMPFL;C:\Windows\system32\DRIVERS\btwampfl.sys --> C:\Windows\system32\DRIVERS\btwampfl.sys [?]
S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
S3 GemCCID;GemCCID;C:\Windows\system32\Drivers\GemCCID.sys --> C:\Windows\system32\Drivers\GemCCID.sys [?]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 Samsung UPD Service;Samsung UPD Service;"C:\Windows\System32\SUPDSvc.exe" --> C:\Windows\System32\SUPDSvc.exe [?]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
.
=============== Created Last 30 ================
.
2012-04-12 17:01:12 2301208 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2012-04-12 17:01:01 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2012-04-12 17:00:57 710992 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-04-12 15:00:46 -------- d-----w- C:\Users\Jock\AppData\Roaming\Traffic Travis v4
2012-04-12 15:00:00 -------- d-----w- C:\Users\Jock\AppData\Roaming\Affilorama
2012-04-12 14:36:33 -------- d-----w- C:\Users\Jock\AppData\Roaming\Malwarebytes
2012-04-12 14:36:02 -------- d-----w- C:\ProgramData\Malwarebytes
2012-04-12 14:36:01 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-04-12 14:36:00 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-04-12 13:57:06 -------- d-----w- C:\Users\Jock\AppData\Roaming\SUPERAntiSpyware.com
2012-04-12 13:56:28 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2012-04-12 13:56:28 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2012-04-12 13:51:28 -------- d-----w- C:\Users\Jock\AppData\Local\{247628A3-1CEC-485B-B3B8-BC426977BC15}
2012-04-11 22:11:00 -------- d-----w- C:\Users\Jock\AppData\Local\{B4B1B841-3A79-4868-BB3E-E073F7E88F15}
2012-04-11 10:40:03 8669240 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FFC04099-39BE-452C-9A03-35F47CA18D76}\mpengine.dll
2012-04-11 10:10:48 -------- d-----w- C:\Users\Jock\AppData\Local\{FE1F1695-41FC-4105-911C-05BBCFF0B43E}
2012-04-10 15:47:42 -------- d-----w- C:\Users\Jock\AppData\Local\{49742E2C-49AD-4334-8DA3-B4F462AA98DA}
2012-04-10 03:47:18 -------- d-----w- C:\Users\Jock\AppData\Local\{854DE2F1-3AFF-4431-9315-29B0877B600E}
2012-04-09 14:05:21 8767136 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe
2012-04-09 13:17:38 418464 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-04-09 13:00:47 -------- d-----w- C:\Users\Jock\AppData\Local\{CC85AAB4-39E4-445C-893C-DEB0AE69816A}
2012-04-08 23:49:24 -------- d-----w- C:\Users\Jock\AppData\Local\{D0C90D18-6CBA-48C0-BF73-8EB548302444}
2012-04-08 23:08:30 -------- d-----w- C:\Users\Jock\AppData\Roaming\EurekaLog
2012-04-08 17:25:17 -------- d-----w- C:\Users\Jock\AppData\Roaming\Article Marketing Robot
2012-04-08 17:25:17 -------- d-----w- C:\Program Files (x86)\Article Marketing Robot
2012-04-08 11:48:47 -------- d-----w- C:\Users\Jock\AppData\Local\{AEA6ABA7-483F-459C-89B4-7A2B2B223062}
2012-04-07 23:48:23 -------- d-----w- C:\Users\Jock\AppData\Local\{F7352335-0903-48F5-BDEF-F5EF3D543B0B}
2012-04-07 17:06:49 -------- d-----w- C:\Users\Jock\AppData\Local\Chromium
2012-04-07 16:12:19 -------- d-----w- C:\Program Files (x86)\SEGA
2012-04-07 16:10:56 -------- d-----w- C:\ProgramData\AVG Secure Search
2012-04-07 16:10:53 -------- d-----w- C:\Program Files (x86)\Common Files\AVG Secure Search
2012-04-07 16:10:53 -------- d-----w- C:\Program Files (x86)\AVG Secure Search
2012-04-07 16:10:47 125376 ----a-w- C:\Windows\System32\drivers\scdemu.sys
2012-04-07 16:10:46 -------- d-----w- C:\Program Files (x86)\PowerISO
2012-04-07 11:47:49 -------- d-----w- C:\Users\Jock\AppData\Local\{C05C9877-251B-48F6-9C9E-47FAA1C98705}
2012-04-07 00:48:44 -------- d-----w- C:\Users\Jock\AppData\Local\{F6C4ED37-B853-4808-A38C-50E5B0773293}
2012-04-06 18:12:59 68104 ----a-w- C:\Windows\System32\XAPOFX1_0.dll
2012-04-06 17:59:36 -------- d-----w- C:\Users\Jock\AppData\Local\SKIDROW
2012-04-06 17:59:32 -------- d-----w- C:\Users\Jock\AppData\Roaming\Sports Interactive
2012-04-06 17:59:32 -------- d-----w- C:\Users\Jock\AppData\Local\Sports Interactive
2012-04-06 12:47:49 -------- d-----w- C:\Users\Jock\AppData\Local\{593501EB-BA0D-40EF-A289-F9EE6C891E08}
