Ps help remove 'Delta' from registry and system locations #?

genera8ion
New Helpee

Posts: 14

Ps help remove 'Delta' from registry and system locations #? Mar 2, 2014 10:57:08 GMT -8

Post by genera8ion on Mar 2, 2014 10:57:08 GMT -8

Dear Quads,

I have been infected with Delta. Apart from it redirecting my browsers (I can fix the in-browser settings) I'm concerned about it leaving other code behind in the registry etc. beyond reach of my computer literacy...

I've never used regedit before and don't want to make an error while blundering through there no knowing exactly what to look for.

I don't want to be keylogged or someone's bot-ch.

Can you pls help me?

Tks a million!

Last Edit: Apr 18, 2014 16:51:15 GMT -8 by Quads

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Ps help remove 'Delta' from registry and system locations #? Mar 2, 2014 13:48:36 GMT -8

Post by Quads on Mar 2, 2014 13:48:36 GMT -8

Do Not use advanced tools or any tools used on this board without supervision.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also if it is busy (have a lot of systems at once to deal with) like being in a supermarket checkout line, waiting their turn, I use the forum like a checkout line.

Quads

genera8ion New Helpee Posts: 14	Ps help remove 'Delta' from registry and system locations #? Mar 8, 2014 1:14:00 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by genera8ion on Mar 8, 2014 1:14:00 GMT -8 Thank you. I confirm that I have read your warning notice above. My system is running: Windows 7 Starter. SP1. 32 bit.

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Ps help remove 'Delta' from registry and system locations #? Mar 8, 2014 14:09:00 GMT -8

Post by Quads on Mar 8, 2014 14:09:00 GMT -8

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 32 bit version.

Place FRST.exe onto your desktop from where ever it downloaded to.

Start FRST that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)
Press Scan button.

It will make a logs (FRST.txt and addition.txt) on your Desktop Please attach the log in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply.

Quads

genera8ion
New Helpee

Posts: 14

Ps help remove 'Delta' from registry and system locations #? Mar 9, 2014 20:25:00 GMT -8

Post by genera8ion on Mar 9, 2014 20:25:00 GMT -8

Thanks Quads.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-03-2014 01

Ran by Liszelle (administrator) on LISZELLE-PC on 09-03-2014 20:00:06

Running from C:\Users\Liszelle\Desktop

Microsoft Windows 7 Starter Service Pack 1 (X86) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

==================== Processes (Whitelisted) =================

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe

(Acer Incorporated) C:\Program Files\Acer\Registration\GREGsvc.exe

(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.1.1.7\NIS.exe

(Livescribe) C:\Program Files\Common Files\Livescribe\PenComm\PenCommService.exe

(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe

(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.1.1.7\NIS.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe

(Intel Corporation) C:\Windows\system32\igfxext.exe

(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe

(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe

==================== Registry (Whitelisted) ==================

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {0979dbe5-8854-11e1-b94e-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {0979dbe7-8854-11e1-b94e-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {0979dbec-8854-11e1-b94e-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {166eaa2f-c748-11e1-b5a0-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {166eaa33-c748-11e1-b5a0-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {16df3b14-63bd-11e0-a8fc-806e6f6e6963} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {16df3b35-63bd-11e0-a8fc-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {20aa6069-55f5-11e0-b81c-0026c7a8da7c} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {20aa6072-55f5-11e0-b81c-1c7508223930} - F:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {20aa6111-55f5-11e0-b81c-001e101f859f} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {20aa6113-55f5-11e0-b81c-001e101f859f} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {20aa6114-55f5-11e0-b81c-001e101f859f} - F:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {2c09dea1-628a-11e0-b5c8-0026c7a8da7c} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {71114b21-ac89-11e1-b0ab-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {a825d6a1-6c6a-11e0-b898-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {ac24d6e5-884c-11e1-b2c5-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {ac24d6e9-884c-11e1-b2c5-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {c4063181-9c96-11e1-ae98-0026c7a8da7c} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {c4063184-9c96-11e1-ae98-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {c54acb58-4cce-11e1-b621-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {cd640afb-66da-11e0-b744-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {d49ef772-30c1-11e0-8af4-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {d49ef77a-30c1-11e0-8af4-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {d49ef77c-30c1-11e0-8af4-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {e0df6f28-c264-11e0-a47f-0026c7a8da7c} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {e0df6f2a-c264-11e0-a47f-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {e0df6f2d-c264-11e0-a47f-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {e8d80d07-30c3-11e0-aa96-1c7508223930} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {ebd0a3f3-3cd6-11e1-b775-001e101f36d9} - E:\AutoRun.exe

HKU\S-1-5-21-2066188107-2257231759-1798236243-1000\...\MountPoints2: {ebd0a3f7-3cd6-11e1-b775-1c7508223930} - E:\AutoRun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com.sa/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = acer.msn.com

