Text only | Text with Images

LandzDown Forum

Security => Analysis and Malware Removal => Topic started by: mare_wbpa on December 04, 2013, 05:46:59 PM

Title: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 04, 2013, 05:46:59 PM
Hi team.  Some of you may remember me, you helped me a few months ago with my Compaq desktop. I was having trouble installing the SP3, among other issues. Ravencajun referred me to Lzd. I'm back with problems I'm having with my Compaq Presario laptop CQ60, AMD Athlon processor, 2 GB ram, 280HD 136 GB free, using Firefox.  I did a MWB scan yesterday, updating MWB b4 the scan, it detected 10 objects, which I deleted.  Today I seem to be getting more popups than before the scan.  The laptop is also slow and has been freezing up.  Bellow is the log of the scan.  I'd appreciate any help you can offer.





Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.12.04.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
mary ann :: MARYANN-PC [administrator]

12/3/2013 8:09:39 PM
mbam-log-2013-12-03 (20-09-39).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 448647
Time elapsed: 3 hour(s), 58 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 5
HKCR\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Quarantined and deleted successfully.
HKCR\inbox.WS.com IE Toolbar (PUP.Optional.InboxToolBar.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCB69577-088B-4004-9ED8-FF5BCC83A039} (PUP.Optional.RebateInformer.A) -> Quarantined and deleted successfully.
HKCU\Software\Inbox Toolbar (PUP.Optional.InboxToolBar.A) -> Quarantined and deleted successfully.

Registry Values Detected: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Data: exé×'äAœÐ%«WLè -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Data:  -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Data:  -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D7E97865-918F-41E4-9CD0-25AB1C574CE8} (PUP.Optional.InboxToolBar.A) -> Data:  -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\mary ann\Documents\Downloads\4shared_Desktop_3.2.3.exe (PUP.Optional.4Shared) -> Quarantined and deleted successfully.
C:\Users\mary ann\Documents\Downloads\setup.exe (PUP.BundleInstaller.VG) -> Quarantined and deleted successfully.

(end)
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 04, 2013, 06:55:22 PM
Hi, mare_wbpa.  Welcome back.  We'll certainly do what we can to help you clean your laptop.  First, however, some additional logs are needed so we can see what else Inbox.com Toolbar may have installed. 

Note:  Due to the length of the logs, it may take two replies to get everything posted.

1.  Please provide the requested logs in Log Posting Instructions (http://www.landzdown.com/analysis-and-malware-removal/log-posting-instructions/).

2.  Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode and save to your Desktop.
Thank you.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 07, 2013, 09:14:35 PM
When I clicked on the highlighted link to download the AWC it took me to a download which I thought was AWC but turned out to be Zip Extractor, I downloaded that, which brought along with it Norton and a toolbar.  Should I do anything to get  rid of those b4 I run the AWC, which I managed to download to my desktop sucessfully.  Sorry for the backslide!!
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 07, 2013, 10:57:56 PM
Please uninstall ZipExtractor.  If there is an uninstall link for Norton and the toolbar, uninstall them as well.

Then return to Bleeping Computer, http://www.bleepingcomputer.com/download/adwcleaner/ and click the Download Now @ Bleeping Computer link, as highlighted in yellow in the attached image.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 08, 2013, 02:27:30 AM
I haven't run the AWC yet, should I do that before downloading the Bleeping computer?
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 08, 2013, 04:58:39 PM
Ok, let's go back to square one. 

1.  Please post the three logs as requested in the Log Posting Instructions (http://www.landzdown.com/analysis-and-malware-removal/log-posting-instructions/) topic.

2.  AdwCleaner is hosted at the Bleeping Computer website.  If you do not have AdwCleaner.exe on your desktop, please do the following.   Otherwise, please follow the instructions to scan with AdwCleaner and post the log.

Please download AdwCleaner from here http://www.bleepingcomputer.com/download/adwcleaner/dl/125/ by Xplode and save to your Desktop.  Note:  After you click the download link, there will be a delay of a few seconds.  You will then be offered the file to save.  Please save that file to your desktop.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 12:43:12 AM
There were 4 logs when I went into the C drive and found ADW, this is the 1st:
# AdwCleaner v3.014 - Report created 08/12/2013 at 19:17:20
# Updated 01/12/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : mary ann - MARYANN-PC
# Running from : C:\Users\mary ann\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Program Files\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
File Found : C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Found : C:\Users\mary ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\searchplugins\Mysearchdial.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\searchplugins\safeguard-secure-search.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\user.js
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\Askcom.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\askcomsearch.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\Mysearchdial.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\safeguard-secure-search.xml
File Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\user.js
File Found : C:\Users\Public\Desktop\eBay.lnk
File Found : C:\Users\Public\Desktop\Open It!.lnk
File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
Folder Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\{AD9A41D2-9A49-4FA6-A79E-71A0785364C8}
Folder Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\inboxcomtoolbar@inbox.com
Folder Found : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\toolbar@ask.com
Folder Found C:\Program Files\Ask.com
Folder Found C:\Program Files\Common Files\Software Update Utility
Folder Found C:\Program Files\Conduit
Folder Found C:\Program Files\Free Offers from Freeze.com
Folder Found C:\Program Files\Inbox Toolbar
Folder Found C:\Program Files\iWin
Folder Found C:\Program Files\iWin
Folder Found C:\Program Files\openit
Folder Found C:\ProgramData\Ask
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iWin
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iWin
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!
Folder Found C:\ProgramData\Trymedia
Folder Found C:\Users\mary ann\AppData\LocalLow\AskToolbar
Folder Found C:\Users\mary ann\AppData\LocalLow\Conduit
Folder Found C:\Users\mary ann\AppData\LocalLow\FunWebProducts
Folder Found C:\Users\mary ann\AppData\LocalLow\Hotbar
Folder Found C:\Users\mary ann\AppData\LocalLow\Inbox Toolbar
Folder Found C:\Users\mary ann\AppData\LocalLow\iWin
Folder Found C:\Users\mary ann\AppData\LocalLow\iWin
Folder Found C:\Users\mary ann\AppData\LocalLow\MyWebSearch
Folder Found C:\Users\mary ann\AppData\Roaming\iWin
Folder Found C:\Users\mary ann\AppData\Roaming\iWin
Folder Found C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chameleon Tom
Folder Found C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freeze.com
Folder Found C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin
Folder Found C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin
Folder Found C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Inbox Toolbar
Folder Found C:\Users\mary ann\AppData\Roaming\Mysearchdial
Folder Found C:\Users\MARYAN~1\AppData\Local\Temp\AskSearch
Folder Found C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

***** [ Shortcuts ] *****

Shortcut Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Help.lnk ( /showurl hxxp://toolbar.inbox.com/faq.aspx )
Shortcut Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Inbox.com.lnk ( /showurl hxxp://www.inbox.com/homepage.aspx?tbid=80229 )
Shortcut Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Settings.lnk ( /showurl hxxp://toolbar.inbox.com/settings/settings.aspx?lng=en )

***** [ Registry ] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\Hotbar
Key Found : HKCU\Software\AppDataLow\Software\iWin
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AVG SafeGuard toolbar
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\iWin
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\hotbarsa
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\iWin Toolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\OpenIt Open It!
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Found : HKCU\Software\mysearchdial.com
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\APN
Key Found : HKLM\Software\AskToolbar
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7F1DF2F8-CB22-42FC-BB1F-096DFCD4799F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9912E824-B76D-4D1E-AE00-CFAC5A4BCDF9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Interface\{50D2FDCC-2707-49CB-8223-7FE0424909AA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{878CE013-7BA9-4650-A78C-B2234C0C1648}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A7213D71-47E1-4832-92D7-D61DFE9F231F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A87DFD99-CF81-4241-85CE-881E0026B686}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C96B9FAE-A032-4100-BB47-32EF05E28BE4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{CF82F350-E1C4-4916-AC12-BA73DB60AFB7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1678857
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Inbox Toolbar
Key Found : HKLM\Software\iWin
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99A88FFA-0520-4D69-B41A-DD96B3C324CE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1DF2F8-CB22-42FC-BB1F-096DFCD4799F}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iWin Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenIt Open It!
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\Software\Trymedia Systems
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16520

Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=728447292&ir=
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=728447292&ir=
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [SearchAssistant] - hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [CustomizeSearch] - hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch] - hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229

-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\prefs.js ]

Line Found : user_pref("browser.search.defaultenginename", "Mysearchdial");

[ File : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\prefs.js ]