2012-04-06 00:46:59 -------- d-----w- C:\Users\Jock\AppData\Local\{0268BB64-D011-4E0D-BA65-B7FF2F96C58A}
2012-04-05 12:46:36 -------- d-----w- C:\Users\Jock\AppData\Local\{C858D049-AA34-457D-9B97-6C9591D5049E}
2012-04-05 01:34:02 2301208 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-04-05 01:33:52 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-04-05 01:33:42 710992 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-04-05 00:24:54 -------- d-----w- C:\Users\Jock\AppData\Local\{3C3F1C8F-CED1-4DBE-BB24-32431C27666B}
2012-04-04 12:24:41 -------- d-----w- C:\Users\Jock\AppData\Local\{C45720AF-6DDB-4655-8FD0-A1E4207C3F4C}
2012-04-04 00:10:19 -------- d-----w- C:\Users\Jock\AppData\Local\{31D46827-A758-4D00-8446-8A8BCD65D20F}
2012-04-03 12:09:54 -------- d-----w- C:\Users\Jock\AppData\Local\{E033B796-ACC7-4EEE-8191-C639238CE42E}
2012-04-02 23:51:00 -------- d-----w- C:\ProgramData\Premium
2012-04-02 23:50:48 -------- d-----w- C:\ProgramData\Codecv
2012-04-02 23:50:41 -------- d-----w- C:\codec-info
2012-04-02 23:50:27 -------- d-----w- C:\ProgramData\InstallMate
2012-04-02 23:02:49 -------- d-----w- C:\Users\Jock\AppData\Local\{4D9A290F-1B75-446D-A2D7-C4A2D4ACC852}
2012-04-02 11:02:36 -------- d-----w- C:\Users\Jock\AppData\Local\{F6618C60-258C-4AEC-9887-D799BE47FCB8}
2012-04-01 22:51:30 -------- d-----w- C:\Users\Jock\AppData\Local\{2F5BDC24-2F96-499E-976F-1FAF9284B151}
2012-04-01 10:51:18 -------- d-----w- C:\Users\Jock\AppData\Local\{76278707-0B3D-424C-94DA-32EBD487CB01}
2012-03-31 14:58:33 -------- d-----w- C:\Users\Jock\AppData\Local\{482FCEFB-BD75-4CD2-99F0-75B170149D40}
2012-03-31 02:57:58 -------- d-----w- C:\Users\Jock\AppData\Local\{7624AE1D-0A76-45C9-A229-2EEB3E88C5E5}
2012-03-30 17:55:35 -------- d-----w- C:\Users\Jock\AppData\Local\CyberLink
2012-03-30 14:57:35 -------- d-----w- C:\Users\Jock\AppData\Local\{0551DB28-5627-41A0-A208-D5CAF452287B}
2012-03-30 02:57:10 -------- d-----w- C:\Users\Jock\AppData\Local\{9BB52DC1-1AA2-497C-936B-B6C7D6D6DC5F}
2012-03-29 12:50:47 405624 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\symnets.sys
2012-03-29 12:50:47 1092728 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\symefa64.sys
2012-03-29 12:50:46 738936 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\srtsp64.sys
2012-03-29 12:50:46 451192 ----a-r- C:\Windows\System32\drivers\NISx64\1306020.00A\symds64.sys
2012-03-29 12:50:46 37496 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\srtspx64.sys
2012-03-29 12:50:46 190072 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\ironx64.sys
2012-03-29 12:50:46 167048 ----a-w- C:\Windows\System32\drivers\NISx64\1306020.00A\ccsetx64.sys
2012-03-29 12:50:18 -------- d-----w- C:\Windows\System32\drivers\NISx64\1306020.00A
2012-03-29 12:27:04 -------- d-----w- C:\Users\Jock\AppData\Local\{6881A53E-1B5A-448A-A0C4-A86C358D9D2D}
2012-03-29 01:35:52 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2012-03-29 01:10:27 175736 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2012-03-29 01:09:48 -------- d-----w- C:\Program Files (x86)\Norton Internet Security
2012-03-29 01:09:47 -------- d-----w- C:\ProgramData\Norton
2012-03-29 01:07:53 -------- d-----w- C:\ProgramData\NortonInstaller
2012-03-29 01:07:53 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2012-03-29 00:56:39 -------- d-----w- C:\Program Files\Symantec
2012-03-29 00:56:39 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2012-03-29 00:55:52 -------- d-----w- C:\Windows\System32\drivers\NISx64
2012-03-28 21:54:49 -------- d-----w- C:\Users\Jock\AppData\Local\{E4A78821-BF38-4983-A104-1277E206F610}
2012-03-28 21:54:26 -------- d-----w- C:\Users\Jock\AppData\Local\{A2EC3730-6DB6-49E6-B367-6EFFD8D6761A}
2012-03-28 09:53:11 -------- d-----w- C:\Users\Jock\AppData\Local\{AE6B374D-9E0F-4F69-A0A3-FE0FC1DDB4BD}
2012-03-28 09:52:46 -------- d-----w- C:\Users\Jock\AppData\Local\{03B58C70-79FF-4197-8E8C-CBCC93784241}
2012-03-27 21:51:25 -------- d-----w- C:\Users\Jock\AppData\Local\{DE1F6E92-5BBD-4673-AEF1-93D3A762B5D5}
2012-03-27 21:51:04 -------- d-----w- C:\Users\Jock\AppData\Local\{790E7FA3-BC30-4F58-AA52-9D73A20494ED}