URLSearchHook: HKCU - (No Name) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - No File

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}

SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=34720026C7A8DA7D&affID=119360&tt=060813_ctrl&tsp=4967

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}

BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.1.1.7\coIEPlg.dll (Symantec Corporation)

BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.1.1.7\IPS\IPSBHO.DLL (Symantec Corporation)

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.1.1.7\coIEPlg.dll (Symantec Corporation)

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} online.westpac.com.au/wtoa/wtOtherAccounts/portfoliomanagerwt.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0

FireFox:

========

FF ProfilePath: C:\Users\Liszelle\AppData\Roaming\Mozilla\Firefox\Profiles\60d3d1eu.default

FF Homepage: translate.google.com

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll ()

FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)

FF Plugin: @apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Liszelle\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Liszelle\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF SearchPlugin: C:\Users\Liszelle\AppData\Roaming\Mozilla\Firefox\Profiles\60d3d1eu.default\searchplugins\safesearch.xml

FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.1.7\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.1.7\IPSFF [2014-02-21]

FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.1.7\coFFPlgn\

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.1.7\coFFPlgn\ []

Chrome:

=======

CHR DefaultSearchKeyword: google.com.sa

CHR Extension: (Google Docs) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-20]

CHR Extension: (Google Drive) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-20]

CHR Extension: (YouTube) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-20]

CHR Extension: (Google Search) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-20]

CHR Extension: (Norton Identity Protection) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-02-20]

CHR Extension: (Google Wallet) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-20]

CHR Extension: (Gmail) - C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-20]

CHR HKLM\...\Chrome\Extension: [dednnpigldgdbpgcdpfppmlcnnbjciel] - C:\Users\Liszelle\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx [2014-02-20]

CHR HKLM\...\Chrome\Extension: [lpmkgpnbiojfaoklbkpfneikocaobfai] - C:\Users\Liszelle\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx [2014-02-20]

CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.1.1.7\Exts\Chrome.crx [2014-02-21]

CHR StartMenuInternet: Google Chrome - C:\Users\Liszelle\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64112 2014-01-08] (CyberGhost S.R.L)

R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-12] (Acer Incorporated)

R2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)

S3 MWLService; C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)

R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.1.1.7\NIS.exe [276376 2014-02-12] (Symantec Corporation)

R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)

R2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.1.7\Definitions\BASHDefs\20140214.001\BHDrvx86.sys [1098968 2014-02-14] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1501010.007\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)

R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2014-02-20] (Symantec Corporation)

R3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [109960 2010-04-13] (ELAN Microelectronic Corp.)

S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.)

R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.1.7\Definitions\IPSDefs\20140307.001\IDSvix86.sys [395992 2014-03-06] (Symantec Corporation)

R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [64304 2010-10-13] (McAfee, Inc.)

R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [18992 2009-06-03] (Egis Technology Inc.)

R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2009-06-03] (Egis Technology Inc.)

R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [60976 2009-06-03] (Egis Technology Inc.)

R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.1.7\Definitions\VirusDefs\20140308.007\NAVENG.SYS [93272 2014-02-20] (Symantec Corporation)

R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.1.7\Definitions\VirusDefs\20140308.007\NAVEX15.SYS [1612376 2014-02-20] (Symantec Corporation)

R3 SRTSP; C:\Windows\system32\drivers\NIS\1501010.007\SRTSP.SYS [664280 2014-02-11] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NIS\1501010.007\SRTSPX.SYS [32344 2014-02-11] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\NIS\1501010.007\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\NIS\1501010.007\SYMEFA.SYS [935512 2013-09-27] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2014-02-21] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NIS\1501010.007\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)

R1 SymNetS; C:\Windows\system32\drivers\NIS\1501010.007\SYMNETS.SYS [446552 2013-09-26] (Symantec Corporation)

R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [35288 2013-08-22] (The OpenVPN Project)

S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-09 20:00 - 2014-03-09 20:01 - 00016917 _____ () C:\Users\Liszelle\Desktop\FRST.txt

2014-03-09 19:59 - 2014-03-09 20:00 - 00000000 ____D () C:\FRST

2014-03-09 19:55 - 2014-03-09 19:54 - 01145344 _____ (Farbar) C:\Users\Liszelle\Desktop\FRST.exe

2014-03-09 19:52 - 2014-03-09 19:54 - 01145344 _____ (Farbar) C:\Users\Liszelle\Downloads\FRST.exe

2014-03-08 17:11 - 2014-03-08 17:12 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\{6FDFFBF2-D3DE-4893-A591-48D7820157B3}

2014-03-08 12:15 - 2014-03-08 12:15 - 00000197 _____ () C:\Users\Liszelle\Desktop\DELTA removal.url