Line Found : user_pref("aol_toolbar.surf.date", "2");
Line Found : user_pref("aol_toolbar.surf.lastDate", "1");
Line Found : user_pref("aol_toolbar.surf.lastMonth", "7");
Line Found : user_pref("aol_toolbar.surf.lastYear", "2012");
Line Found : user_pref("aol_toolbar.surf.month", "2");
Line Found : user_pref("aol_toolbar.surf.prevMonth", "336");
Line Found : user_pref("aol_toolbar.surf.total", "29269");
Line Found : user_pref("aol_toolbar.surf.week", "173");
Line Found : user_pref("aol_toolbar.surf.year", "2260");
Line Found : user_pref("browser.search.defaultengine", "Ask.com Search");
Line Found : user_pref("browser.search.defaulturl", "hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=23-07-2010&tb_mrud=23-07-[...]
Line Found : user_pref("browser.search.order.1", "Mysearchdial");
Line Found : user_pref("extensions.asktb.InstallDir", "C:\\Program Files\\Ask.com\\");
Line Found : user_pref("extensions.asktb.apn_dbr", "ff_3.6.25");
Line Found : user_pref("extensions.asktb.cbid", "^A2E");
Line Found : user_pref("extensions.asktb.config-updated", false);
Line Found : user_pref("extensions.asktb.crumb", "2012.01.11+16.19.23-toolbar015iad-US-V2lsa2VzIEJhcnJlLFBBLFVuaXRlZCBTdGF0ZXM%3D");
Line Found : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
Line Found : user_pref("extensions.asktb.dtid", "^YYYYYY^SM^US");
Line Found : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=sf&tbid=80229&language=en&qkw=");
Line Found : user_pref("extensions.asktb.first-launch", true);
Line Found : user_pref("extensions.asktb.first-restart-after-config-update", true);
Line Found : user_pref("extensions.asktb.fresh-install", false);
Line Found : user_pref("extensions.asktb.guid", "7cc970e8-6db6-4f15-8ffa-9c51692085dc");
Line Found : user_pref("extensions.asktb.hpr", "YES");
Line Found : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com\", \"www.facebook.com\", \"www.playsushi.com\", \"WWW.google.com\", \"hxxps://websearch.ask.com\", [...]
Line Found : user_pref("extensions.asktb.if", "first");
Line Found : user_pref("extensions.asktb.l", "dis");
Line Found : user_pref("extensions.asktb.last-config-req", "1327091583403");
Line Found : user_pref("extensions.asktb.locale", "en_US");
Line Found : user_pref("extensions.asktb.location", "Wilkes Barre,PA,United States");
Line Found : user_pref("extensions.asktb.o", "2159");
Line Found : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Line Found : user_pref("extensions.asktb.qsrc", "2871");
Line Found : user_pref("extensions.asktb.r", "2");
Line Found : user_pref("extensions.asktb.sa", "YES");
Line Found : user_pref("extensions.asktb.saguid", "DBC80978-8713-430B-B496-A1C3EAD7AD74");
Line Found : user_pref("extensions.asktb.search-plugin-suggestions-url", "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}");
Line Found : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
Line Found : user_pref("extensions.asktb.themeid", "");
Line Found : user_pref("extensions.asktb.timeinstalled", "1/11/2012 7:23:39 PM");
Line Found : user_pref("extensions.asktb.to", "");
Line Found : user_pref("extensions.asktb.v", "3.14.1.100009");
Line Found : user_pref("extensions.asktb.version", "5.14.1.20007");
Line Found : user_pref("extensions.enabledAddons", "inboxcomtoolbar%40inbox.com:1.2.0.49,%7Bad9a41d2-9a49-4fa6-a79e-71a0785364c8%7D:9.5.3,firefox%40browsesmart.net:1.0.0,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:[...]
Line Found : user_pref("extensions.enabledItems", "{c2f863cd-0429-48c7-bb54-db756a951760}:5.96.10.5491,inboxcomtoolbar@inbox.com:1.0.0.26,{98e34367-8df7-42b4-837b-20b892ff0849}:1.6,{CAFEEFAC-0016-0000-0020-ABCDEFF[...]
Line Found : user_pref("extensions.inboxcomtoolbar@inbox.com.update.url", "hxxp://toolbar.inbox.com/toolbar/firefox/update.aspx?version=%ITEM_VERSION%&status=%ITEM_STATUS%&appVersion=%APP_VERSION%&appOS=%APP_OS%&a[...]
Line Found : user_pref("extensions.mysearchdial.aflt", "dsites");
Line Found : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
Line Found : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");
Line Found : user_pref("extensions.mysearchdial.cntry", "US");
Line Found : user_pref("extensions.mysearchdial.cr", "728447292");
Line Found : user_pref("extensions.mysearchdial.dfltLng", "");
Line Found : user_pref("extensions.mysearchdial.dfltSrch", true);
Line Found : user_pref("extensions.mysearchdial.dnsErr", true);
Line Found : user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,18285[...]
Line Found : user_pref("extensions.mysearchdial.excTlbr", false);
Line Found : user_pref("extensions.mysearchdial.hdrMd5", "9F532685D7E465ED23E2D9081CFF9458");
Line Found : user_pref("extensions.mysearchdial.hmpg", true);
Line Found : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1[...]
Line Found : user_pref("extensions.mysearchdial.id", "00242B95580905B4");
Line Found : user_pref("extensions.mysearchdial.instlDay", "16046");
Line Found : user_pref("extensions.mysearchdial.instlRef", "");
Line Found : user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1[...]
Line Found : user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.21.016:2:41");
Line Found : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCy[...]
Line Found : user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"89\",\"lastVrsn\":\"89\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Line Found : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
Line Found : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
Line Found : user_pref("extensions.mysearchdial.sg", "none");
Line Found : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
Line Found : user_pref("extensions.mysearchdial.tlbrId", "base");
Line Found : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czut[...]
Line Found : user_pref("extensions.mysearchdial.vrsn", "1.8.21.0");
Line Found : user_pref("extensions.mysearchdial.vrsni", "1.8.21.0");
Line Found : user_pref("extensions.mysearchdial_i.hmpg", true);
Line Found : user_pref("extensions.mysearchdial_i.newTab", false);
Line Found : user_pref("extensions.mysearchdial_i.smplGrp", "none");
Line Found : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.21.016:2:41");
Line Found : user_pref("ibxcomtb.defHP", "hxxp://www.ask.com/?l=dis&o=2159&gct=hp");
Line Found : user_pref("ibxcomtb.defs", "<buttons>\r\n<button id=\"music_search\" position=\"100\" default=\"3\" type=\"simple\" action=\"hxxp://toolbar.inbox.com/link.aspx?code=music_search_freenapster&amp;query=[...]
Line Found : user_pref("ibxcomtb.ibxHP", "hxxp://www.inbox.com/homepage.aspx?tbid=80229&lng=en");

*************************

AdwCleaner[R0].txt - [27410 octets] - [08/12/2013 19:17:20]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [27471 octets] ##########
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 12:45:30 AM
2nd

# AdwCleaner v3.014 - Report created 08/12/2013 at 19:26:52
# Updated 01/12/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : mary ann - MARYANN-PC
# Running from : C:\Users\mary ann\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\Hotbar
Key Found : HKCU\Software\AppDataLow\Software\iWin
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AVG SafeGuard toolbar
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\iWin
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\hotbarsa
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\iWin Toolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\OpenIt Open It!
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Found : HKCU\Software\mysearchdial.com
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\APN
Key Found : HKLM\Software\AskToolbar
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{37540F19-DD4C-478B-B2DF-C19281BCAF27}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7F1DF2F8-CB22-42FC-BB1F-096DFCD4799F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9912E824-B76D-4D1E-AE00-CFAC5A4BCDF9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Interface\{50D2FDCC-2707-49CB-8223-7FE0424909AA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{878CE013-7BA9-4650-A78C-B2234C0C1648}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A7213D71-47E1-4832-92D7-D61DFE9F231F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A87DFD99-CF81-4241-85CE-881E0026B686}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C96B9FAE-A032-4100-BB47-32EF05E28BE4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{CF82F350-E1C4-4916-AC12-BA73DB60AFB7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1678857
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Inbox Toolbar
Key Found : HKLM\Software\iWin
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\Scheduled Update for Ask Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99A88FFA-0520-4D69-B41A-DD96B3C324CE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1DF2F8-CB22-42FC-BB1F-096DFCD4799F}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iWin Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OpenIt Open It!
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\Software\Trymedia Systems
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CE0C2586-DA36-452B-ACDB-320D9BCB19BF}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16520

Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=728447292&ir=
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R&cr=728447292&ir=
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [SearchAssistant] - hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [CustomizeSearch] - hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://toolbar.inbox.com/search/ie.aspx?tbid=80229
Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch] - hxxp://toolbar.inbox.com/help/sa_customize.aspx?tbid=80229

-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\prefs.js ]

Line Found : user_pref("browser.search.defaultenginename", "Mysearchdial");

[ File : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\prefs.js ]