2012-03-27 09:49:37 -------- d-----w- C:\Users\Jock\AppData\Local\{F2816DC8-3AD9-4E20-AA24-9326CDB7F3A8}
2012-03-27 09:49:15 -------- d-----w- C:\Users\Jock\AppData\Local\{D0B3CAC2-B49D-4C39-88B3-09C3AF73D909}
2012-03-26 21:47:38 -------- d-----w- C:\Users\Jock\AppData\Local\{C217CB0F-6CE7-4227-993A-064B47575FC1}
2012-03-26 21:47:16 -------- d-----w- C:\Users\Jock\AppData\Local\{196F655D-190B-41CA-A28F-1CD886A3539A}
2012-03-26 09:45:20 -------- d-----w- C:\Users\Jock\AppData\Local\{4B7D1DF0-A661-411F-891C-CA108CC1D9AA}
2012-03-26 09:44:56 -------- d-----w- C:\Users\Jock\AppData\Local\{CA4B4FE5-6AC5-490E-9013-DDFE0282BBA5}
2012-03-25 14:23:32 -------- d-----w- C:\Users\Jock\AppData\Local\{0CF09E8A-5F77-49BB-ADF1-17738879DB76}
2012-03-25 14:23:09 -------- d-----w- C:\Users\Jock\AppData\Local\{9853A715-EF5E-4D8C-BD68-2068B26D85DD}
2012-03-25 02:21:40 -------- d-----w- C:\Users\Jock\AppData\Local\{C55C0CD0-39F1-47E3-8DE6-0C4139E02034}
2012-03-25 02:21:19 -------- d-----w- C:\Users\Jock\AppData\Local\{9CEF8275-E8C7-4C89-9BD9-F3AFEFF41F4A}
2012-03-24 14:19:56 -------- d-----w- C:\Users\Jock\AppData\Local\{B07CA83D-DFB3-48F3-B210-1AD9A589FF68}
2012-03-24 14:19:34 -------- d-----w- C:\Users\Jock\AppData\Local\{1C724F6F-89DF-430A-AD18-89D51CB720D8}
2012-03-24 02:17:59 -------- d-----w- C:\Users\Jock\AppData\Local\{86615EE5-FFDE-4684-87CF-2C05AD126304}
2012-03-24 02:17:36 -------- d-----w- C:\Users\Jock\AppData\Local\{6974546E-B903-461D-9A5E-2940D7296A3A}
2012-03-23 14:15:20 -------- d-----w- C:\Users\Jock\AppData\Local\{47FE49ED-B7AB-4212-8BB9-26A46B1747AD}
2012-03-23 14:15:04 -------- d-----w- C:\Users\Jock\AppData\Local\{54DDD240-0DD4-459D-B6D6-190BBB546E93}
2012-03-22 18:19:56 -------- d-----w- C:\Users\Jock\AppData\Roaming\Acapela Group
2012-03-22 18:03:51 -------- d-----w- C:\Program Files (x86)\Ginger
2012-03-22 15:30:35 -------- d-----w- C:\Users\Jock\AppData\Local\{D8DDF2E4-F98A-4BB2-9BDC-5C3586C9971E}
2012-03-22 15:30:13 -------- d-----w- C:\Users\Jock\AppData\Local\{98CD3489-BD07-4B81-B4E6-D1827D5F8B3F}
2012-03-22 03:28:56 -------- d-----w- C:\Users\Jock\AppData\Local\{D08A75CA-197C-4894-B6B8-6D62ABAE919B}
2012-03-22 03:28:34 -------- d-----w- C:\Users\Jock\AppData\Local\{1650E38B-EF6B-46D2-9652-9AC77A63F1DA}
2012-03-21 15:27:08 -------- d-----w- C:\Users\Jock\AppData\Local\{81E0C6B2-15AE-4420-B7AF-EFEDC96AF3B1}
2012-03-21 15:26:55 -------- d-----w- C:\Users\Jock\AppData\Local\{567E86B1-A0C9-44E6-B76E-A6D35B30C1B9}
2012-03-21 01:18:29 -------- d-----w- C:\Users\Jock\AppData\Local\{7494122C-5DC3-4B51-965B-773F095540C3}
2012-03-21 01:18:07 -------- d-----w- C:\Users\Jock\AppData\Local\{906FE2B5-98BB-4AF5-A825-1126687DD7DB}
2012-03-20 13:16:48 -------- d-----w- C:\Users\Jock\AppData\Local\{444039A5-49CF-44E5-909A-76ED62C4843C}
2012-03-20 13:16:25 -------- d-----w- C:\Users\Jock\AppData\Local\{E296B18B-AE9C-400D-8944-03792616561A}
2012-03-20 01:16:58 -------- d-----w- C:\Users\Jock\AppData\Local\Facebook
2012-03-20 01:14:45 -------- d-----w- C:\Users\Jock\AppData\Local\{33BD446C-60F8-4567-8A4A-F6FDE7EB0486}
2012-03-19 13:11:57 -------- d-----w- C:\Users\Jock\AppData\Local\{153BDFC1-52A1-4CA5-8EBA-D5CF1794CD88}
2012-03-19 13:11:44 -------- d-----w- C:\Users\Jock\AppData\Local\{4CB171EA-1FF5-48BF-B1B1-CB911A1C4AAB}
2012-03-18 15:23:25 -------- d-----w- C:\Users\Jock\AppData\Local\{92D319EE-1664-4F5D-9C7A-B8A31D96BBA0}
2012-03-18 15:23:03 -------- d-----w- C:\Users\Jock\AppData\Local\{0DCF42F7-539D-41DB-981B-0DA38DD02B2E}
2012-03-18 03:21:25 -------- d-----w- C:\Users\Jock\AppData\Local\{67013C29-5AF5-4ACE-A631-50D9A9598A9C}
2012-03-18 03:21:03 -------- d-----w- C:\Users\Jock\AppData\Local\{905487BB-5B17-46F9-B1D7-FD0D93A887FF}
2012-03-17 23:08:37 592824 ----a-w- C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-17 23:08:37 44472 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
2012-03-17 15:19:32 -------- d-----w- C:\Users\Jock\AppData\Local\{77969797-7CB7-45A2-87A5-86932B03F1C6}
2012-03-17 15:19:10 -------- d-----w- C:\Users\Jock\AppData\Local\{20655B00-33F0-428E-832F-E6A8A8F1B5D6}