2014-03-07 08:18 - 2014-03-07 08:18 - 00003288 ____N () C:\bootsqm.dat

2014-03-03 21:32 - 2014-03-09 19:35 - 00000000 ____D () C:\Users\Public\Documents\Saudi Arabia

2014-03-01 12:43 - 2014-03-01 12:47 - 100304152 _____ (Microsoft Corporation) C:\Users\Liszelle\Downloads\msert.exe

2014-03-01 12:28 - 2014-03-01 12:28 - 24793312 _____ (Microsoft Corporation) C:\Users\Liszelle\Downloads\Windows-KB890830-V5.9.exe

2014-03-01 09:29 - 2014-03-01 09:29 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\Skype

2014-03-01 09:28 - 2014-03-01 09:28 - 00000000 ___RD () C:\Program Files\Skype

2014-03-01 09:28 - 2014-03-01 09:28 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-03-01 09:01 - 2014-03-01 09:01 - 34829472 _____ (Skype Technologies S.A.) C:\Users\Liszelle\Downloads\SkypeSetupFull.exe

2014-02-28 14:10 - 2014-02-28 14:10 - 00910992 _____ (Symantec Corporation) C:\Users\Liszelle\Downloads\AutoDetectPkg.exe

2014-02-22 22:09 - 2014-02-22 22:09 - 00000000 ____D () C:\Program Files\iPod

2014-02-22 22:08 - 2014-02-22 22:10 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-02-22 22:08 - 2014-02-22 22:10 - 00000000 ____D () C:\Program Files\iTunes

2014-02-22 21:54 - 2014-02-22 21:54 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\CrashDumps

2014-02-22 19:06 - 2014-02-22 19:18 - 00000000 ____D () C:\Users\Liszelle\Documents\Seder

2014-02-21 10:48 - 2013-12-21 10:56 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-21 09:56 - 2014-02-21 09:58 - 00000000 ____D () C:\85d5d7074e319e5885ad9665501c

2014-02-21 09:36 - 2014-02-01 10:58 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-21 09:36 - 2014-02-01 10:57 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-21 09:36 - 2014-02-01 10:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-21 09:36 - 2014-02-01 10:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-21 09:36 - 2014-02-01 09:38 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2014-02-21 09:35 - 2014-02-01 10:58 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-21 09:35 - 2014-02-01 10:58 - 01140736 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-21 09:35 - 2014-02-01 10:57 - 14359040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-21 09:35 - 2014-02-01 10:57 - 13760512 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-21 09:35 - 2014-02-01 10:57 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-21 09:26 - 2014-02-21 09:26 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\{B67DF6A7-F2BC-40FF-8591-7ED54BF36663}

2014-02-21 00:12 - 2014-02-21 10:10 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-02-21 00:12 - 2014-02-21 00:12 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS

2014-02-21 00:12 - 2014-02-21 00:12 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT

2014-02-21 00:10 - 2014-02-21 00:10 - 00000000 ____D () C:\Windows\system32\Drivers\NIS

2014-02-21 00:10 - 2014-02-21 00:10 - 00000000 ____D () C:\Program Files\Norton Internet Security

2014-02-20 23:52 - 2014-02-20 23:52 - 00000000 ____D () C:\ProgramData\PCSettings

2014-02-20 23:39 - 2014-02-20 23:39 - 01021952 _____ (Symantec Corporation) C:\Users\Liszelle\Downloads\NISDownloader.exe

2014-02-20 23:39 - 2014-02-20 23:39 - 00000000 ____D () C:\Users\Public\Downloads\Norton

2014-02-20 22:57 - 2014-01-01 02:05 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-20 22:56 - 2013-12-25 02:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-20 22:56 - 2013-12-06 05:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-20 22:56 - 2013-12-06 05:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-20 22:56 - 2013-12-04 05:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-20 22:56 - 2013-12-04 05:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-20 22:56 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-20 22:56 - 2013-12-04 05:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-20 22:56 - 2013-12-04 05:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-20 22:56 - 2013-12-04 04:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-20 22:56 - 2013-12-04 04:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-20 22:56 - 2013-12-04 04:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-20 22:56 - 2013-12-04 04:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-20 22:56 - 2013-11-26 11:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-15 14:09 - 2013-12-18 06:13 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-02-15 13:12 - 2014-02-15 13:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-03-09 20:01 - 2014-03-09 20:00 - 00016917 _____ () C:\Users\Liszelle\Desktop\FRST.txt

2014-03-09 20:00 - 2014-03-09 19:59 - 00000000 ____D () C:\FRST

2014-03-09 19:54 - 2014-03-09 19:55 - 01145344 _____ (Farbar) C:\Users\Liszelle\Desktop\FRST.exe

2014-03-09 19:54 - 2014-03-09 19:52 - 01145344 _____ (Farbar) C:\Users\Liszelle\Downloads\FRST.exe