Line Found : user_pref("aol_toolbar.surf.date", "2");
Line Found : user_pref("aol_toolbar.surf.lastDate", "1");
Line Found : user_pref("aol_toolbar.surf.lastMonth", "7");
Line Found : user_pref("aol_toolbar.surf.lastYear", "2012");
Line Found : user_pref("aol_toolbar.surf.month", "2");
Line Found : user_pref("aol_toolbar.surf.prevMonth", "336");
Line Found : user_pref("aol_toolbar.surf.total", "29269");
Line Found : user_pref("aol_toolbar.surf.week", "173");
Line Found : user_pref("aol_toolbar.surf.year", "2260");
Line Found : user_pref("browser.search.defaultengine", "Ask.com Search");
Line Found : user_pref("browser.search.defaulturl", "hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=23-07-2010&tb_mrud=23-07-[...]
Line Found : user_pref("browser.search.order.1", "Mysearchdial");
Line Found : user_pref("extensions.asktb.InstallDir", "C:\\Program Files\\Ask.com\\");
Line Found : user_pref("extensions.asktb.apn_dbr", "ff_3.6.25");
Line Found : user_pref("extensions.asktb.cbid", "^A2E");
Line Found : user_pref("extensions.asktb.config-updated", false);
Line Found : user_pref("extensions.asktb.crumb", "2012.01.11+16.19.23-toolbar015iad-US-V2lsa2VzIEJhcnJlLFBBLFVuaXRlZCBTdGF0ZXM%3D");
Line Found : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
Line Found : user_pref("extensions.asktb.dtid", "^YYYYYY^SM^US");
Line Found : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=sf&tbid=80229&language=en&qkw=");
Line Found : user_pref("extensions.asktb.first-launch", true);
Line Found : user_pref("extensions.asktb.first-restart-after-config-update", true);
Line Found : user_pref("extensions.asktb.fresh-install", false);
Line Found : user_pref("extensions.asktb.guid", "7cc970e8-6db6-4f15-8ffa-9c51692085dc");
Line Found : user_pref("extensions.asktb.hpr", "YES");
Line Found : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com\", \"www.facebook.com\", \"www.playsushi.com\", \"WWW.google.com\", \"hxxps://websearch.ask.com\", [...]
Line Found : user_pref("extensions.asktb.if", "first");
Line Found : user_pref("extensions.asktb.l", "dis");
Line Found : user_pref("extensions.asktb.last-config-req", "1327091583403");
Line Found : user_pref("extensions.asktb.locale", "en_US");
Line Found : user_pref("extensions.asktb.location", "Wilkes Barre,PA,United States");
Line Found : user_pref("extensions.asktb.o", "2159");
Line Found : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Line Found : user_pref("extensions.asktb.qsrc", "2871");
Line Found : user_pref("extensions.asktb.r", "2");
Line Found : user_pref("extensions.asktb.sa", "YES");
Line Found : user_pref("extensions.asktb.saguid", "DBC80978-8713-430B-B496-A1C3EAD7AD74");
Line Found : user_pref("extensions.asktb.search-plugin-suggestions-url", "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}");
Line Found : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
Line Found : user_pref("extensions.asktb.themeid", "");
Line Found : user_pref("extensions.asktb.timeinstalled", "1/11/2012 7:23:39 PM");
Line Found : user_pref("extensions.asktb.to", "");
Line Found : user_pref("extensions.asktb.v", "3.14.1.100009");
Line Found : user_pref("extensions.asktb.version", "5.14.1.20007");
Line Found : user_pref("extensions.enabledAddons", "inboxcomtoolbar%40inbox.com:1.2.0.49,%7Bad9a41d2-9a49-4fa6-a79e-71a0785364c8%7D:9.5.3,firefox%40browsesmart.net:1.0.0,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:[...]
Line Found : user_pref("extensions.enabledItems", "{c2f863cd-0429-48c7-bb54-db756a951760}:5.96.10.5491,inboxcomtoolbar@inbox.com:1.0.0.26,{98e34367-8df7-42b4-837b-20b892ff0849}:1.6,{CAFEEFAC-0016-0000-0020-ABCDEFF[...]
Line Found : user_pref("extensions.inboxcomtoolbar@inbox.com.update.url", "hxxp://toolbar.inbox.com/toolbar/firefox/update.aspx?version=%ITEM_VERSION%&status=%ITEM_STATUS%&appVersion=%APP_VERSION%&appOS=%APP_OS%&a[...]
Line Found : user_pref("extensions.mysearchdial.aflt", "dsites");
Line Found : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
Line Found : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");
Line Found : user_pref("extensions.mysearchdial.cntry", "US");
Line Found : user_pref("extensions.mysearchdial.cr", "728447292");
Line Found : user_pref("extensions.mysearchdial.dfltLng", "");
Line Found : user_pref("extensions.mysearchdial.dfltSrch", true);
Line Found : user_pref("extensions.mysearchdial.dnsErr", true);
Line Found : user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,18285[...]
Line Found : user_pref("extensions.mysearchdial.excTlbr", false);
Line Found : user_pref("extensions.mysearchdial.hdrMd5", "9F532685D7E465ED23E2D9081CFF9458");
Line Found : user_pref("extensions.mysearchdial.hmpg", true);
Line Found : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1[...]
Line Found : user_pref("extensions.mysearchdial.id", "00242B95580905B4");
Line Found : user_pref("extensions.mysearchdial.instlDay", "16046");
Line Found : user_pref("extensions.mysearchdial.instlRef", "");
Line Found : user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1[...]
Line Found : user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.21.016:2:41");
Line Found : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCy[...]
Line Found : user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"89\",\"lastVrsn\":\"89\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Line Found : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
Line Found : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
Line Found : user_pref("extensions.mysearchdial.sg", "none");
Line Found : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
Line Found : user_pref("extensions.mysearchdial.tlbrId", "base");
Line Found : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0BzyyDyDzztDzytDyD0ByEtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czut[...]
Line Found : user_pref("extensions.mysearchdial.vrsn", "1.8.21.0");
Line Found : user_pref("extensions.mysearchdial.vrsni", "1.8.21.0");
Line Found : user_pref("extensions.mysearchdial_i.hmpg", true);
Line Found : user_pref("extensions.mysearchdial_i.newTab", false);
Line Found : user_pref("extensions.mysearchdial_i.smplGrp", "none");
Line Found : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.21.016:2:41");
Line Found : user_pref("ibxcomtb.defHP", "hxxp://www.ask.com/?l=dis&o=2159&gct=hp");
Line Found : user_pref("ibxcomtb.defs", "<buttons>\r\n<button id=\"music_search\" position=\"100\" default=\"3\" type=\"simple\" action=\"hxxp://toolbar.inbox.com/link.aspx?code=music_search_freenapster&amp;query=[...]
Line Found : user_pref("ibxcomtb.ibxHP", "hxxp://www.inbox.com/homepage.aspx?tbid=80229&lng=en");

*************************

AdwCleaner[R0].txt - [27552 octets] - [08/12/2013 19:17:20]
AdwCleaner[R1].txt - [22840 octets] - [08/12/2013 19:26:52]
AdwCleaner[S0].txt - [4395 octets] - [08/12/2013 19:25:19]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [22961 octets] ##########


Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 12:49:19 AM
3rd

# AdwCleaner v3.014 - Report created 08/12/2013 at 19:25:19
# Updated 01/12/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : mary ann - MARYANN-PC
# Running from : C:\Users\mary ann\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Trymedia
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iWin
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!
Folder Deleted : C:\Program Files\Ask.com
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\Free Offers from Freeze.com
Folder Deleted : C:\Program Files\Inbox Toolbar
Folder Deleted : C:\Program Files\iWin
Folder Deleted : C:\Program Files\openit
Folder Deleted : C:\Program Files\Common Files\Software Update Utility
Folder Deleted : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Folder Deleted : C:\Users\MARYAN~1\AppData\Local\Temp\AskSearch
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\FunWebProducts
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\Hotbar
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\Inbox Toolbar
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\iWin
Folder Deleted : C:\Users\mary ann\AppData\LocalLow\MyWebSearch
Folder Deleted : C:\Users\mary ann\AppData\Roaming\iWin
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Mysearchdial
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chameleon Tom
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freeze.com
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Inbox Toolbar
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\{AD9A41D2-9A49-4FA6-A79E-71A0785364C8}
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\inboxcomtoolbar@inbox.com
Folder Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\Extensions\toolbar@ask.com
File Deleted : C:\Users\Public\Desktop\eBay.lnk
File Deleted : C:\Users\Public\Desktop\Open It!.lnk
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\Askcom.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\askcomsearch.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\searchplugins\Mysearchdial.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\Mysearchdial.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\gvvo0xw7.default\user.js
File Deleted : C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\user.js
File Deleted : C:\Users\mary ann\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Shortcuts ] *****

Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 12:50:38 AM
last

# AdwCleaner v3.014 - Report created 08/12/2013 at 19:28:11
# Updated 01/12/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : mary ann - MARYANN-PC
# Running from : C:\Users\mary ann\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 09, 2013, 01:20:54 AM
Those four logs represent scanning twice and selecting clean twice.  Please now provide the remaining requested logs in the Log Posting Instructions (http://www.landzdown.com/analysis-and-malware-removal/log-posting-instructions/) topic.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 11:26:21 PM
DDS log#1
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 3/6/2009 1:29:29 AM
System Uptime: 12/9/2013 3:44:48 PM (3 hours ago)
.
Motherboard: Wistron |  | 303C
Processor: AMD Athlon Dual-Core QL-62 | Socket A | 1000/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 222 GiB total, 136.282 GiB free.
D: is FIXED (NTFS) - 11 GiB total, 1.818 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.4)
Adobe Shockwave Player
AIM Toolbar
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Driver Installation Program
AVG 2014
Big Fish Games: Game Manager
blinkx beat
Bonjour
Cake Mania Main Street
Canon MP Navigator EX 1.0
Canon MX310 series
Canon MX310 series User Registration
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
Conexant HD Audio
Coupon Printer for Windows
CyberLink DVD Suite
Deal or No Deal - Secret Vault Games
ESU for Microsoft Vista
Facebook Plug-In
Family Feud (remove only)
Google Toolbar for Internet Explorer
Google Update Helper
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.7
HP Games
HP Help and Support
HP Quick Launch Buttons 6.40 H2
HP Total Care Advisor
HP Update
HP User Guides 0118
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
HPTCSSetup
iDFX
iTunes
iWin Games (remove only)
Java 7 Update 25
Java Auto Updater
Java(TM) 6 Update 7
Juno Preloader
LabelPrint
LightScribe System Software  1.14.17.1
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Live Search Toolbar
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft Works
MotoConnect 1.1.31
Motorola Mobile Drivers Installation 4.7.1
Move Media Player
Mozilla Firefox 25.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee Reveal
NetWaiting
NetZero Preloader
Norton Internet Security
NVIDIA Drivers
OGA Notifier 2.0.0048.0
ooVoo
PIXMA Extended Survey Program
Power2Go
PowerDirector
Presto! PageManager 7.15.16
PVSonyDll
QuickTime
Realtek USB 2.0 Card Reader
ScanSoft OmniPage SE 4
SCRABBLE
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2861188)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827329) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2827330) 32-Bit Edition
Skype web features
Skype™ 5.10
SPORE Creature Creator Trial Edition
Sure Cuts A Lot 2.029
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Visual Studio 2012 x86 Redistributables
Wedding Dash
WorldWinner Games
.
==== End Of File ===========================
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 11:27:33 PM
Log #2
S (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16520  BrowserJavaVersion: 10.25.2
Run by mary ann at 18:20:02 on 2013-12-09
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.1790.786 [GMT -5:00]
.
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: AVG Anti-Virus Free *Disabled/Updated* {0C939084-9E57-CBDB-EA61-0B0C7F62AF82}
SP: AVG Anti-Virus Free *Disabled/Updated* {B7F27160-B86D-C455-D0D1-307E04E5E53F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ================
.
C:\PROGRA~1\AVG\AVG2014\avgrsx.exe
C:\Program Files\AVG\AVG2014\avgcsrvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2014\avgidsagent.exe
C:\Program Files\AVG\AVG2014\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\OfficeGuardianV2N\UACProxy.exe
C:\Program Files\iWin Games\iWinTrusted.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\SMINST\BLService.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\taskeng.exe
C:\ProgramData\OfficeGuardianV2N\Reminder\SacNetAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVG\AVG2014\avgui.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\ooVoo\ooVoo.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\ProgramData\OfficeGuardianV2N\Reminder\SacReminder.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AVG\AVG2014\avgnsx.exe
C:\Program Files\AVG\AVG2014\avgemcx.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
mStart Page = hxxp://www.google.com
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
mSearchAssistant = hxxp://www.google.com
mCustomizeSearch = hxxp://www.google.com
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: IEHlprObj Class: {8CA5ED52-F3FB-4414-A105-2E3491156990} - c:\program files\iwin games\iWinGamesHookIE.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: AIM Toolbar: {61539ECD-CC67-4437-A03C-9AACCBD14326} - c:\program files\aim toolbar\aimtb.dll
TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [oovoo.exe] c:\program files\oovoo\oovoo.exe /minimized
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [AVG-Secure-Search-Update_0913a] c:\users\mary ann\appdata\roaming\avg 0913a campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid 36370af645e65b16b18c941e1116b748-969a7225267dc17e441b61148ef273c84c89902b --CMPID 0913a
uRun: [SacReminderHDDV2N] c:\programdata\officeguardianv2n\reminder\SacReminder.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AVG_UI] "c:\program files\avg\avg2014\avgui.exe" /TRAYONLY
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre7\bin\jp2iexp.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
TCP: NameServer = 192.168.2.1 24.229.54.212 216.144.187.199 204.186.80.229
TCP: Interfaces\{2B1F2E8F-3C9A-485F-9F8A-D41BE44E6BF3} : DHCPNameServer = 192.168.2.1 24.229.54.212 216.144.187.199 204.186.80.229
TCP: Interfaces\{A14EF26A-61FF-4731-9929-9797EAE1222D} : DHCPNameServer = 172.168.37.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\mary ann\appdata\roaming\mozilla\firefox\profiles\zni3qowh.default\
FF - component: c:\program files\mozilla firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - component: c:\users\mary ann\appdata\roaming\mozilla\firefox\profiles\zni3qowh.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.22.3\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: c:\program files\worldwinner.com, inc\worldwinner games\npwwload.dll
FF - plugin: c:\users\mary ann\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\mary ann\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\mary ann\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_117.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: !HIDDEN! 2009-08-14 10:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-10-24 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-10-31 222520]
R0 AvgMfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-10-1 102712]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [2013-11-5 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-11-4 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-9-17 22840]
R1 AvgLdx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-10-31 176952]
R1 AvgTdiX;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-8-1 193848]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2014\avgidsagent.exe [2013-11-11 3478544]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2014\avgwdsvc.exe [2013-9-24 348008]
R2 CFUACProxy_officeguardianv2n;CFUACProxy_officeguardianv2n;c:\programdata\officeguardianv2n\UACProxy.exe [2013-10-7 83792]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 iWinTrusted;iWinTrusted;c:\program files\iwin games\iWinTrusted.exe [2010-4-14 78104]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-6-2 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-5-23 701512]
R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-6-24 91456]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-25 365952]
R2 SacNetAgentService_C57C4F854F53;SacNetAgentService_C57C4F854F53;c:\programdata\officeguardianv2n\reminder\SacNetAgent.exe [2013-10-7 163664]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-25 193840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-5-23 22856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 --> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 754856]
.
=============== Created Last 30 ================
.
2013-12-09 00:17:13   --------   d-----w-   C:\AdwCleaner
2013-12-07 21:23:40   --------   d-----w-   c:\program files\common files\Symantec Shared
2013-11-14 15:20:28   --------   d-----w-   C:\d75b162b80459d40b8e3ea44193fe7e9
2013-11-13 22:32:54   297984   ----a-w-   c:\windows\system32\gdi32.dll
2013-11-13 22:32:48   993792   ----a-w-   c:\windows\system32\crypt32.dll
2013-11-13 22:32:34   596480   ----a-w-   c:\windows\system32\FWPUCLNT.DLL
2013-11-13 22:32:34   444928   ----a-w-   c:\windows\system32\IKEEXT.DLL
.
==================== Find3M  ====================
.
2013-11-06 02:50:48   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys
2013-11-05 02:57:30   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys
2013-11-01 04:00:28   176952   ----a-w-   c:\windows\system32\drivers\avgldx86.sys
2013-11-01 03:30:08   222520   ----a-w-   c:\windows\system32\drivers\avglogx.sys
2013-10-25 03:28:32   147768   ----a-w-   c:\windows\system32\drivers\avgidshx.sys
2013-10-13 09:48:06   1806848   ----a-w-   c:\windows\system32\jscript9.dll
2013-10-13 09:35:52   1427968   ----a-w-   c:\windows\system32\inetcpl.cpl
2013-10-13 09:35:38   1129472   ----a-w-   c:\windows\system32\wininet.dll
2013-10-13 09:30:14   142848   ----a-w-   c:\windows\system32\ieUnatt.exe
2013-10-13 09:29:02   420864   ----a-w-   c:\windows\system32\vbscript.dll
2013-10-13 09:25:39   2382848   ----a-w-   c:\windows\system32\mshtml.tlb
2013-10-09 00:14:04   71048   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-09 00:14:04   692616   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-09-17 05:57:26   22840   ----a-w-   c:\windows\system32\drivers\avgidsshimx.sys
.
============= FINISH: 18:22:28.06 ===============
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 09, 2013, 11:44:46 PM
Security Check results