2012-03-17 03:17:36 -------- d-----w- C:\Users\Jock\AppData\Local\{B1E3BCD7-9EA5-4871-A1D3-A690135B8F83}
2012-03-17 03:17:13 -------- d-----w- C:\Users\Jock\AppData\Local\{BFE246B9-74A1-4C9A-B536-9B64F8F73587}
2012-03-16 15:15:31 -------- d-----w- C:\Users\Jock\AppData\Local\{385FEC50-ED20-462F-A82D-3CF4BA0EE183}
2012-03-16 15:15:19 -------- d-----w- C:\Users\Jock\AppData\Local\{F344A2F5-672D-4DC3-86C2-58A21095B79A}
2012-03-15 15:22:52 -------- d-----w- C:\Users\Jock\AppData\Local\{0E2599A6-163D-44E6-9D09-E878129D52F8}
2012-03-15 15:22:30 -------- d-----w- C:\Users\Jock\AppData\Local\{6363F251-D9FE-4294-9EF3-FE7541C1DA5E}
2012-03-15 03:19:44 -------- d-----w- C:\Users\Jock\AppData\Local\{9D3E51E4-4A06-40B6-A673-D640572A80D2}
2012-03-15 03:19:22 -------- d-----w- C:\Users\Jock\AppData\Local\{A27A705B-E0FC-4FBA-B9A7-097625A08D95}
2012-03-15 03:06:00 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-15 03:05:58 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-15 03:05:57 3913584 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-03-14 15:17:50 -------- d-----w- C:\Users\Jock\AppData\Local\{30316F29-BA57-439C-9BA0-69D56307FA32}
2012-03-14 15:17:28 -------- d-----w- C:\Users\Jock\AppData\Local\{4833F87B-A95C-4D94-B2B4-0B86C3F75704}
2012-03-14 14:23:00 3145728 ----a-w- C:\Windows\System32\win32k.sys
2012-03-14 14:22:59 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-03-14 14:22:59 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-03-14 14:22:33 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-03-14 14:22:33 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-03-14 14:22:33 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-03-14 14:22:33 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-03-14 14:22:32 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-03-14 14:22:32 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-03-14 14:22:32 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-03-14 03:15:44 -------- d-----w- C:\Users\Jock\AppData\Local\{9D82D5B1-19CE-4D68-8F67-6797DF0832E8}
2012-03-14 03:15:32 -------- d-----w- C:\Users\Jock\AppData\Local\{8E40490D-CA9E-4C86-956B-04E909ED11A2}
.
==================== Find3M ====================
.
2012-04-09 14:05:44 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-23 09:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe
.
============= FINISH: 19:59:55.86 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 30/10/2011 00:15:57
System Uptime: 12/04/2012 17:52:06 (2 hours ago)
.
Motherboard: SAMSUNG ELECTRONICS CO., LTD. | | RV420/RV520/RV720/E3530/S3530/E3420/E3520
Processor: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz | CPU | 1890/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 230 GiB total, 96.613 GiB free.
D: is FIXED (NTFS) - 343 GiB total, 309.211 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Description: Broadcom BCM2070 Bluetooth 3.0 +HS USB Device
Device ID: USB\VID_0A5C&PID_219C\B4749FD62129
Manufacturer: Broadcom
Name: Broadcom BCM2070 Bluetooth 3.0 +HS USB Device
PNP Device ID: USB\VID_0A5C&PID_219C\B4749FD62129
Service: BTHUSB
.
==== System Restore Points ===================
.
RP106: 03/04/2012 13:06:29 - Installed Ginger
RP107: 06/04/2012 19:11:34 - Installed DirectX
RP108: 07/04/2012 17:46:18 - Installed DirectX
RP109: 08/04/2012 18:24:28 - Installed Article Marketing Robot
RP110: 08/04/2012 19:00:17 - Windows Backup
RP111: 11/04/2012 11:39:35 - Windows Update
.
==== Installed Programs ======================
.
?? ??? ?? Windows Live Mesh ActiveX ???
??? ActiveX ?? Windows Live Mesh ???? ??????? ???????
???? ??? Windows Live
???? ???? ActiveX ????? ?? Windows Live Mesh ????????? ???????
???? Windows Live
????? Windows Live
?????? ??????? ?? Windows Live
??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ???????????
??????? Windows Live Mesh ActiveX ??(????)
??????? Windows Live Mesh ActiveX ???
???????? ?????????? Windows Live
????????? ActiveX ?? Windows Live Mesh ????????????????????????? (???)
?????????? Windows Live
??????????? ?? Windows Live
ActiveX-kontroll för fjärranslutningar för Windows Live Mesh
ActiveX ???????? ?? Windows Live Mesh ?? ?????????? ??????
