achesoj

Member
  • Content count

    9
  • Joined

  • Last visited

Community Reputation

0 Neutral

About achesoj

  • Rank
    New Member
  1. sorry about the delay again. The receptionist has forgotten to allow access to the computer the last couple of nights.
  2. Never mind. I see the instructions.
  3. I won't be able to get back on that system until Monday. I will do as you've asked then. Sorry about the pasting. I didn't see a way to attach the files. I'm assuming I use My Media?
  4. The computer is running XP. But just out of curiosity, why is hijackthis not good for windows 7? I didn't get an extras file for some reason. I searched the system for it, but nothing there. Sorry about that. I know that at least one of these logs may seem useless right now, but I might have some more questions once we get the first issue taken care of if you don't mind. thank you for your help. OTL logfile created on: 7/18/2012 7:39:14 PM - Run 2 OTL by OldTimer - Version 3.2.54.0 Folder = C:\Program Files Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 750.73 Mb Total Physical Memory | 439.49 Mb Available Physical Memory | 58.54% Memory free 1.17 Gb Paging File | 0.60 Gb Available in Paging File | 51.50% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 37.27 Gb Total Space | 19.15 Gb Free Space | 51.39% Space Free | Partition Type: NTFS Computer Name: FRONTDESK1 | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Program Files\OTL.exe (OldTimer Tools) PRC - C:\Program Files\WebVaccine\a2service.exe (Emsisoft GmbH) PRC - C:\Program Files\WebVaccine\a2guard.exe (Emsisoft GmbH) PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask) PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopConnect.exe (CrossLoop) PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopService.exe (CrossLoop) PRC - C:\Program Files\FastAttach\NEA\NEATaskbar.exe () PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop vnserver.exe (GlavSoft LLC.) PRC - C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\EagleSoft\Shared Files\esinetconnect.exe (Patterson Dental Supply, Inc.) PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Modules (No Company Name) ========== MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\e70343406253e43964f9fe1f42cfbd7c\System.Web.Services.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01abbadafaf265d9f4ac9bbb247acb98\System.Windows.Forms.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86f2038209a4cf0d0f5b30f6375c9b2\System.Drawing.ni.dll () MOD - C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\12c6fe8d4dd78f9bddf847d3b2821c03\System.Data.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll () MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll () MOD - C:\Program Files\FastAttach\NEA\NEATaskbar.exe () MOD - C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\screenhooks.dll () ========== Win32 Services (SafeList) ========== SRV - (OneStep Search Service) -- C:\Program Files\OneStepSearch\onestep.exe C:\Program Files\OneStepSearch\onestep.dll Service File not found SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (a2AntiMalware) -- C:\Program Files\WebVaccine\a2service.exe (Emsisoft GmbH) SRV - (CrossLoopService) -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopService.exe (CrossLoop) SRV - (tvnserver) -- C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop vnserver.exe (GlavSoft LLC.) SRV - (ESCameraService) -- C:\Program Files\EagleSoft\Shared Files\ESCameraService.exe () SRV - (NetSvc) -- c:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation) SRV - (SoundMAX Agent Service (default)) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Driver Services (SafeList) ========== DRV - (WDICA) -- File not found DRV - (SetupNTGLM7X) -- D:\NTGLM7X.sys File not found DRV - (PDRFRAME) -- File not found DRV - (PDRELI) -- File not found DRV - (PDFRAME) -- File not found DRV - (PDCOMP) -- File not found DRV - (PCIDump) -- File not found DRV - (NTACCESS) -- D:\NTACCESS.sys File not found DRV - (MtxVideo) -- System32\DRIVERS\MtxVideo.sys File not found DRV - (lbrtfdc) -- File not found DRV - (i2omgmt) -- File not found DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found DRV - (Changer) -- File not found DRV - (a2acc) -- C:\Program Files\WebVaccine\a2accx86.sys (Emsisoft GmbH) DRV - (a2injectiondriver) -- C:\Program Files\WebVaccine\a2dix86.sys (Emsisoft GmbH) DRV - (A2DDA) -- C:\Program Files\WebVaccine\a2ddax86.sys (Emsi Software GmbH) DRV - (a2util) -- C:\Program Files\WebVaccine\a2util32.sys (Emsi Software GmbH) DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation) DRV - (SMBios) Intel ® -- C:\WINDOWS\system32\drivers\SMBios.sys (Intel Corporation) DRV - (sf) -- C:\WINDOWS\system32\drivers\sf.sys (Sonic Focus, Inc) DRV - (Winachcf) -- C:\WINDOWS\system32\drivers\winachcf.sys (Conexant) DRV - (NAL) -- C:\WINDOWS\system32\drivers\iqvw32.sys (Intel Corporation ) DRV - (MidiSyn) -- C:\WINDOWS\system32\drivers\MidiSyn.sys (Analog Devices Inc) DRV - (ha10kx2k) -- C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd) DRV - (emupia) -- C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd) DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV - (ctprxy2k) -- C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd) DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV - (ctaud2k) Creative Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd) DRV - (ctac32k) -- C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd) DRV - (HCF_MSFT) -- C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant) DRV - (ctljystk) -- C:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.coupons.com/ IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/customize/ie/defaults/cs/ymsgr/*http://www.yahoo.com/ext/search/search.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{5B4C3B43-49B6-42A7-A602-F7ACDCA0D409}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP120&keywords={searchTerms} IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = My Web Search IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultUrl = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZU&fl=0&ptb=mbRz1VNEPq5jk42o1lZw8A&url=http://edits.mywebsearch.com/toolbaredits/barsearch.jhtml&st=sb&searchfor={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) IE - HKCU\..