Results of screen317's Security Check version 0.99.77 
Windows Vista Service Pack 2 x86 (UAC is enabled) 
Internet Explorer 9 
Internet Explorer 8 
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Firewall Enabled! 
AVG AntiVirus Free Edition 2014   
AVG Anti-Virus Free               
Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````[/u]
Malwarebytes Anti-Malware version 1.75.0.1300 
Java 7 Update 25 
Java(TM) 6 Update 7 
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player    11.9.900.117 
Adobe Reader 10.1.4 Adobe Reader out of Date! 
Mozilla Firefox (25.0.1)
````````Process Check: objlist.exe by Laurent````````[/u] 
Malwarebytes Anti-Malware mbamservice.exe 
Malwarebytes Anti-Malware mbamgui.exe 
AVG avgwdsvc.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: 2 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````[/u]
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 10, 2013, 01:28:00 AM
That is what I wanted to see.  Thank you!

A.  First, let's take care of the outdated third-party software.

1.  Java  -- Although you updated to JRE7, that update didn't remove the old JRE6.  Please do the following:

a)  Uninstall Java(TM) 6 Update 7 
b)  Update Java(TM) 7 to the latest version here:  Java Version 7 Update 45 (http://java.com/en/download/index.jsp).  Note Watch the install carefully to uncheck any unwanted extras as they are not needed for the update.

2.  Adobe Flash Player 10 -- It is necessary to update Flash Player for both Internet Explorer as well as Non-IE browsers, such as Firefox.  Following are the direct download links for both.  Please download and install the updates.  Note:  Pay attention to where you save the files because you will need to close the browser to install the updates.  Also note that Adobe has generally been updating Flash Player on the second Tuesday of each month so there may be another update tomorrow.

Non-IE (Opera, Firefox, Etc.):  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_plugin.exe
Windows XP, Vista and 7:  Flash Player For Internet Explorer 7, 8, 9, 10, 11:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_active_x.exe

3.  Adobe Reader -- Adobe Reader XI (11.0.05) for Windows is available here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

Note: UNcheck any pre-checked additional options presented with the update. They are not part of the software update and are completely optional.



B.  Uninstalls

1.  iWin Games -- iWinTrusted.exe is part of iWinGames and "is classified as malware, spyware, adware, or other potentially unwanted software."  I suggest you uninstall it.

2.  Norton Internet Security -- After uninstalling, please run the Norton Removal Tool, following the instructions here:  Download and run the Norton Removal Tool to uninstall your Norton product (https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us).



C.  After the above is completed, please restart your computer and do the following:

Please follow these instructions carefully.  Download ComboFix from the following location:  Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)

!!! IMPORTANT !!! Save ComboFix.exe to your Desktop

Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 11, 2013, 12:33:27 AM
I uninstalled Java 6 update 7 but didn't uninstall update Java 7 update 45 before downloading  the above Java.  I saved it to my documents.  It doesn't appear in the add/remove programs listed in the control panel option for uninstall.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 13, 2013, 11:08:15 PM
You don't need to uninstall Java 7 (it is listed in your installed programs as Java 7 update 25).  Just follow the link I provided to get the update to the latest version 45.  Then move on to the remaining instructions.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 14, 2013, 01:03:41 AM
Here is the only combofix text document that I could find that looked anything like a log.  I had trouble finding it as it didn't come up when I pasted C:\ComboFix.txt into search.  I followed the other instructions and uninstalled norton and Iwin .

ComboFix 13-12-13.01 - mary ann 12/13/2013  17:54:24.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.1790.858 [GMT -5:00]
Running from: C:\Users\mary ann\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {0C939084-9E57-CBDB-EA61-0B0C7F62AF82}
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG Anti-Virus Free *Disabled/Updated* {B7F27160-B86D-C455-D0D1-307E04E5E53F}
SP: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Blinkx
C:\Program Files\Blinkx\blinkx.ico
C:\Program Files\Blinkx\blinkxss.exe
C:\Program Files\Blinkx\blinkxstop.exe
C:\Program Files\Blinkx\lang.dll
C:\Program Files\Blinkx\templates\beat.ico
C:\Program Files\Blinkx\templates\index.html
C:\Program Files\Blinkx\templates\noflash.html
C:\Program Files\Blinkx\templates\offline.html
C:\Program Files\Blinkx\templates\offline.swf
C:\Program Files\Blinkx\templates\uninstall.exe
C:\ProgramData\ntuser.dat
C:\Users\mary ann\AppData\Roaming\Microsoft\Windows\Recent\Comfy Cakes.pif
C:\Users\mary ann\install_flash_player_11_plugin.exe
C:\Users\mary ann\Norton_Removal_Tool.exe
C:\Windows\isRS-000.tmp


(((((((((((((((((((((((((   Files Created from 2013-11-13 to 2013-12-13  )))))))))))))))))))))))))))))))


2013-12-13 23:08:46 . 2013-12-13 23:09:06   --------   d-----w-   C:\Users\mary ann\AppData\Local\temp
2013-12-13 23:08:46 . 2013-12-13 23:08:46   --------   d-----w-   C:\Users\Default\AppData\Local\temp
2013-12-12 15:05:59 . 2013-10-30 00:35:24   2050560   ----a-w-   C:\Windows\system32\win32k.sys
2013-12-12 15:05:50 . 2013-10-30 02:12:54   335360   ----a-w-   C:\Windows\system32\SysFxUI.dll
2013-12-12 15:05:50 . 2013-10-30 01:43:04   130048   ----a-w-   C:\Windows\system32\drivers\drmk.sys
2013-12-12 15:05:50 . 2013-10-30 00:43:06   167936   ----a-w-   C:\Windows\system32\drivers\portcls.sys
2013-12-12 15:05:24 . 2013-10-11 02:08:55   131072   ----a-w-   C:\Windows\system32\wshom.ocx
2013-12-12 15:05:24 . 2013-10-11 00:35:42   135168   ----a-w-   C:\Windows\system32\cscript.exe
2013-12-12 15:05:24 . 2013-10-11 00:35:41   155648   ----a-w-   C:\Windows\system32\wscript.exe
2013-12-12 15:05:16 . 2013-10-11 02:08:55   36864   ----a-w-   C:\Windows\system32\wshcon.dll
2013-12-12 15:05:16 . 2013-10-11 02:08:35   172032   ----a-w-   C:\Windows\system32\scrrun.dll
2013-12-12 15:04:01 . 2013-10-22 07:19:59   158208   ----a-w-   C:\Windows\system32\imagehlp.dll
2013-12-10 23:50:16 . 2013-12-10 23:50:25   --------   d-----w-   C:\ProgramData\Oracle
2013-12-10 23:50:03 . 2013-12-10 23:50:03   --------   d-----w-   C:\Program Files\Common Files\Java
2013-12-10 23:48:11 . 2013-10-08 12:50:41   94632   ----a-w-   C:\Windows\system32\WindowsAccessBridge.dll
2013-12-10 23:40:04 . 2013-12-10 23:40:09   915368   ----a-w-   C:\jxpiinstall.exe
2013-12-09 00:17:13 . 2013-12-09 00:28:14   --------   d-----w-   C:\AdwCleaner
2013-11-14 15:20:28 . 2013-11-14 15:22:29   --------   d-----w-   C:\d75b162b80459d40b8e3ea44193fe7e9
.


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-12-13 00:04:13 . 2013-06-02 22:07:32   71048   ----a-w-   C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-12-13 00:04:13 . 2013-06-02 22:07:32   692616   ----a-w-   C:\Windows\system32\FlashPlayerApp.exe
2013-11-06 02:50:48 . 2013-11-06 02:50:48   120600   ----a-w-   C:\Windows\system32\drivers\avgdiskx.sys
2013-11-05 02:57:30 . 2013-11-05 02:57:30   209176   ----a-w-   C:\Windows\system32\drivers\avgidsdriverx.sys
2013-11-01 04:00:28 . 2013-11-01 04:00:28   176952   ----a-w-   C:\Windows\system32\drivers\avgldx86.sys
2013-11-01 03:30:08 . 2013-11-01 03:30:08   222520   ----a-w-   C:\Windows\system32\drivers\avglogx.sys
2013-10-30 02:13:01 . 2008-01-21 02:23:21   1304064   ----a-w-   C:\Windows\system32\WMALFXGFXDSP.dll
2013-10-25 03:28:32 . 2013-10-25 03:28:32   147768   ----a-w-   C:\Windows\system32\drivers\avgidshx.sys
2013-10-11 02:08:02 . 2013-11-13 22:32:34   444928   ----a-w-   C:\Windows\system32\IKEEXT.DLL
2013-10-11 02:07:57 . 2013-11-13 22:32:34   596480   ----a-w-   C:\Windows\system32\FWPUCLNT.DLL
2013-10-03 12:45:50 . 2013-11-13 22:32:54   297984   ----a-w-   C:\Windows\system32\gdi32.dll
2013-10-03 12:45:45 . 2013-11-13 22:32:48   993792   ----a-w-   C:\Windows\system32\crypt32.dll
2013-10-01 05:49:38 . 2013-10-01 05:49:38   102712   ----a-w-   C:\Windows\system32\drivers\avgmfx86.sys
2013-09-17 05:57:26 . 2013-09-17 05:57:26   22840   ----a-w-   C:\Windows\system32\drivers\avgidsshimx.sys


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPAdvisor"="C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 23:56:04 972080]
"oovoo.exe"="C:\program files\oovoo\oovoo.exe" [2011-12-12 23:21:54 22459984]
"SacReminderHDDV2N"="C:\ProgramData\OfficeGuardianV2N\reminder\SacReminder.exe" [2010-11-18 09:05:07 862032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 18:05:10 1049896]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2008-09-24 01:21:52 468264]
"UpdateLBPShortCut"="C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 01:11:32 210216]
"UpdatePSTShortCut"="C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 03:42:38 210216]
"QlbCtrl.exe"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 23:14:02 202032]
"UpdateP2GoShortCut"="C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 01:11:32 210216]
"UpdatePDIRShortCut"="C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 01:11:32 210216]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 14:58:56 75008]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 21:51:00 488752]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 01:01:00 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 01:50:00 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 13:03:38 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 16:02:14 79400]
"WrtMon.exe"="C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 12:35:26 20480]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-04-28 19:06:30 142120]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 07:41:12 49208]
"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 01:43:52 59720]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2013-05-01 07:59:04 421888]
"AVG_UI"="C:\Program Files\AVG\AVG2014\avgui.exe" [2013-11-08 03:03:50 4956176]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 14:16:26 254336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation   REG_MULTI_SZ      FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14:42   451872   ----a-w-   C:\Program Files\Common Files\LightScribe\LSRunOnce.exe

Contents of the 'Scheduled Tasks' folder

2013-12-13 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-02 22:07:33 . 2013-12-13 00:04:13]

2013-12-13 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-05 21:34:59 . 2010-02-05 21:34:39]

2013-12-13 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-05 21:34:59 . 2010-02-05 21:34:39]


------- Supplementary Scan -------

uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 24.229.54.212 207.44.96.129 24.229.54.220
FF - ProfilePath - C:\Users\mary ann\AppData\Roaming\Mozilla\Firefox\Profiles\zni3qowh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
FF - ExtSQL: !HIDDEN! 2009-08-14 10:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

- - - - ORPHANS REMOVED - - - -

HKCU-Run-AVG-Secure-Search-Update_0913a - C:\Users\mary ann\AppData\Roaming\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe
HKCU-Run-AVG-Secure-Search-Update_1113a - C:\Users\mary ann\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-Family Feud - C:\Program Files\iWin\Family Feud\Uninstall.exe