Adobe AIR
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Community Help
Adobe Dreamweaver CS5.5
Adobe Flash Professional CS5.5
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 9.1
Adobe Stock Photos 1.0
Adobe Widget Browser
Agatha Christie - Death on the Nile
AIM 7
Apple Application Support
Apple Software Update
Article Marketing Robot
Atheros Client Installation Program
µTorrent
AVG Security Toolbar
„Windows Live Essentials“
„Windows Live Mail“
„Windows Live Mesh ActiveX“ nuotoliniu ryšiu valdiklis
„Windows Live Messenger“
„Windows Live“ fotogalerija
BatteryLifeExtender
Bejeweled 2 Deluxe
Big Fish Games: Game Manager
Bing Bar
Build-a-lot
Chuzzle Deluxe
Codecv
Contrôle ActiveX Windows Live Mesh pour connexions à distance
Control ActiveX de Windows Live Mesh para conexiones remotas
Control ActiveX Windows Live Mesh pentru conexiuni la distan?a
Controle ActiveX do Windows Live Mesh para Conexões Remotas
Controlo ActiveX do Windows Live Mesh para Ligações Remotas
CyberLink BD_3D Advisor 2.0
CyberLink Media Suite
CyberLink Media+ Player10
CyberLink MediaShow
CyberLink Power2Go
CyberLink PowerDirector
CyberLink YouCam
D3DX10
Diner Dash 2 Restaurant Rescue
Directory Submitter Full
Download Updater (AOL LLC)
Easy Content Share
Easy Display Manager
Easy Migration
Easy Network Manager
Easy SpeedUp Manager
EasyBatteryManager
EasyFileShare
EasyRotator Wizard
Facebook Video Calling 1.2.0.159
Farm Frenzy
Fast Start
FileZilla Client 3.5.1
Football Manager 2012
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsluge polaczen zdalnych
Fotogalerija Windows Live
Galeria de Fotografias do Windows Live
Galeria fotografii uslugi Windows Live
Galerie de photos Windows Live
Galerie foto Windows Live
Galería fotográfica de Windows Live
Ginger
Google Talk (remove only)
Hotdog Hotshot
Insaniquarium Deluxe
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
iSnooker
John Deere Drive Green
Junk Mail filter update
Kontrola Windows Live Mesh ActiveX za daljinske veze
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave
Malwarebytes Anti-Malware version 1.61.0.1400
Mesh Runtime
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Movie Color Enhancer
Mozilla Firefox 11.0 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Norton Internet Security
Norton Online Backup
Notepad++
Opera 11.52
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia
PDF Settings CS5
Peggle
Penguins!
PhoneShare
Plants vs. Zombies
Poczta uslugi Windows Live
Podstawowe programy Windows Live
Polar Golfer
Pošta Windows Live
PowerISO
Raccolta foto di Windows Live
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
S?????? f?t???af??? t?? Windows Live
Samsung AnyWeb Print
Samsung Printer Live Update
Samsung Recovery Solution 5
Samsung Support Center 1.0
Samsung Universal Print Driver
Samsung Universal Scan Driver
Samsung Update Plus
SamsungMovie
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
SISShortcut
Skype™ 4.2
St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se??
Traffic Travis 4.1.0
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
User Guide
uTorrentBar Toolbar
Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi
VLC
VLC media player 1.1.5
WildTangent Games
WildTangent ORB Game Console
Windows Live
Windows Live ??
Windows Live ?? ???
Windows Live ???
Windows Live ????
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotótár
Windows Live Foto-galerija
Windows Live fotoattelu galerija
Windows Live Fotogalerie
Windows Live Fotogalleri
Windows Live Fotogaléria
Windows Live Fotograf Galerisi
Windows Live Galeria de Fotos
Windows Live Galerija fotografija
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger
Windows Live Mesh ActiveX-objekt til fjernforbindelser
Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz
Windows Live Mesh ActiveX control for remote connections
Windows Live Mesh ActiveX kontrola za daljinske veze
Windows Live Mesh ActiveX vadikla attalajiem savienojumiem
Windows Live Meshin etäyhteyksien ActiveX-komponentti
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Pošta
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Temel Parçalar
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Liven asennustyökalu
Windows Liven sähköposti
Windows Liven valokuvavalikoima
WordCaptureX Pro
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
12/04/2012 17:52:50, Error: BTHUSB [17] - The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
12/04/2012 00:02:29, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR4.
11/04/2012 18:54:57, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR3.
11/04/2012 12:20:47, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
08/04/2012 01:36:48, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
.
==== End Of File ===========================

is what i have posted enough or do you need it all?

No, that's good.

Download Combofix from any of the links below, and save it to your DESKTOP.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

ComboFix 12-04-13.01 - Jock 13/04/2012 17:54:57.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4010.1596 [GMT 1:00]
Running from: c:\users\Jock\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Exp.Clean
.
.
((((((((((((((((((((((((( Files Created from 2012-03-13 to 2012-04-13 )))))))))))))))))))))))))))))))
.
.