\SearchScopes,DefaultScope = {009605E6-56DA-4A38-AABE-0C0A11FBD902} IE - HKCU\..\SearchScopes\{009605E6-56DA-4A38-AABE-0C0A11FBD902}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7ADRA_enUS370 IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{30F66AB5-2ECC-46B0-98C5-D9AC743C11B4}: "URL" = http://www.bing.com/search?FORM=WE2TDF&PC=WEAC&q={searchTerms}&src=IE-SearchBox IE - HKCU\..\SearchScopes\{5B4C3B43-49B6-42A7-A602-F7ACDCA0D409}: "URL" = http://www.onestepsearch.net/?prt=OSFREEZ118&keywords={searchTerms} IE - HKCU\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://search.coupons.com/search.asp?p=df&q={searchTerms} IE - HKCU\..\SearchScopes\{ABCBF769-A765-4F25-AF2C-1EC2A900E895}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=833A9D8A-BD31-4434-AF5E-74D46FAD96D3&apn_sauid=1D79BBF6-4356-41EF-888A-36C96D04CC83 IE - HKCU\..\SearchScopes\{E5F5D888-2587-E012-A817-7038F5690F26}: "URL" = http://bing.zugo.com/s/?q={searchTerms}&iesrc=IE-SearchBox&site=Bing&cfg=2-114-0-1HCVK IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.) O1 HOSTS File: ([2005/07/29 14:39:44 | 000,000,023 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (TBSB07898 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Coupons.com CouponBar bcore3.dll File not found O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found. O3 - HKLM\..\Toolbar: (Coupons.com CouponBar) - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - C:\Program Files\Coupons.com CouponBar bcore3.dll File not found O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Coupons.com CouponBar) - {8660E5B3-6C41-44DE-8503-98D99BBECD41} - C:\Program Files\Coupons.com CouponBar bcore3.dll File not found O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE (Creative Technology Ltd.) O4 - HKLM..\Run: [emsisoft anti-malware] c:\program files\webvaccine\a2guard.exe (Emsisoft GmbH) O4 - HKLM..\Run: [ESInetConnect] C:\Program Files\EagleSoft\Shared Files\esinetconnect.exe (Patterson Dental Supply, Inc.) O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE (MyWebSearch.com) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [tvncontrol] C:\Program Files\ShowMyPCService vnserver.exe (GlavSoft LLC.) O4 - HKCU..\Run: [CrossLoop] C:\Documents and Settings\Administrator\Local Settings\Application Data\CrossLoop\CrossLoopConnect.exe (CrossLoop) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FA Reminder.lnk = C:\WINDOWS\Installer\{76DFE172-9A45-4A05-B9F1-22AD72C92277}\_166C426944DFE1D3967B3B.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = _ [binary data] O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZU File not found O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173736256921 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1173736244187 (MUWebControl Class) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37889.2941319444 (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://pattersonsupport.webex.com/client/T25L/support/ieatgpc.cab (GpcContainer Class) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool) O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=722 (Performance Viewer Activex Control) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{90729DE9-C962-4C64-B7DC-CBFE5060F61F}: NameServer = 192.168.1.1 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\RelevantKnowledge: DllName - (C:\Program Files\RelevantKnowledge\rlls.dll) - File not found O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003/06/14 03:57:29 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{c345955a-8e04-11e1-beb4-0002b3d10eb9}\Shell - "" = AutoRun O33 - MountPoints2\{c345955a-8e04-11e1-beb4-0002b3d10eb9}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c345955a-8e04-11e1-beb4-0002b3d10eb9}\Shell\AutoRun\command - "" = E:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012/07/18 19:37:28 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Program Files\OTL.exe [2012/07/16 18:45:28 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2012/07/16 18:45:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis [2012/07/12 13:14:56 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix [2012/07/12 13:14:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2012/06/26 16:34:32 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com [2012/06/26 16:34:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\AskToolbar [2012/06/26 16:24:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012/06/26 16:24:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ask [2012/06/26 16:23:54 | 000,476,936 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\npdeployJava1.dll [2012/06/26 16:23:54 | 000,157,448 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2012/06/26 16:23:54 | 000,149,256 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2012/06/26 16:23:54 | 000,149,256 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2012/06/26 16:23:54 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2012/06/26 16:23:20 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012/06/19 18:36:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\PCHealth [2012/06/18 20:36:28 | 000,000,000 | ---D | C] -- C:\_OTL [2009/01/07 17:34:57 | 000,036,864 | ---- | C] (WebEx Communications, Inc) -- C:\Documents and Settings\Administrator\atwbxdet.dll [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Administrator\*.tmp files -> C:\Documents and Settings\Administrator\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/07/18 19:45:01 | 000,000,250 | ---- | M] () -- C:\WINDOWS asks\Scheduled Update for Ask Toolbar.job [2012/07/18 19:37:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Program Files\OTL.exe [2012/07/18 19:30:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS asks\Adobe Flash Player Updater.job [2012/07/18 18:51:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS asks\GoogleUpdateTaskMachineUA.job [2012/07/18 13:51:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS asks\GoogleUpdateTaskMachineCore.job [2012/07/17 07:29:58 | 000,002,453 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Payment Browser.lnk [2012/07/16 18:46:27 | 000,010,568 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\hijackthis log 7-16 [2012/07/16 18:45:51 | 000,002,463 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk [2012/07/12 13:14:34 | 000,060,304 | ---- | M] () -- C:\Documents and Settings\Administrator\g2mdlhlpx.exe [2012/07/12 11:30:21 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2012/07/12 11:30:20 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012/07/12 03:16:59 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/07/12 03:16:47 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2012/07/12 03:16:46 | 000,002,335 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FA Reminder.lnk [2012/07/12 03:16:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/07/12 03:16:29 | 000,193,776 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012/07/11 18:20:42 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2012/07/02 15:03:09 | 000,006,524 | ---- | M] () -- C:\WINDOWS\System32\ESDictionary.dic [2012/06/29 12:04:13 | 000,468,759 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\logo.mht [2012/06/28 08:53:27 | 000,122,419 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\MacKenzie LeCroy.pdf [2012/06/27 12:40:50 | 003,240,054 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\logo_for_delayed_tx.bmp [2012/06/26 16:34:36 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for [2012/06/26 16:23:28 | 000,157,448 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2012/06/26 16:23:28 | 000,149,256 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2012/06/26 16:23:28 | 000,149,256 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2012/06/26 16:23:28 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2012/06/26 16:23:26 | 000,476,936 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\npdeployJava1.dll [2012/06/26 16:23:26 | 000,472,840 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2012/06/26 07:58:54 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2012/06/26 07:58:54 | 000,000,786 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Windows Media Player.lnk [2012/06/25 16:36:01 | 000,001,712 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FREE Trial version of CAESY Patient Education.lnk [2012/06/21 09:51:51 | 000,211,502 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\CoryWilliams%20LOGO%20FINAL[1].JPG [6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Administrator\*.tmp files -> C:\Documents and Settings\Administrator\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/07/16 18:46:27 | 000,010,568 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\hijackthis log 7-16 [2012/07/16 18:45:29 | 000,002,463 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk [2012/07/12 13:14:33 | 000,060,304 | ---- | C] () -- C:\Documents and Settings\Administrator\g2mdlhlpx.exe [2012/06/29 12:04:11 | 000,468,759 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\logo.mht [2012/06/28 08:52:58 | 000,122,419 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\MacKenzie LeCroy.pdf [2012/06/27 12:40:50 | 003,240,054 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\logo_for_delayed_tx.bmp [2012/06/26 16:34:37 | 000,000,250 | ---- | C] () -- C:\WINDOWS asks\Scheduled Update for Ask Toolbar.job [2012/06/25 16:36:01 | 000,001,712 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FREE Trial version of CAESY Patient Education.lnk [2012/06/21 09:51:51 | 000,211,502 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\CoryWilliams%20LOGO%20FINAL[1].JPG [2012/06/16 04:53:03 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012/04/11 08:00:28 | 000,523,814 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2027339946-3660946461-3242847100-500-0.dat [2012/03/29 03:23:48 | 000,174,334 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat [2011/06/16 10:39:00 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\PUTTY.RND [2011/05/11 10:59:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\iphist.dat [2011/05/11 10:58:48 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\UNWISE.EXE [2011/05/11 10:58:39 | 009,990,144 | ---- | C] () -- C:\WINDOWS\System32\XCClient.dll [2009/08/17 14:52:51 | 000,000,014 | ---- | C] () -- C:\Documents and Settings\Administrator\iphist.dat [2008/01/03 17:11:02 | 000,000,426 | ---- | C] () -- C:\Documents and Settings\Administrator\neacomm.ini [2007/04/11 15:48:26 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat [2006/07/19 13:04:52 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/03/23 11:47:48 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html [2003/10/01 17:13:02 | 000,176,618 | ---- | C] () -- C:\Documents and Settings\Administrator\~ [2003/09/08 07:41:25 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Administrator\EsUninstLog.Err ========== LOP Check ========== [2007/06/25 10:53:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\FunWebProducts [2006/12/19 16:04:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Leadertech [2012/03/02 17:35:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Toolbar4 [2006/07/17 11:19:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Walgreens [2012/06/26 16:24:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ask [2009/07/29 12:23:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CAM Commerce Solutions [2011/03/24 16:17:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn [2012/07/18 19:45:01 | 000,000,250 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job ========== Purity Check ========== < End of report > Emsisoft Anti-Malware - Version 6.6 IDS log Date PID Source Event Behavior/Infection 7/3/2012 8:05:16 AM 1664 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 7/3/2012 8:05:16 AM 1664 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 7/2/2012 7:56:46 AM 2428 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 7/2/2012 7:56:45 AM 2428 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 6/29/2012 8:25:22 