AddRemove-blinkx beat - C:\Program Files\Blinkx\templates\uninstall.exe


Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 14, 2013, 01:40:03 AM
Excellent! 

Are you still getting popups?  Is your laptop still slow and freezing?
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 14, 2013, 05:03:58 PM
So far so good.  I will update when I have been on long enough to know if the problems are solved.  Good to know that you and the team are there for when I get into trouble.  Thanks for all your help.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 14, 2013, 05:52:36 PM
In that case, please do the following to implement cleanup procedures and also to reset System Restore points:

Click Start > Run and copy/paste the following bold text into the Run box and click OK:

ComboFix /Uninstall

Note: In the event you wish to contribute to the ongoing development of ComboFix, the developer is accepting donations via PayPal (https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=combofix%40live%2ecom&item_name=ComboFix&no_shipping=0&no_note=1&tax=0&currency_code=USD&bn=PP%2dDonationsBF&charset=UTF%2d8).


Please refer to the Safe Computing Practices and other recommendations in this updated copy of "So how did I get infected in the first place?" (http://securitygarden.blogspot.com/p/blog-page.html).

Let us know if you have any other questions.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 14, 2013, 08:55:41 PM
Had a major freeze up today when I visited this site.

http://www.wdcs.co.uk/media/flash/whalebanner/content_us.html

Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 14, 2013, 11:23:54 PM
Please go to the About Flash Player page (http://www.adobe.com/products/flash/about/) with both IE and Firefox to make sure you have the latest version, 11.9.900.170. 
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 18, 2013, 03:10:01 AM
I have the latest Adobe Flash in FF.  I have IE on the dfesktop, but when I double click non it, it'd not the IE startup page. 
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 19, 2013, 12:29:25 AM
I'm not sure if you mean that the shortcut on your desktop for IE doesn't work or when you launch IE from the shortcut it doesn't go to your home/startup page.

1.  If you mean when launched IE does not open to your home/start page, it is likely that it was reset when you ran AdwCleaner.  If that is the case, see the instructions here:  Change your home page in Internet Explorer - Microsoft Windows Help (http://windows.microsoft.com/en-US/internet-explorer/change-home-page#ie=ie-9).

2.  On the other hand, if you mean that the shortcut on your desktop for IE isn't working, try creating a new shortcut and deleting the old, non-working shortcut.  To delete the old shortcut, right-click it and select delete.  Instructions are in the section "Method 1: Create a shortcut to Internet Explorer on your desktop" at The Internet Explorer icon is missing from your desktop (http://support.microsoft.com/kb/945402).  You could, alternatively, run the Microsoft Fixit that is located on that page.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on December 25, 2013, 03:05:49 AM
Merry Christmas to Corinne and the team.  Please be patient with me.  I've been very busy with holiday prep, with no time to play with the computer.  I'll be back soon after the holiday with a reply to last suggestions.  Mare
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on December 25, 2013, 04:38:55 PM
Merry Christmas, Mare!  No hurry.  Family first!  We'll be here and do our best to help.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on January 06, 2014, 01:02:43 AM
Happy New Year, I'm back.  Sorry it took so long, besides the holidays there was my Birthday festivities and other later celebrations.  Getting back to business, it seems that there is no IE shortcut on my desktop.  there was a shortcut that said it was IE, but had the FF logo.  I went into all programs and found IE, when I clicked on it I was taken to a page that had a big Google logo with a search bar.  I decided to stop there and come here to ask what to do next.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on January 06, 2014, 03:17:14 PM
Hi, Mare.  Belated Happy Birthday!

Because you had so many adware, "browser hijackers" and toolbars, when AdwCleaner removed those files, it set your IE start page to Google.  That way, you can set your start page to your choice.  All you need to do is go to the page you want to open when you launch IE and set it as your start/home page.  Instructions for IE 9 are here:  Change your home page in Internet Explorer (http://windows.microsoft.com/en-US/internet-explorer/change-home-page#ie=ie-9).
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on January 06, 2014, 04:19:48 PM
I have the latest version of Adobe Flash on FF but not on IE.  I'm waiting to do any downloads or upgrading til I get further instructions from you.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on January 07, 2014, 03:09:05 AM
Hi, Mare.  Go ahead and install the latest Adobe Flash update for IE.  Here is the direct download link for Windows XP, Vista and 7:
Flash Player For Internet Explorer 7, 8, 9, 10, 11:  http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_11_active_x.exe

Have you reset your IE start/home page?
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on January 22, 2014, 11:45:39 PM
Sorry its been this long.  Life just has a way of getting in the way of computer time.  I now have the latest version of Adobe Flash on FF and IE.  What's next?
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on January 23, 2014, 12:16:20 AM
Hi, Mare.

As I recall, other than creating a new IE shortcut on your desktop (bottom of page 2) your computer was back to normal.  Are you having other problems?

Of course, as happens each month, there were new updates in January. In fact, "Patch Tuesday" had updates for not only for Microsoft but also Adobe and Java.  See my posts for Adobe & Java in the General Software News, Updates & Discussions (http://www.landzdown.com/general-software-news-updates-discussions/) forum.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on January 30, 2014, 02:08:51 AM
Still freezing up, more so on particular sites.  I've been getting notices for Java updates but I hesitate to do that update due to problems in the past.  I went to do it and discovered that I'm supposed to uninstall current Java program.  I went to uninstall from add/remove programs and the only thing I found to uninstall was a Java update, so I uninstalled it.  Went to the Java site to update band found a Java uninstall tool, but that has to be downloaded.  I'm hesitant again.  Need your sage advice.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on January 30, 2014, 02:58:42 AM
I am definitely glad I don't have Java installed on my computer!  Are you sure you need it?  Do you play online games?  Most home computer users do not need Java installed on their computer.  In the past, Java was needed for websites to be properly displayed. However, that is generally not the case now.

Why don't you try uninstalling Java, restarting the computer and hold off on installing the latest version.  See if you actually need it.

As to the Java Uninstall Tool, yes, it is safe to run.  The tool is described here:  http://www.java.com/en/download/faq/uninstaller_toolinfo.xml and available from here:  http://www.java.com/en/download/uninstallapplet.jsp

Let me know how it goes. 
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on January 30, 2014, 10:54:11 PM
I've often wondered if I needed Java.  I have no idea what it's supposed to do.  I uninstalled the Java update yesterday (update 45 was the only thing named Java in programs list) when it said that I have to uninstall old version b4 updating.  I went to the Java uninstaller tool site, there was a page to go to to verify what version of Java is installed.  It couldn't verify that Java was installed.  I hope that means that I'm rid of it.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on January 31, 2014, 12:11:54 AM
If you want to post fresh DDS logs, I'll check to see if I see any further signs of Java.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 01, 2014, 12:27:32 AM
Here is the DDS scan:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 3/6/2009 1:29:29 AM
System Uptime: 1/31/2014 3:52:42 PM (4 hours ago)
.
Motherboard: Wistron |  | 303C
Processor: AMD Athlon Dual-Core QL-62 | Socket A | 2000/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 222 GiB total, 116.571 GiB free.
D: is FIXED (NTFS) - 11 GiB total, 1.818 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Shockwave Player
AIM Toolbar
Amazon Cloud Player
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Driver Installation Program
AVG 2014
Big Fish Games: Game Manager
blinkx beat
Bonjour
Cake Mania Main Street
Canon MP Navigator EX 1.0
Canon MX310 series
Canon MX310 series User Registration
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
Conexant HD Audio
Coupon Printer for Windows
CyberLink DVD Suite
Deal or No Deal - Secret Vault Games
ESU for Microsoft Vista
Facebook Plug-In
Family Feud (remove only)
Google Update Helper
HDAUDIO Soft Data Fax Modem with SmartCP
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP DVD Play 3.7
HP Games
HP Help and Support
HP Quick Launch Buttons 6.40 H2
HP Total Care Advisor
HP Update
HP User Guides 0118
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
HPTCSSetup
iDFX
iTunes
Juno Preloader
LabelPrint
LightScribe System Software  1.14.17.1
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Live Search Toolbar
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft Works
MotoConnect 1.1.31
Motorola Mobile Drivers Installation 4.7.1
Move Media Player
Mozilla Firefox 26.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee Reveal
NetWaiting
NetZero Preloader
NVIDIA Drivers
OGA Notifier 2.0.0048.0
ooVoo
PIXMA Extended Survey Program
Power2Go
PowerDirector
Presto! PageManager 7.15.16
PVSonyDll
QuickTime
Realtek USB 2.0 Card Reader
ScanSoft OmniPage SE 4
SCRABBLE
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2861188)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817641) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2837615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2837617) 32-Bit Edition
Skype web features
Skype™ 5.10
SPORE Creature Creator Trial Edition
Sure Cuts A Lot 2.029
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Visual Studio 2012 x86 Redistributables
VLC media player 2.1.2
Wedding Dash
WorldWinner Games
.
==== End Of File ===========================
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 01, 2014, 12:46:14 AM
Quick question:  Do you use Juno or NetZero as your ISP? 

Don't forget the DDS.txt log.  :)
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 01, 2014, 04:25:02 PM
I posted the DDS scan above.  I don't use either of those as my ISP.  If I'm correct, you're asking about my internet service provider.  I use the local cable co, SECTV for cable modem internet.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 01, 2014, 06:23:15 PM
I asked about Juno & NetZero because you have both Juno Preloader and NetZero Preloader installed on your computer,  They are utilities that automatically load those Internet Service Provider drivers and startup modules.  Perhaps you used them in the past. 

The log you posted was the attach.txt.  Please look for the log named DDS.txt and post that.