2012-04-13 17:04 . 2012-04-13 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-04-13 11:35 . 2012-04-13 11:35 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F49C7A73-3544-43BC-B2FC-6D302CF7C1E0}\offreg.dll
2012-04-13 11:12 . 2012-04-13 11:12 -------- d-----w- c:\windows\en
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\ar
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\bg
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\cs
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\da
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\de
2012-04-13 11:09 . 2012-04-13 11:09 -------- d-----w- c:\windows\el
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\es
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\fi
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\fr
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\he
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\hr
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\hu
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\it
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\ko
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\lt
2012-04-13 11:08 . 2012-04-13 11:08 -------- d-----w- c:\windows\lv
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\nl
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\no
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\pl
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\pt-br
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\pt-pt
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\ro
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\ru
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\sk
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\sl
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\sr-latn-cs
2012-04-13 11:07 . 2012-04-13 11:07 -------- d-----w- c:\windows\sv
2012-04-13 11:06 . 2012-04-13 11:06 -------- d-----w- c:\windows\th
2012-04-13 11:06 . 2012-04-13 11:06 -------- d-----w- c:\windows\tr
2012-04-13 11:06 . 2012-04-13 11:06 -------- d-----w- c:\windows\zh-cn
2012-04-13 11:06 . 2012-04-13 11:06 -------- d-----w- c:\windows\zh-tw
2012-04-13 10:45 . 2012-04-13 10:45 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7fa794951cd196201\DSETUP.dll
2012-04-13 10:45 . 2012-04-13 10:45 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7fa794951cd196201\DXSETUP.exe
2012-04-13 10:45 . 2012-04-13 10:45 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7fa794951cd196201\dsetup32.dll
2012-04-13 10:45 . 2012-04-13 10:45 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7fff52ce1cd196202\MeshBetaRemover.exe
2012-04-13 10:43 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F49C7A73-3544-43BC-B2FC-6D302CF7C1E0}\mpengine.dll
2012-04-13 02:00 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-13 02:00 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-13 02:00 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-04-13 02:00 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-04-13 02:00 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-13 02:00 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-04-13 02:00 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-04-12 17:01 . 2012-04-12 17:01 2301208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2012-04-12 17:01 . 2012-04-12 17:01 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2012-04-12 17:00 . 2012-04-12 17:00 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-04-12 15:00 . 2012-04-12 15:45 -------- d-----w- c:\users\Jock\AppData\Roaming\Traffic Travis v4
2012-04-12 15:00 . 2012-04-12 15:00 -------- d-----w- c:\users\Jock\AppData\Roaming\Affilorama
2012-04-12 14:36 . 2012-04-12 14:36 -------- d-----w- c:\users\Jock\AppData\Roaming\Malwarebytes
2012-04-12 14:36 . 2012-04-12 14:36 -------- d-----w- c:\programdata\Malwarebytes
2012-04-12 14:36 . 2012-04-04 14:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-12 14:36 . 2012-04-12 14:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-12 13:57 . 2012-04-12 13:57 -------- d-----w- c:\users\Jock\AppData\Roaming\SUPERAntiSpyware.com
2012-04-12 13:56 . 2012-04-12 13:57 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-04-12 13:56 . 2012-04-12 13:56 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-04-09 14:05 . 2012-04-09 14:05 8767136 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-09 13:17 . 2012-04-09 14:05 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-08 23:08 . 2012-04-08 23:08 -------- d-----w- c:\users\Jock\AppData\Roaming\EurekaLog
2012-04-08 17:25 . 2012-04-08 17:43 -------- d-----w- c:\users\Jock\AppData\Roaming\Article Marketing Robot
2012-04-08 17:25 . 2012-04-08 17:25 -------- d-----w- c:\program files (x86)\Article Marketing Robot
2012-04-07 20:53 . 2012-04-07 20:53 -------- d-----w- c:\program files\Microsoft Silverlight
2012-04-07 20:53 . 2012-04-07 20:53 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2012-04-07 17:06 . 2012-04-07 17:06 -------- d-----w- c:\users\Jock\AppData\Local\Chromium
2012-04-07 16:12 . 2012-04-07 16:12 -------- d-----w- c:\program files (x86)\SEGA
2012-04-07 16:10 . 2012-04-07 16:13 -------- d-----w- c:\programdata\AVG Secure Search
2012-04-07 16:10 . 2012-04-09 16:57 -------- d-----w- c:\program files (x86)\AVG Secure Search
2012-04-07 16:10 . 2012-04-07 16:10 -------- d-----w- c:\program files (x86)\Common Files\AVG Secure Search
2012-04-07 16:10 . 2012-02-09 06:06 125376 ----a-w- c:\windows\system32\drivers\scdemu.sys
2012-04-07 16:10 . 2012-04-07 16:11 -------- d-----w- c:\program files (x86)\PowerISO
2012-04-06 18:12 . 2008-05-30 13:19 511496 ----a-w- c:\windows\system32\XAudio2_1.dll
2012-04-06 17:59 . 2012-04-06 22:02 -------- d-----w- c:\users\Jock\AppData\Local\SKIDROW
2012-04-06 17:59 . 2012-04-06 17:59 -------- d-----w- c:\users\Jock\AppData\Roaming\Sports Interactive
2012-04-06 17:59 . 2012-04-06 17:59 -------- d-----w- c:\users\Jock\AppData\Local\Sports Interactive
2012-04-05 01:34 . 2012-04-05 01:34 2301208 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-04-05 01:33 . 2012-04-05 01:33 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-04-05 01:33 . 2012-04-05 01:33 710992 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-04-02 23:51 . 2012-04-02 23:51 -------- d-----w- c:\programdata\Premium
2012-04-02 23:50 . 2012-04-08 21:46 -------- d-----w- c:\programdata\Codecv
2012-04-02 23:50 . 2012-04-02 23:50 -------- d-----w- C:\codec-info
2012-04-02 23:50 . 2012-04-02 23:51 -------- d-----w- c:\programdata\InstallMate
2012-03-30 17:55 . 2012-03-30 17:55 -------- d-----w- c:\users\Jock\AppData\Local\CyberLink
2012-03-29 01:35 . 2012-03-29 01:35 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-03-29 01:10 . 2012-03-29 12:50 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-03-29 01:09 . 2012-03-29 01:09 -------- d-----w- c:\program files (x86)\Norton Internet Security
2012-03-29 01:09 . 2012-03-29 01:15 -------- d-----w- c:\programdata\Norton