AM 3136 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 6/29/2012 8:25:21 AM 3136 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 6/28/2012 7:23:29 AM 2868 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 6/28/2012 7:23:28 AM 2868 C:\Program Files\Internet Explorer\iexplore.exe Blocked by rule APNMEDIA.ASK.COM 6/19/2012 10:36:20 AM 2592 C:\Program Files\EagleSoft\Shared Files\esinetconnect.exe Allowed by user Behavior.Spyware 6/19/2012 10:36:14 AM 2592 C:\Program Files\EagleSoft\Shared Files\esinetconnect.exe Allowed by user Behavior.TrojanDownloader 6/18/2012 9:22:30 AM 2380 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Undefined event Behavior.RemoteControl 6/18/2012 9:15:56 AM 2380 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.Backdoor 6/18/2012 9:15:48 AM 2380 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.NewProcess 6/18/2012 8:12:23 AM 4004 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.Backdoor 6/18/2012 8:11:50 AM 4004 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.NewProcess 6/18/2012 8:09:28 AM 3644 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.Backdoor 6/18/2012 8:08:45 AM 3644 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by rule Behavior.NewProcess 6/18/2012 8:08:18 AM 3192 C:\Program Files\PaymentBrowser.com\Payment Browser\gatewaycc3.exe Allowed by user Behavior.Backdoor 6/16/2012 7:29:56 AM 3024 C:\Documents and Settings\Administrator\Local Settings\Temp\gus78D.tmp Allowed by user Behavior.AutorunCreation Emsisoft Anti-Malware - Version 6.6 quarantine log Date Source Event Behavior/Infection 6/16/2012 7:04:53 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 7:04:54 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:08:02 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:09:50 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:10:04 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:10:25 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:08:00 AM Key: hkey_local_machine\system\currentcontrolset\enum\root\legacy_mywebsearchservice Moved to quarantine Trace.Registry.funwebproducts!E1 6/16/2012 6:12:26 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:10:35 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:08:31 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:09:49 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:12:26 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:08:32 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:08:01 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:10:36 AM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/16/2012 6:10:24 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:10:03 AM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/16/2012 6:08:00 AM Key: hkey_local_machine\system\currentcontrolset\enum\root\legacy_mywebsearchservice Moved to quarantine Trace.Registry.funwebproducts!E1 6/16/2012 6:07:59 AM C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE Moved to quarantine Adware.Win32.MyWebSearch!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{a6573479-9075-4a65-98a6-19fd29cf7374}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddyfreqnone Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root ypelib\{29d67d3c-509a-4544-903f-c8c1b8236554} Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin --> description Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.popswatterbarbutton Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearch.outlookaddin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{cff4ce82-3aa2-451f-9b77-7165605fb835} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> sr Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.0.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.killerobjmanager.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall --> uninstallstring Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows5 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> msimn.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\mywebsearch\bar --> configrevisionurl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> pid Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:13 PM Value: hkey_classes_root\clsid\{00a6faf1-072e-44cf-8957-5838f569a31d}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:22 PM Value: hkey_classes_root\wusn.1 --> wusn_id Moved to quarantine Trace.Registry.whenu.savenow!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.historykillerscheduler.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> googletalkhtml.0 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> cachedir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\fun web products\settings\cursormaniabtn --> etag Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> lastrequest Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.iecookiesmanager.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall --> publisher Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> msnmsgr.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.iecookiesmanager.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg --> path Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{00a6faf1-072e-44cf-8957-5838f569a31d} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:06 PM Key: hkey_local_machine\software\classes\clsid\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:33 PM Value: hkey_current_user\software\microsoft\internet explorer\urlsearchhooks --> {00a6faf6-072e-44cf-8957-5838f569a31d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> pl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:42 PM Key: hkey_local_machine\software\funwebproducts Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> checkforconnection Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{cff4ce82-3aa2-451f-9b77-7165605fb835}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.popswattersettingscontrol.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aimt.numactive2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{adb01e81-3c79-4272-a0f1-7b2be7a782dc}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> eintl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:13 PM Value: hkey_local_machine\software\divxnetworks\divx player 2.0 --> skinsdir Moved to quarantine Trace.Registry.