Thanks.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 02, 2014, 03:11:05 AM
I don't ever remember using NetZero or Juno.  I hope this log is the one you need, it's what came up when I put DDS.txt in the search.  Sorry about the other.

(Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 9.0.8112.16526
Run by mary ann at 19:17:36 on 2014-01-31
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.1790.883 [GMT -5:00]
.
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: AVG Anti-Virus Free *Disabled/Updated* {0C939084-9E57-CBDB-EA61-0B0C7F62AF82}
SP: AVG Anti-Virus Free *Disabled/Updated* {B7F27160-B86D-C455-D0D1-307E04E5E53F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ================
.
C:\PROGRA~1\AVG\AVG2014\avgrsx.exe
C:\Program Files\AVG\AVG2014\avgcsrvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG2014\avgidsagent.exe
C:\Program Files\AVG\AVG2014\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ProgramData\OfficeGuardianV2N\UACProxy.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\SMINST\BLService.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\ProgramData\OfficeGuardianV2N\Reminder\SacNetAgent.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\AVG\AVG2014\avgui.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files\ooVoo\ooVoo.exe
C:\ProgramData\OfficeGuardianV2N\Reminder\SacReminder.exe
C:\Users\mary ann\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
C:\Program Files\AVG\AVG2014\avgnsx.exe
C:\Program Files\AVG\AVG2014\avgemcx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.google.com
uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AIM Toolbar: {61539ECD-CC67-4437-A03C-9AACCBD14326} - c:\program files\aim toolbar\aimtb.dll
TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [oovoo.exe] c:\program files\oovoo\oovoo.exe /minimized
uRun: [AVG-Secure-Search-Update_0913a] c:\users\mary ann\appdata\roaming\avg 0913a campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid 36370af645e65b16b18c941e1116b748-969a7225267dc17e441b61148ef273c84c89902b --CMPID 0913a
uRun: [SacReminderHDDV2N] c:\programdata\officeguardianv2n\reminder\SacReminder.exe
uRun: [AVG-Secure-Search-Update_1113a] c:\users\mary ann\appdata\roaming\avg 1113a campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=36370af645e65b16b18c941e1116b748-969a7225267dc17e441b61148ef273c84c89902b /CMPID=1113a
uRun: [Amazon Cloud Player] "c:\users\mary ann\appdata\local\amazon cloud player\Amazon Music Helper.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [UpdateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"
mRun: [UpdatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [UpdateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"
mRun: [UpdatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AVG_UI] "c:\program files\avg\avg2014\avgui.exe" /TRAYONLY
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - <orphaned>
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
TCP: NameServer = 192.168.2.1 24.229.54.212 216.144.187.199 204.186.80.229
TCP: Interfaces\{2B1F2E8F-3C9A-485F-9F8A-D41BE44E6BF3} : DHCPNameServer = 192.168.2.1 24.229.54.212 216.144.187.199 204.186.80.229
TCP: Interfaces\{A14EF26A-61FF-4731-9929-9797EAE1222D} : DHCPNameServer = 172.168.37.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\mary ann\appdata\roaming\mozilla\firefox\profiles\zni3qowh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/?ilc=1
FF - plugin: c:\program files\google\update\1.3.22.3\npGoogleUpdate3.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: c:\program files\worldwinner.com, inc\worldwinner games\npwwload.dll
FF - plugin: c:\users\mary ann\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\mary ann\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\mary ann\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_170.dll
FF - ExtSQL: !HIDDEN! 2009-08-14 10:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-10-24 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-10-31 222520]
R0 AvgMfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-10-1 102712]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [2013-11-5 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-11-4 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-9-17 22840]
R1 AvgLdx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-10-31 176952]
R1 AvgTdiX;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-8-1 193848]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2014\avgidsagent.exe [2013-11-11 3478544]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2014\avgwdsvc.exe [2013-9-24 348008]
R2 CFUACProxy_officeguardianv2n;CFUACProxy_officeguardianv2n;c:\programdata\officeguardianv2n\UACProxy.exe [2013-10-7 83792]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-6-2 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-5-23 701512]
R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2010-6-24 91456]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-25 365952]
R2 SacNetAgentService_C57C4F854F53;SacNetAgentService_C57C4F854F53;c:\programdata\officeguardianv2n\reminder\SacNetAgent.exe [2013-10-7 163664]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-25 193840]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-5-23 22856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 754856]
.
=============== Created Last 30 ================
.
2014-01-22 23:32:48   17248136   ----a-w-   c:\users\mary ann\install_flash_player_11_active_x.exe
.
==================== Find3M  ====================
.
2014-01-22 23:33:32   692616   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2014-01-22 23:33:31   71048   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-10 23:40:09   915368   ----a-w-   C:\jxpiinstall.exe
2013-11-14 22:50:50   1806848   ----a-w-   c:\windows\system32\jscript9.dll
2013-11-14 22:42:41   1129472   ----a-w-   c:\windows\system32\wininet.dll
2013-11-14 22:42:32   1427968   ----a-w-   c:\windows\system32\inetcpl.cpl
2013-11-14 22:38:54   142848   ----a-w-   c:\windows\system32\ieUnatt.exe
2013-11-14 22:38:16   420864   ----a-w-   c:\windows\system32\vbscript.dll
2013-11-14 22:35:52   2382848   ----a-w-   c:\windows\system32\mshtml.tlb
2013-11-06 02:50:48   120600   ----a-w-   c:\windows\system32\drivers\avgdiskx.sys
2013-11-05 02:57:30   209176   ----a-w-   c:\windows\system32\drivers\avgidsdriverx.sys
.
============= FINISH: 19:19:28.06 ===============
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 02, 2014, 04:40:46 PM
Yes, that is the log I was looking for.  Thank you. 

As there are no System Restore points shown in your log, I suggest you do that first.  In fact, before making any changes to your computer, whether installing or removing software, it is always a wise move to create a fresh restore point.  In case you are unsure how to do that, the steps are as follows:
After doing that, you can uninstall Juno Preloader and NetZero Preloader if you wish.

I'm not seeing anything in the logs that would explain the freezing problem you've had.  Does it happen with all browsers or one in particular.  Is it always the same sites, and, if so, which sites?  In the event the problem is with IE9, try visiting the site with Compatibility View:  Fix site display problems with Compatibility View (http://windows.microsoft.com/en-US/internet-explorer/use-compatibility-view#ie=ie-9)

Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 17, 2014, 03:04:46 AM
I created a restore point and removed Juno Preloader and Net Zero Preloader.  It seems as if I'm getting freeze up only when I'm on a site called Dump A Day.  Don't let your minds go in the toilet, it has to do with DIY and new products.  Starts out OK, but if I stay on it a while an go from page to page, eventually I'll get a freeze up.  Otherwise computer seems to be chugging along OK.  Need to do a MAB scan.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 17, 2014, 04:30:24 PM
Hi, Mare.

Are you using IE or Firefox when you visit the site? 

After you scan with Malwarebytes, please post the log.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 19, 2014, 04:10:15 PM
I use FF just about exclusively.  Here's the scan.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.19.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
mary ann :: MARYANN-PC [administrator]

2/18/2014 9:19:40 PM
MBAM-log-2014-02-19 (01-44-06).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 444833
Time elapsed: 3 hour(s), 4 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\mary ann\AppData\Local\temp\lpWIt9vh.exe.part (PUP.Optional.OptimumInstaller.A) -> No action taken.

(end)
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 19, 2014, 08:08:54 PM
QuoteFiles Detected: 1
C:\Users\mary ann\AppData\Local\temp\lpWIt9vh.exe.part (PUP.Optional.OptimumInstaller.A) -> No action taken.

You need to rescan with Malwarebytes and remove the above.  In checking your previous logs, it was not on your computer during earlier scans, although that was early in December.

After rescanning with MBAM and removing the above, please do the following:

Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/) to your desktop.

Note:  A few seconds after landing on the above link, depending on the browser you are using, you will see the following:
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 20, 2014, 12:46:32 AM
When the scan results, not log, came up after the scan, the "pup optional" came up as an object detected and I removed it with the MBAM.  I don't think that there was "Installer" after it.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 26, 2014, 04:44:15 PM
Having one freeze up after another this AM.  All seemed to be working well except for the freeze ups on the one site til now.  Help please.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 26, 2014, 07:49:28 PM
Please see my instructions above from February 19 to run the Junkware Removal Tool.

Thanks!
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 27, 2014, 05:06:44 AM
Ran the MBAM scan.  No threats detected.  Here's the log.

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.26.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
mary ann :: MARYANN-PC [administrator]

2/26/2014 6:40:58 PM
mbam-log-2014-02-26 (18-40-58).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 452686
Time elapsed: 5 hour(s), 14 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Title: Re: Compaq Laptop May Be Infected
Post by: winchester73 on February 27, 2014, 12:32:06 PM
You've only followed the first part of her instructions, she wants you to run another tool  :D

Here is the next step:


Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/) to your desktop.

Note:  A few seconds after landing on the above link, depending on the browser you are using, you will see the following:
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 27, 2014, 03:18:33 PM
Had every intention of running the JRT but the MBAM didn't finish till the wee hrs, my time, so I posted it and went to bed.  Did the JRT scan this AM.  Here's the log.

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by mary ann on Thu 02/27/2014 at 10:07:45.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{38EDDE75-9689-4887-95E5-13B31E4E2DCB}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5313b6d2-fb85-4978-b2c5-252172d315cd}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{60A4E56C-445B-47E9-8637-F329433B1DB3}
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\mary ann\appdata\locallow\oovootb"
Successfully deleted: [Folder] "C:\Program Files\coupons"