2014-03-09 19:40 - 2010-10-24 08:37 - 01622278 _____ () C:\Windows\WindowsUpdate.log

2014-03-09 19:35 - 2014-03-03 21:32 - 00000000 ____D () C:\Users\Public\Documents\Saudi Arabia

2014-03-09 19:30 - 2009-07-14 07:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-03-09 19:30 - 2009-07-14 07:34 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-03-09 19:23 - 2009-07-14 07:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-03-09 19:23 - 2009-07-14 07:39 - 00105242 _____ () C:\Windows\setupact.log

2014-03-08 21:21 - 2012-02-05 15:50 - 00000000 ____D () C:\Users\Liszelle\AppData\Roaming\vlc

2014-03-08 21:17 - 2012-05-06 12:35 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000UA.job

2014-03-08 21:12 - 2013-02-07 16:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-03-08 20:17 - 2012-05-06 12:35 - 00000868 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000Core.job

2014-03-08 17:12 - 2014-03-08 17:11 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\{6FDFFBF2-D3DE-4893-A591-48D7820157B3}

2014-03-08 12:15 - 2014-03-08 12:15 - 00000197 _____ () C:\Users\Liszelle\Desktop\DELTA removal.url

2014-03-07 21:32 - 2010-09-17 11:53 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-03-07 08:18 - 2014-03-07 08:18 - 00003288 ____N () C:\bootsqm.dat

2014-03-04 21:19 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-03-01 18:03 - 2013-06-10 10:59 - 00000000 ____D () C:\Users\Liszelle\Documents\DAN

2014-03-01 12:47 - 2014-03-01 12:43 - 100304152 _____ (Microsoft Corporation) C:\Users\Liszelle\Downloads\msert.exe

2014-03-01 12:28 - 2014-03-01 12:28 - 24793312 _____ (Microsoft Corporation) C:\Users\Liszelle\Downloads\Windows-KB890830-V5.9.exe

2014-03-01 10:54 - 2010-10-24 08:34 - 01547356 _____ () C:\Windows\PFRO.log

2014-03-01 09:32 - 2012-04-17 09:24 - 00000000 ____D () C:\Users\Liszelle\AppData\Roaming\Skype

2014-03-01 09:29 - 2014-03-01 09:29 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\Skype

2014-03-01 09:28 - 2014-03-01 09:28 - 00000000 ___RD () C:\Program Files\Skype

2014-03-01 09:28 - 2014-03-01 09:28 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-03-01 09:28 - 2012-04-17 09:23 - 00000000 ____D () C:\ProgramData\Skype

2014-03-01 09:01 - 2014-03-01 09:01 - 34829472 _____ (Skype Technologies S.A.) C:\Users\Liszelle\Downloads\SkypeSetupFull.exe

2014-02-28 14:10 - 2014-02-28 14:10 - 00910992 _____ (Symantec Corporation) C:\Users\Liszelle\Downloads\AutoDetectPkg.exe

2014-02-22 22:10 - 2014-02-22 22:08 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-02-22 22:10 - 2014-02-22 22:08 - 00000000 ____D () C:\Program Files\iTunes

2014-02-22 22:09 - 2014-02-22 22:09 - 00000000 ____D () C:\Program Files\iPod

2014-02-22 22:09 - 2011-02-06 05:50 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-02-22 21:58 - 2011-02-06 05:50 - 00000000 ____D () C:\ProgramData\Apple

2014-02-22 21:54 - 2014-02-22 21:54 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\CrashDumps

2014-02-22 19:18 - 2014-02-22 19:06 - 00000000 ____D () C:\Users\Liszelle\Documents\Seder

2014-02-21 10:10 - 2014-02-21 00:12 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared

2014-02-21 09:59 - 2013-07-27 07:45 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-21 09:58 - 2014-02-21 09:56 - 00000000 ____D () C:\85d5d7074e319e5885ad9665501c

2014-02-21 09:26 - 2014-02-21 09:26 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\{B67DF6A7-F2BC-40FF-8591-7ED54BF36663}

2014-02-21 09:26 - 2011-05-02 09:05 - 00000000 ____D () C:\Users\Liszelle\AppData\Local\Windows Live

2014-02-21 00:20 - 2013-12-03 14:44 - 00000000 ____D () C:\Users\Liszelle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton

2014-02-21 00:20 - 2013-12-03 14:44 - 00000000 ____D () C:\ProgramData\Norton

2014-02-21 00:15 - 2013-02-07 16:05 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-02-21 00:15 - 2013-02-07 16:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-02-21 00:12 - 2014-02-21 00:12 - 00142936 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS

2014-02-21 00:12 - 2014-02-21 00:12 - 00008194 _____ () C:\Windows\system32\Drivers\SYMEVENT.CAT