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{cff4ce82-3aa2-451f-9b77-7165605fb835} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.pseudotransparentplugin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\mwsoemon --> version Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:23 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar --> urlinfoabout Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{3e720451-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows media\wmsdk\sources --> f3popularscreensavers Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin --> loadbehavior Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root\screensavercontrol.screensaverinstaller Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\fun web products\msnmessenger --> dllfile Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearchtoolbar.settingsplugin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{07b18eab-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\office\word\addins\mywebsearch.outlookaddin --> description Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\myfuncardsimbtn --> htmlmenurevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\interface\{07b18eaa-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.popswattersettingscontrol Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearchtoolbar.toolbarplugin.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> nextrequest Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:19 PM Value: hkey_local_machine\software\classes\clsid\{3e720452-b472-4954-b7aa-33069eb53906}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:42 PM Key: hkey_local_machine\system\currentcontrolset\enum\root\legacy_mywebsearchservice Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.historykillerscheduler.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:13 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\ Moved to quarantine Trace.Registry.filesubmit.a!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{9ff05104-b030-46fc-94b8-81276e4e27df}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> sr Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{a6573479-9075-4a65-98a6-19fd29cf7374}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:13 PM Value: hkey_classes_root\clsid\{07b18ea9-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\code store database\distribution units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}\downloadinformation --> inf Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{a9571378-68a1-443d-b082-284f960c6d17} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{07b18eab-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{cff4ce82-3aa2-451f-9b77-7165605fb835}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{00a6faf6-072e-44cf-8957-5838f569a31d}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> lsp Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> abs Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\freeze.com\ Moved to quarantine Trace.Registry.freeze!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> incmail.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> id Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> dir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.pseudotransparentplugin.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg --> standardsmileydir.aim Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:12 PM Key: hkey_current_user\software\freeze.com\ Moved to quarantine Trace.Registry.freeze!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{25560540-9571-4d7b-9389-0f166788785a}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> visible Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> boscript Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:13 PM Value: hkey_local_machine\software\divxnetworks\divx player 2.0 --> applicationdir Moved to quarantine Trace.Registry.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearchtoolbar.toolbarplugin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddytextuninstalled.0 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aimt.0 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> dir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{a9571378-68a1-443d-b082-284f960c6d17} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{98d9753d-d73b-42d5-8c85-4469cda897ab} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.htmlmenu Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> pl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> mwssrcas.dll Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:28 PM Key: hkey_classes_root\interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.htmlpanel.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{9ff05104-b030-46fc-94b8-81276e4e27df} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:28 PM Key: hkey_classes_root\interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\funwebproducts\installer --> curinstall Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearch.outlookaddin.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:28 PM Key: hkey_classes_root\interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:06 PM Key: hkey_local_machine\software\classes\clsid\{07b18ea9-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\skintools --> playerpath Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.htmlmenu.2 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\mywebsearch\bar --> cachedir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall --> urlinfoabout Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{d778513b-1c40-4819-b0c5-49e40b39afd0}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\interface\{07b18eac-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar --> displayname Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\code store database\distribution units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}\installedversion --> lastmodified Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.popswatterbarbutton.