~~~ FireFox

Successfully deleted the following from C:\Users\mary ann\AppData\Roaming\mozilla\firefox\profiles\zni3qowh.default\prefs.js

user_pref("aim_toolbar.search.searchtype", "web");
Emptied folder: C:\Users\mary ann\AppData\Roaming\mozilla\firefox\profiles\zni3qowh.default\minidumps [136 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 02/27/2014 at 10:12:37.46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 27, 2014, 08:07:12 PM
From the MBAM log:
QuoteTime elapsed: 5 hour(s), 14 minute(s), 9 second(s)

It takes a long time to decompress archives to scan and then compress again.  It is only necessary to do a Quick Scan with Malwarebytes.  As Marcin, the founder of Malwarebytes, replied here (http://www.reddit.com/r/IAmA/comments/119cyf/iam_marcin_kleczynski_founder_and_ceo_of/c6kh0lv):

QuoteWe've designed the quick scan to detect everything. The full scan is there for people who won't believe us.



Quote from: mare_wbpa on February 26, 2014, 04:44:15 PM
Having one freeze up after another this AM.  All seemed to be working well except for the freeze ups on the one site til now.  Help please.

Going back to Firefox freezing, with the JRT log showing an accumulated 136 minidumps, although likely since the initial installation, that is still quite a few crashes.  After the removals by JRT, is it still crashing/freezing?

If Firefox continues to crash, I suggest going through the steps here:  Troubleshoot Firefox issues using Safe Mode | Firefox Help (https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode?redirectlocale=en-US&redirectslug=Safe+Mode).
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 28, 2014, 12:02:54 AM
Seemed to be working fine for a while.  Yesterday it would freeze up after only a minute or 2 online.  After the MBAB and JRT it seemed to be working fine, then started to freeze up again.  Went to the FF help page, it suggested to reset the FF to default before going thru other measures.  I did that, and right now it seems OK.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 28, 2014, 12:05:25 AM
BTW, I forgot to thank you for the info on doing the quick MBAM scan.  I'll keep that in mind next time I have to do MBAM.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 28, 2014, 01:58:56 AM
You're welcome.  A Quick Scan will certainly save you hours!  In fact, it would probably be a good idea for you to run a Quick Scan once a week. 

If resetting doesn't solve the problem, follow through with the other suggestions.  Let us know how you make out.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 28, 2014, 02:31:40 AM
Scanning weekly sounds like a good idea.  If it prevents problems it will save a lot of time in the long run.  Should I keep JRT or uninstall it.  Is it safe to do the JRT scan in the future should I have similar issues? 
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 28, 2014, 03:21:42 PM
Both JRT and AdwCleaner are regularly updated with new information provided by members of the security community.  As a result, it is important to always use the most recent version.  JRT has an auto-update feature.  It does NOT create backups of what was removed but it does backup the registry.  Conversely, AdwCleaner does not create a backup but does contain a quarantine file from which files can be dequarantined.  AdwCleaner will also prompt when an old version is run and redirect to the developer's home site (http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner).

Bottom line, yes, you can run JRT and/or AdwCleaner if you are comfortable running either or both utilities on your own.  However, we are always happy to provide guidance. 
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on February 28, 2014, 03:58:41 PM
Well, in that case, I'll contact you b 4 I do anything in the future.  I was just thinking about not always having to bother you.  You are so kind to do this for people like me.  I really, really appreciate you.
Title: Re: Compaq Laptop May Be Infected
Post by: Corrine on February 28, 2014, 08:21:32 PM
Trust me, it is absolutely NO bother!  That is what we are here for.   
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on March 03, 2014, 12:58:06 AM
You are so kind.  I'd be in big trouble without you.
Title: Re: Compaq Laptop May Be Infected
Post by: mare_wbpa on March 10, 2014, 12:24:54 AM
Had a couple of freeze ups, so I did a JRT scan.  Here's the log.

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by mary ann on Sun 03/09/2014 at 20:06:07.95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\mary ann\AppData\Roaming\mozilla\firefox\profiles\zni3qowh.default\minidumps [141 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 03/09/2014 at 20:11:38.99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Text only | Text with Images