2014-02-21 00:10 - 2014-02-21 00:10 - 00000000 ____D () C:\Windows\system32\Drivers\NIS

2014-02-21 00:10 - 2014-02-21 00:10 - 00000000 ____D () C:\Program Files\Norton Internet Security

2014-02-20 23:52 - 2014-02-20 23:52 - 00000000 ____D () C:\ProgramData\PCSettings

2014-02-20 23:39 - 2014-02-20 23:39 - 01021952 _____ (Symantec Corporation) C:\Users\Liszelle\Downloads\NISDownloader.exe

2014-02-20 23:39 - 2014-02-20 23:39 - 00000000 ____D () C:\Users\Public\Downloads\Norton

2014-02-20 22:14 - 2010-09-17 12:24 - 00000000 ____D () C:\Program Files\Acer GameZone

2014-02-17 08:15 - 2013-08-07 06:41 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-02-15 13:12 - 2014-02-15 13:12 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-02-07 23:27 - 2014-01-06 22:21 - 00000000 ____D () C:\Program Files\CyberGhost 5

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\system32\winlogon.exe => MD5 is legit

C:\Windows\system32\wininit.exe => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\services.exe => MD5 is legit

C:\Windows\system32\User32.dll => MD5 is legit

C:\Windows\system32\userinit.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit

C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 08-03-2014 01

Ran by Liszelle at 2014-03-09 20:02:34

Running from C:\Users\Liszelle\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}

AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

µTorrent (HKLM\...\uTorrent) (Version: 3.1.2 - )

3 Mobile Broadband (HKLM\...\{3EAAC5FD-E209-4856-8C49-D4EA40F85032}) (Version: 1.00.0000 - 3 Mobile)

Acer Crystal Eye webcam Ver:1.1.192.810 (HKLM\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.192.810 - Chicony Electronics Co.,Ltd.)

Acer ePower Management (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated)

Acer eRecovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)

Acer Registration (HKLM\...\Acer Registration) (Version: 1.03.3003 - Acer Incorporated)

Acer ScreenSaver (HKLM\...\Acer Screensaver) (Version: 1.1.0830.2010 - Acer Incorporated)

Acer Updater (HKLM\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)

Acer VCM (HKLM\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3002 - Acer Incorporated)

Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe Acrobat 5.0 (HKLM\...\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)

Adobe AIR (Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden

Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)

Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)

AndroidInstaller (Version: 1.00.022 - Insyde) Hidden

Apple Application Support (HKLM\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.35 - Atheros Communications Inc.)

Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)

Bonjour Print Services (HKLM\...\{9D210D79-AEC5-453B-960C-4DD2C73931E1}) (Version: 2.0.2.0 - Apple Inc.)

CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version: - CyberGhost S.R.L.)

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

Dropbox (HKCU\...\Dropbox) (Version: 1.2.52 - Dropbox, Inc.)

EndNote X6 (HKLM\...\{86B3F2D6-AC2B-0016-8AE1-F2F77F781B0C}) (Version: 16.0.1.6599 - Thomson Reuters)

ENE USB Card Reader Driver (HKLM\...\3B29FD3CCF1F5B855DA0C521597413EBABE97DFB) (Version: 5.89.0.70 - ENE)

eSobi v2 (HKLM\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)

eSobi v2 (Version: 2.0.4.000274 - esobi Inc.) Hidden

e-tax 2013 (HKLM\...\{FFF14233-FE39-4671-A38E-76FD8F24A879}) (Version: 0.10.558 - Australian Taxation Office)

ETDWare PS/2-x86 7.0.6.5_WHQL (HKLM\...\Elantech) (Version: 7.0.6.5 - ELAN Microelectronics Corp.)

Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.146 - Google Inc.)

Google Update Helper (Version: 1.3.21.165 - Google Inc.) Hidden

iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)

Identity Card (HKLM\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)

iFunbox (v2.6.2375.747), iFunbox DevTeam (HKLM\...\iFunbox_is1) (Version: v2.6.2375.747 - )

iLivid (HKLM\...\iLivid) (Version: 1.92.0.118480 - Bandoo Media Inc.) <==== ATTENTION

iLivid (Version: 1.92.0.118480 - Bandoo Media Inc.) Hidden <==== ATTENTION

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.4.1002 - Intel Corporation)

iTunes (HKLM\...\{C4780F70-8F21-4F0C-95FE-32FF3E2F9247}) (Version: 11.1.4.62 - Apple Inc.)

Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Launch Manager (HKLM\...\LManager) (Version: 4.0.14 - Acer Inc.)

Livescribe Desktop (HKLM\...\LivescribeDesktop) (Version: 2.3.4 - Livescribe Inc.)