2012-03-29 01:07 . 2012-03-29 01:07 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-03-29 00:56 . 2012-03-29 12:51 -------- d-----w- c:\program files\Symantec
2012-03-29 00:56 . 2012-03-29 01:10 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-03-29 00:55 . 2012-03-30 12:09 -------- d-----w- c:\windows\system32\drivers\NISx64
2012-03-22 18:19 . 2012-03-22 18:19 -------- d-----w- c:\users\Jock\AppData\Roaming\Acapela Group
2012-03-22 18:03 . 2012-04-03 12:07 -------- d-----w- c:\program files (x86)\Ginger
2012-03-20 01:16 . 2012-03-20 01:17 -------- d-----w- c:\users\Jock\AppData\Local\Facebook
2012-03-19 22:56 . 2012-04-09 15:01 -------- d-----w- c:\users\Jock\AppData\Roaming\skypePM
2012-03-19 22:55 . 2012-04-13 14:43 -------- d-----w- c:\users\Jock\AppData\Roaming\Skype
2012-03-17 23:08 . 2012-03-17 23:08 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-17 23:08 . 2012-03-17 23:08 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-09 14:05 . 2011-10-30 18:08 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-08 17:50 . 2012-03-08 17:50 49016 ----a-w- c:\windows\SysWow64\sirenacm.dll
2012-03-08 17:37 . 2012-03-08 17:37 302448 ----a-w- c:\windows\WLXPGSS.SCR
2012-02-23 09:18 . 2011-10-29 16:34 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 14:22 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 14:22 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 14:22 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 14:22 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-10 06:36 . 2012-03-14 14:22 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 14:22 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-02-03 04:34 . 2012-03-14 14:23 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-01-25 06:38 . 2012-03-14 14:22 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-01-25 06:38 . 2012-03-14 14:22 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-01-25 06:33 . 2012-03-14 14:22 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-01-16 05:20 . 2012-01-16 05:20 126976 ----a-r- c:\users\Jock\AppData\Roaming\Microsoft\Installer\{00D6FA20-0E53-4ACA-A96F-44A312E59C3C}\DirectorySubmitter.e_B8C79C46F59349DBBAB4C18CF1C5AF0D.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-04-09 16:57 1869152 ----a-w- c:\program files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{BBC95637-AC5D-4C51-965E-82D984447F2E}]
2012-04-01 08:29 140800 ----a-w- c:\programdata\Codecv\bhoclass.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\uTorrentBar\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTor.dll" [2011-05-09 176936]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll" [2012-04-09 1869152]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim"="c:\program files (x86)\AIM\aim.exe" [2012-02-29 4321112]
"googletalk"="c:\users\Jock\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"EnhanceViews_AutoWatched_Program_By_Carbon0x"="c:\users\Jock\Desktop\Enhanceviews Autowatcher v1.93(3).exe" [2012-02-28 656896]
"Facebook Update"="c:\users\Jock\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-03-20 137536]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl10"="c:\program files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe" [2010-09-20 87336]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-04-09 982880]
"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2012-02-09 312376]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\users\Jock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
Ginger.lnk - c:\windows\Installer\{1A10532B-CC99-415C-A51F-B8418DE7A395}\NewShortcut1_07A8F5336D4F4AA6858FD2E3E66AF10F.exe [2012-4-3 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 253600]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [x]
R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1306020.00A\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1306020.00A\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120402.001\BHDrvx64.sys [2012-04-02 1160824]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1306020.00A\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120412.001\IDSvia64.sys [2012-03-28 488568]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1306020.00A\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1306020.00A\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 GingerUpdateService;GingerUpdateService;c:\program files (x86)\Ginger\GingerUpdateService\GingerUpdateService.exe [2012-04-01 170824]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe [2012-01-17 138232]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S2 vToolbarUpdater10.2.0;vToolbarUpdater10.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe [2012-04-09 918880]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-03-29 138360]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 t_mouse.sys;iBall Advanced Mouse;c:\windows\system32\DRIVERS\t_mouse.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 14:05]
.
2012-04-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1682194932-64252910-1022618409-1001Core.job
- c:\users\Jock\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-20 01:16]
.
2012-04-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1682194932-64252910-1022618409-1001UA.job
- c:\users\Jock\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-20 01:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-27 11780712]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-09-05 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-09-05 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-09-05 416024]
"MouseDriver"="TiltWheelMouse.exe" [2010-11-01 241152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://isearch.avg.com/?cid={48AEED14-1377-413A-A2AF-5014F8DA6763}&mid=1d15d0654f9d47d1ba16653dd932c8da-055f4bebbaaa84848773987d26365bcb1bd81593&lang=en&ds=st011&pr=sa&d=2012-04-07 17:10&v=10.0.0.7&sap=hp
mStart Page = hxxp://samsung.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{328ECD19-C167-40eb-A0C7-16FE7634105E} - {94BB0C4C-B957-479A-85E4-42F53B89F681} - c:\program files\Samsung AnyWeb Print\W2PBrowser.dll
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll
DPF: {0920DBB1-D098-4ACE-9DDD-7A6F18A9ED66} - hxxps://britishgastopup.paypoint.com/HomeVend.cab
DPF: {283B7DE7-A1ED-4D27-AA59-C6E7427544D2} - hxxps://bg.itronenergypoint.net/IHVConnect/KeyBoxControl.cab
FF - ProfilePath - c:\users\Jock\AppData\Roaming\Mozilla\Firefox\Profiles\k7xmnb30.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2260173&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.6.2.10\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-04-13 18:06:41
ComboFix-quarantined-files.txt 2012-04-13 17:06
.
Pre-Run: 111,893,086,208 bytes free
Post-Run: 112,236,269,568 bytes free
.
- - End Of File - - 24BEAE25FE0B1052001D38CC7E95EA10

Please download Rooter and Save it to your desktop.

• Double click it to start the tool.Vista and Windows7 run as administrator.
  
• Click Scan.