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root ypelib\{f42228fb-e84e-479e-b922-fbbd096e792c} Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{8e6f1832-9607-4440-8530-13be7c4b1d14}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> aim.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{8e6f1830-9607-4440-8530-13be7c4b1d14} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:22 PM Value: hkey_local_machine\software\classes\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> pl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.2.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg --> version Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.outlookaddin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Key: hkey_local_machine\software\search toolbar Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:13 PM Value: hkey_classes_root\clsid\{00a6faf6-072e-44cf-8957-5838f569a31d}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearchtoolbar.settingsplugin.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:05 PM Key: hkey_local_machine\software rymedia systems\activemark software Moved to quarantine Trace.Registry.trymedia!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> pluginpath Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\outlook --> mywebsearch.outlookaddin Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearchtoolbar.settingsplugin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:33 PM Key: hkey_classes_root ypelib\{e47caee0-deea-464a-9326-3f2801535a4d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.historykillerscheduler Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:33 PM Key: hkey_local_machine\software\mywebsearch Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddytextuninstalled.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\code store database\distribution units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb}\downloadinformation --> codebase Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\smileycentralbtn --> htmlmenuposdeleted Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{b813095c-81c0-4e40-aa14-67520372b987} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{3e720453-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{98d9753d-d73b-42d5-8c85-4469cda897ab}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{84da4fdf-a1cf-4195-8688-3e961f505983}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\email-im\0 --> toolbar Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:33 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{07b18ea1-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:19 PM Value: hkey_local_machine\software\classes\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\email-im\0 --> path Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{00a6faf6-072e-44cf-8957-5838f569a31d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{2eff3cf7-99c1-4c29-bc2b-68e057e22340}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:22 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\search toolbar --> changed Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> ssclabel Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\mywebsearch.chatsessionplugin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:06 PM Key: hkey_local_machine\software\classes\clsid\{07b18ea1-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:22 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\search toolbar --> slowinfocache Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{a9571378-68a1-443d-b082-284f960c6d17}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall --> helplink Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:05 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} Moved to quarantine Trace.Registry.cleannoptimize!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{8e6f1832-9607-4440-8530-13be7c4b1d14}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{84da4fdf-a1cf-4195-8688-3e961f505983}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.datacontrol Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> googletalkhtml.1 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin --> friendlyname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.historyswattercontrolbar Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:22 PM Key: hkey_classes_root\wusn.1 Moved to quarantine Trace.Registry.whenusave!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{9ff05104-b030-46fc-94b8-81276e4e27df} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.3.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:06 PM Key: hkey_local_machine\software\classes\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\cursormaniabtn --> lasthtmlmenuurl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> settingsdir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\mywebsearch bar uninstall --> displayname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> icq.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\mywebsearch.htmlpanel Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:13 PM Value: hkey_classes_root\clsid\{07b18ea1-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:33 PM Value: hkey_current_user\software\fun web products\data --> datadir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> des Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.4.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aim.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{25560540-9571-4d7b-9389-0f166788785a} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:06 PM Value: hkey_local_machine\software\classes\clsid\{57cadc46-58ff-4105-b733-5a9f3fc9783c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.els.mywebtattoo.com!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> waol.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\myfuncardsimbtn --> etag Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.htmlmenu.