Livescribe Desktop (Version: 2.3.4 - Livescribe Inc.) Hidden

Livescribe Desktop Documentation (Version: 1.3 - Livescribe Inc.) Hidden

Livescribe Desktop Print Your Own Paper (Version: 1.3 - Livescribe Inc.) Hidden

Livescribe Desktop Vision Objects Elements (Version: 1.3 - Livescribe Inc.) Hidden

Livescribe Smartpen Driver (Version: 1.3 - Livescribe Inc.) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden

Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)

Microsoft Mouse and Keyboard Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden

Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden

Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mozilla Firefox 27.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 27.0.1 (x86 en-US)) (Version: 27.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)

MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden

MyWinLocker (Version: 3.1.212.0 - Egis Technology Inc.) Hidden

MyWinLocker Suite (HKLM\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.)

MyWinLocker Suite (Version: 3.1.212.0 - Egis Technology Inc.) Hidden

Norton Internet Security (HKLM\...\NIS) (Version: 21.1.1.7 - Symantec Corporation)

PrimoPDF -- brought to you by Nitro PDF Software (HKLM\...\PrimoPDF) (Version: 5 - Nitro PDF Software)

QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6171 - Realtek Semiconductor Corp.)

ResearchSoft Direct Export Helper (HKLM\...\ResearchSoft Direct Export Helper) (Version: - )

Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden

Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)

swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)

Update for Microsoft Office Access 2007 Help (KB963663) (HKLM\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version: - Microsoft)

Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft)

Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version: - Microsoft)

Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version: - Microsoft)

Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version: - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{128A5449-CF71-4DA4-A746-F49E3B5DB584}) (Version: - Microsoft)

Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft)

Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version: - Microsoft)

Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)

Update for Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft)

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)

Welcome Center (HKLM\...\Acer Welcome Center) (Version: 1.02.3004 - Acer Incorporated)

Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden

Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)

Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points =========================

03-02-2014 18:39:39 Windows Update

14-02-2014 09:00:10 Scheduled Checkpoint

15-02-2014 11:07:49 Windows Update

20-02-2014 19:34:57 Windows Update

20-02-2014 20:31:25 Removed Norton Online Backup

21-02-2014 06:31:44 Windows Update

21-02-2014 07:12:34 Windows Update

21-02-2014 08:15:03 Windows Update

22-02-2014 15:51:59 Windows Update

01-03-2014 07:31:56 Windows Update

04-03-2014 04:34:16 Windows Update

==================== Hosts content: ==========================

2009-07-14 05:04 - 2009-06-11 00:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {27D696C4-9838-44C2-894F-F35064E66301} - System32\Tasks\5017 => Wscript.exe C:\Users\Liszelle\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION

Task: {2AA0C78A-C8B1-4CC9-9A14-DFBE14A855DB} - System32\Tasks\{1594636E-0E88-47CC-A6DF-7F39FAE3E317} => Iexplore.exe ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1618

Task: {3A4917C6-0880-4E92-A71C-1AA25B771CE2} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION

Task: {3F5F42E7-663A-49F6-852A-DC352D3CB44B} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)

Task: {5087D964-5614-4239-B0CC-221D9A45C9A6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000UA => C:\Users\Liszelle\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-17] (Google Inc.)

Task: {60F5843C-4F05-4ED7-91EB-11A58775D6D2} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)

Task: {620F8E87-11D1-4B81-BD67-02C55B5A5B82} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

Task: {968ECDD1-25D5-4481-9EE7-0CF98981612B} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.1.1.7\SymErr.exe [2013-08-02] (Symantec Corporation)

Task: {C09584A5-552C-4BAB-9FD2-468DF96D5E67} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000Core => C:\Users\Liszelle\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-17] (Google Inc.)

Task: {C84C6572-185E-4E51-9E90-CA20E8186ABC} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.1.1.7\WSCStub.exe [2014-02-12] (Symantec Corporation)

Task: {D0704083-6FA0-4A9B-B1BC-63D91EAF3F09} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21] (Adobe Systems Incorporated)

Task: {E426BCC6-CAF7-4B82-BCC4-70EF1DF463A7} - System32\Tasks\{6D43A05F-2720-439A-A1F3-C29797AB700D} => Iexplore.exe www.skype.com/go/downloading?source=lightinstaller&ver=4.1.0.179.367&LastError=404

Task: {F07410D4-E85A-4933-943B-C53B54C76086} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

Task: {F2EE37B1-4934-4332-AC15-59C7468F2674} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)

Task: {F34A1004-EEF3-431D-B7CD-A0DC42E00F9B} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.1.1.7\SymErr.exe [2013-08-02] (Symantec Corporation)

Task: {F9BE4A18-570B-4515-8FB4-17A2ACDCAD93} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000Core.job => C:\Users\Liszelle\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2066188107-2257231759-1798236243-1000UA.job => C:\Users\Liszelle\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-10-22 16:43 - 2011-03-01 01:37 - 00180624 _____ () C:\Windows\System32\Primomonnt.dll