  
• Eventually, a Notepad file containing the report will open, also found at C:\Rooter.txt. Post that log in your next reply.
  

Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully ...
.
Windows 7 Home Edition (6.1.7601) Service Pack 1
[32_bits] - Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[MpsSvc] RUNNING (state:4)
Windows Firewall -> Enabled
Windows Defender -> Enabled
User Account Control (UAC) -> Enabled
.
Internet Explorer 9.0.8112.16421
Mozilla Firefox 11.0 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:229 Go - Free:99 Go )
D:\ [Fixed-NTFS] .. ( Total:343 Go - Free:309 Go )
E:\ [CD_Rom]
F:\ [CD_Rom]
Q:\ [Fixed-NTFS] .. ( Total:0 Go - Free:0 Go )
.
Scan : 19:23.20
Path : C:\Users\Jock\Downloads\Rooter.exe
User : Jock ( Administrator -> YES )
.
----------------------\\ Processes
.
Locked [System Process] (0)
Locked System (4)
______ ?????????? (440)
______ ?????????? (568)
______ ?????????? (656)
______ ?????????? (680)
______ ?????????? (712)
______ ?????????? (736)
______ ?????????? (744)
______ ?????????? (828)
______ ?????????? (900)
______ ?????????? (976)
______ ?????????? (480)
______ ?????????? (612)
______ ?????????? (740)
______ ?????????? (1084)
______ ?????????? (1252)
______ ?????????? (1428)
______ ?????????? (1436)
______ ?????????? (1556)
______ ?????????? (1592)
______ ?????????? (1628)
______ ?????????? (1720)
______ C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1740)
______ ?????????? (1776)
______ ?????????? (1808)
______ C:\Program Files (x86)\Ginger\GingerUpdateService\GingerUpdateService.exe (1848)
______ C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe (1944)
______ C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (2012)
______ C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (1028)
______ C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (2216)
______ C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe (2312)
______ ?????????? (2348)
______ ?????????? (2372)
______ C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (2604)
______ ?????????? (2792)
______ C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (3064)
______ ?????????? (2424)
______ ?????????? (2364)
______ ?????????? (3248)
______ C:\Program Files (x86)\Norton Internet Security\Engine\19.6.2.10\ccSvcHst.exe (3284)
______ ?????????? (3344)
______ ?????????? (3448)
______ ?????????? (3596)
______ ?????????? (3644)
______ ?????????? (3656)
______ ?????????? (3804)
______ ?????????? (3868)
______ ?????????? (3892)
______ C:\Windows\System32\TiltWheelMouse.exe (3900)
______ ?????????? (3192)
______ C:\Program Files (x86)\AIM\aim.exe (3180)
______ C:\Users\Jock\AppData\Roaming\Google\Google Talk\googletalk.exe (3396)
______ ?????????? (596)
______ ?????????? (4104)
______ ?????????? (4636)
______ C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (4668)
______ C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (4884)
______ ?????????? (5004)
______ C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe (5048)
______ C:\Program Files (x86)\Ginger\GingerClient.exe (5088)
______ C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (3228)
______ ?????????? (4152)
______ ?????????? (4276)
______ ?????????? (3916)
______ C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (3164)
______ C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (4300)
______ ?????????? (4016)
______ C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe (3624)
______ C:\Program Files (x86)\iTunes\iTunesHelper.exe (4552)
______ C:\Program Files (x86)\AVG Secure Search\vprot.exe (2132)
______ C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (4736)
______ C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (5144)
______ ?????????? (5152)
______ C:\Windows\SysWOW64\RunDll32.exe (5832)
______ ?????????? (5968)
______ C:\Program Files (x86)\Ginger\GingerServices\GingerServices.exe (2136)
______ C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (1796)
______ ?????????? (2152)
______ C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (5180)
______ ?????????? (4732)
______ C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe (6224)
______ ?????????? (6264)
______ ?????????? (6508)
______ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (6796)
______ C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (6820)
______ ?????????? (6848)
______ ?????????? (7012)
______ C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe (5952)
______ C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (5684)
______ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (6304)
______ C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe (5520)
______ ?????????? (3484)
______ ?????????? (6068)
______ C:\Program Files (x86)\Mozilla Firefox\firefox.exe (4828)
______ C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (2396)
______ C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe (1108)
______ C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe (8024)
______ ?????????? (7384)
______ C:\Program Files (x86)\Internet Explorer\IELowutil.exe (7960)
______ C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe (6912)
______ C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe (7728)
______ C:\Program Files (x86)\SEGA\Football Manager 2012\fm.exe (8080)
______ ?????????? (8512)
______ ?????????? (1192)
______ ?????????? (5760)
Locked audiodg.exe (8996)
______ C:\Users\Jock\Downloads\Rooter.exe (2952)
.
----------------------\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:1048576 | Length:104857600)
\Device\Harddisk0\Partition2 (Start_Offset:105906176 | Length:246960619520)
\Device\Harddisk0\Partition0 (Start_Offset:247066525696 | Length:368436051968)
\Device\Harddisk0\Partition3 (Start_Offset:615502577664 | Length:24626855936)
\Device\Harddisk0\Partition4 (Start_Offset:247067574272 | Length:368435003392)
.
----------------------\\ Scheduled Tasks
.
C:\Windows\Tasks\Adobe Flash Player Updater.job
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1682194932-64252910-1022618409-1001Core.job
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1682194932-64252910-1022618409-1001UA.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
.
----------------------\\ Registry
.
.
----------------------\\ Files & Folders
.
----------------------\\ Scan completed at 19:24.22
.
C:\Rooter$\Rooter_1.txt - (14/04/2012 | 19:24.22)