2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2010-12-29 08:50 - 2010-12-29 08:50 - 00260608 _____ () C:\Program Files\Common Files\Livescribe\PenComm\PenCommSdk.dll

2014-02-22 20:33 - 2014-02-22 20:33 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\2b6cfcda2d134768a7313df94cfcc1ee\IsdiInterop.ni.dll

2010-09-17 12:12 - 2010-06-08 20:44 - 00058880 _____ () C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk => C:\Windows\pss\Acer VCM.lnk.CommonStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: AndroidManager => C:\Program Files\Acer\Android Manager\AML.exe

MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: EgisTecPMMUpdate => "C:\Program Files\EgisTec IPS\PmmUpdate.exe"

MSCONFIG\startupreg: EgisUpdate => "C:\Program Files\EgisTec IPS\EgisUpdate.exe" -d

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: iSyncData => C:\Program Files\Acer\Android Manager\iSync.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: LManager => C:\Program Files\Launch Manager\LManager.exe

MSCONFIG\startupreg: mwlDaemon => C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe

MSCONFIG\startupreg: Norton Online Backup => C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: SuiteTray => "C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (03/04/2014 11:45:57 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 15007

Error: (03/04/2014 11:45:57 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 15007

Error: (03/04/2014 11:45:57 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/04/2014 11:45:56 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 13946

Error: (03/04/2014 11:45:56 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 13946

Error: (03/04/2014 11:45:56 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/04/2014 11:45:55 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 12948

Error: (03/04/2014 11:45:55 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 12948

Error: (03/04/2014 11:45:55 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/04/2014 11:45:54 PM) (Source: Bonjour Service) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 11918

System errors:

=============

Error: (03/09/2014 07:23:34 PM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/08/2014 04:49:24 PM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/08/2014 09:43:38 AM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/07/2014 09:21:32 PM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/07/2014 08:20:06 AM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/07/2014 08:19:37 AM) (Source: EventLog) (User: )

Description: The previous system shutdown at 7:53:45 AM on ‎6/‎03/‎2014 was unexpected.

Error: (03/06/2014 07:14:58 AM) (Source: Service Control Manager) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (03/06/2014 07:14:27 AM) (Source: EventLog) (User: )

Description: The previous system shutdown at 7:54:19 AM on ‎5/‎03/‎2014 was unexpected.

Error: (03/05/2014 07:20:50 AM) (Source: Service Control Manager) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (03/04/2014 10:22:30 PM) (Source: Service Control Manager) (User: )

Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Microsoft Office Sessions:

=========================

Rgs,
Genera8ion

Last Edit: Mar 9, 2014 21:15:53 GMT -8 by Quads

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Ps help remove 'Delta' from registry and system locations #? Mar 9, 2014 21:50:05 GMT -8

Post by Quads on Mar 9, 2014 21:50:05 GMT -8

More than one PUP and other objects to deal with piece by piece

You may want to read carefully all of this message first before starting the steps.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the script attached, needs to be the same file name as well (fixlist.txt), have it on the Desktop, so that fixlist.txt is next to FRST.exe,

DO NOT DRAG AND DROP to download the script, it won't work for FRST (Right click on the attachment link (not the normal left click) and from the menu choose Save As or Save Link as.)

The script tells FRST what to do.

Start FRST that is on the desktop
When the tool opens click Yes to disclaimer. (if it still does)

Press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) please post it to your reply (attach or paste)

Quads

genera8ion
New Helpee

Posts: 14

Ps help remove 'Delta' from registry and system locations #? Mar 10, 2014 12:25:05 GMT -8

Post by genera8ion on Mar 10, 2014 12:25:05 GMT -8

Ok Quads, ran script as instructed. Log below.
Rgs,Genera8ion.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-03-2014 01
Ran by Liszelle at 2014-03-10 23:19:18 Run:1
Running from C:\Users\Liszelle\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
URLSearchHook: HKCU - (No Name) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=34720026C7A8DA7D&affID=119360&tt=060813_ctrl&tsp=4967
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms}
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
Task: {27D696C4-9838-44C2-894F-F35064E66301} - System32\Tasks\5017 => Wscript.exe C:\Users\Liszelle\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {3A4917C6-0880-4E92-A71C-1AA25B771CE2} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
end
*****************

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} => Key deleted successfully.
HKCR\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{27D696C4-9838-44C2-894F-F35064E66301} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{27D696C4-9838-44C2-894F-F35064E66301} => Key deleted successfully.
C:\Windows\System32\Tasks\5017 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\5017 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3A4917C6-0880-4E92-A71C-1AA25B771CE2} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A4917C6-0880-4E92-A71C-1AA25B771CE2} => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => Key deleted successfully.

==== End of Fixlog ====

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Ps help remove 'Delta' from registry and system locations #? Mar 10, 2014 18:12:22 GMT -8

Post by Quads on Mar 10, 2014 18:12:22 GMT -8

Read carefully

Download Adwcleaner www.bleepingcomputer.com/download/adwcleaner/ on to your desktop

The Blue

Download Now
@bleeping Computer

button and run a scan (Scan Button). It will create a log after. Or there is a Report button,

ONE SCAN ONLY

Attach or paste the log back here

Quads

genera8ion
New Helpee

Posts: 14

Ps help remove 'Delta' from registry and system locations #? Mar 10, 2014 20:27:46 GMT -8

Post by genera8ion on Mar 10, 2014 20:27:46 GMT -8

Ok tks Quads. Done that....>

# AdwCleaner v3.021 - Report created 11/03/2014 at 07:11:48
# Updated 10/03/2014 by Xplode
# Operating System : Windows 7 Starter Service Pack 1 (32 bits)
# Username : Liszelle - LISZELLE-PC
# Running from : C:\Users\Liszelle\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\Users\Liszelle\AppData\Roaming\Mozilla\Firefox\Profiles\60d3d1eu.default

\searchplugins\safesearch.xml
Folder Found C:\Program Files\iLivid
Folder Found C:\ProgramData\Babylon
Folder Found C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid
Folder Found C:\ProgramData\Registry Helper
Folder Found C:\Users\Liszelle\AppData\Local\PackageAware
Folder Found C:\Users\Liszelle\AppData\LocalLow\searchquband
Folder Found C:\Users\Liszelle\AppData\LocalLow\Searchqutoolbar
Folder Found C:\Users\Liszelle\AppData\Roaming\Babylon

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\AppDataLow\Software\searchqutoolbar
Key Found : HKCU\Software\BabSolution
Key Found : HKCU\Software\Cr_Installer
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\Delta
Key Found : HKCU\Software\FLEXnet
Key Found : HKCU\Software\ilivid
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E38FA08E-F56A-

4169-ABF5-5C71E3C153A1}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-

9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-

B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E38FA08E-F56A-4169-

ABF5-5C71E3C153A1}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\ilivid
Key Found : HKLM\Software\Classes\Installer\Features\2B1E51D87B2D71A44BB42DDD5E894160
Key Found : HKLM\Software\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160
Key Found : HKLM\SOFTWARE\Classes\Prod.cap
Key Found : HKLM\Software\Delta
Key Found : HKLM\Software\Freeze.com
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
Key Found : HKLM\Software\ilivid
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-

player_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-

player_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-

4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-

11D2-892F-0090271D4F88}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Components\08121C32A9C319F4CB0C11FF059552A4
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Products\2B1E51D87B2D71A44BB42DDD5E894160
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8D15E1B2-D2B7-4A17-

B44B-D2DDE5981406}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ilivid
Key Found : HKLM\Software\systweak
Value Found : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow

[*.crossrider.com]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow

[*.crossrider.com]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16798

-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Liszelle\AppData\Roaming\Mozilla\Firefox\Profiles\60d3d1eu.default

\prefs.js ]

-\\ Google Chrome v

[ File : C:\Users\Liszelle\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [5118 octets] - [11/03/2014 07:11:48]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5178 octets] ##########

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Ps help remove 'Delta' from registry and system locations #? Mar 10, 2014 22:21:47 GMT -8

Post by Quads on Mar 10, 2014 22:21:47 GMT -8

I have checked your log,

a) Click the Scan Button and wait for the scan to finish, (If Adwcleaner has been left open at the finish of the scan this is already done).

b) Make sure in your case all the items under each TAB are ticked / checked then.

c) Click the Clean Button and Adwcleaner will process all the items ticked / checked and then may ask for the system to be restarted.

d) It should create a new log afterwards (with S0 in the name).

Here is a Screenshot example

http://community.norton.com/t5/image/serverpage/image-id/40743i88953CBAC510F6CF/image-size/original?v=mpbl-1&px=-1

Quads

Ps help remove 'Delta' from registry and system locations #?

Post by genera8ion on Mar 2, 2014 10:57:08 GMT -8

Post by Quads on Mar 2, 2014 13:48:36 GMT -8

Post by genera8ion on Mar 8, 2014 1:14:00 GMT -8

Post by Quads on Mar 8, 2014 14:09:00 GMT -8

Post by genera8ion on Mar 9, 2014 20:25:00 GMT -8

Post by Quads on Mar 9, 2014 21:50:05 GMT -8

Post by genera8ion on Mar 10, 2014 12:25:05 GMT -8

Post by Quads on Mar 10, 2014 18:12:22 GMT -8

Post by genera8ion on Mar 10, 2014 20:27:46 GMT -8

Post by Quads on Mar 10, 2014 22:21:47 GMT -8