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows7 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows3 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.numactive2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:06 PM Value: hkey_classes_root\clsid\{57cadc46-58ff-4105-b733-5a9f3fc9783c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.els.mywebtattoo.com!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{b813095c-81c0-4e40-aa14-67520372b987}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.killerobjmanager Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> outlook.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:33 PM Value: hkey_current_user\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} --> displayname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> ypager.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:42 PM Value: hkey_local_machine\software\freeze.com\installer --> id Moved to quarantine Trace.Registry.ez game cheats!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aimt.1 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows4 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aim.numactive2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearch.pseudotransparentplugin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.popswatterbarbutton Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:27 PM Key: hkey_classes_root\interface\{1093995a-ba37-41d2-836e-091067c4ad17} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:06 PM Value: hkey_local_machine\software\classes\clsid\{57cadc46-58ff-4105-b733-5a9f3fc9783c} --> appid Moved to quarantine Trace.Registry.els.mywebtattoo.com!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar --> displayversion Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{a4730ebe-43a6-443e-9776-36915d323ad3} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> htmlmenurevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:33 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{07b18ea1-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> msn.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.historyswattercontrolbar.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> lastconfigrequest Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\cursormaniabtn --> htmlmenurevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:06 PM Key: hkey_current_user\software\fun web products Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:33 PM Key: hkey_current_user\software\mywebsearch Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> configdatestamp Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:18 PM Value: hkey_local_machine\software\classes\clsid\{2eff3cf7-99c1-4c29-bc2b-68e057e22340}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root\screensavercontrol.screensaverinstaller.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> msmsgs.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\mywebsearch\bar --> configrevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> msn.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearchtoolbar.toolbarplugin.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\fun web products\screensaver --> imagesdir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> historydir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\fun web products --> cachedir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{9ff05104-b030-46fc-94b8-81276e4e27df}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\system\currentcontrolset\services\mywebsearchservice Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> curinstall Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\run --> mywebsearch plugin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> msn.2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.htmlmenu.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\smileycentralbtn --> etag Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:13 PM Value: hkey_local_machine\software\divxnetworks\divx player 2.0 --> installdir Moved to quarantine Trace.Registry.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{b813095c-81c0-4e40-aa14-67520372b987}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.1.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{b813095c-81c0-4e40-aa14-67520372b987} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearch.htmlpanel.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{07b18ea9-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:22 PM Value: hkey_local_machine\software\classes\clsid\{fcbccb87-9224-4b8d-b117-f56d924beb18}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.widomaker toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aim.0.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{90449521-d834-4703-bb4e-d3aa44042ff8} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddytextnone.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows6 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> msn.1 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{3e720452-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearch.htmlpanel Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> curinstall Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\email-im\0 --> appname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:22 PM Value: hkey_classes_root\clsid\{fcbccb87-9224-4b8d-b117-f56d924beb18}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.widomaker toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddytextnone.0 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} --> displayname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\office\word\addins\mywebsearch.outlookaddin --> loadbehavior Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{adb01e81-3c79-4272-a0f1-7b2be7a782dc}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.outlookaddin.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{a9571378-68a1-443d-b082-284f960c6d17}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.popswatterbarbutton.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.datacontrol.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} --> url Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:27 PM Key: hkey_classes_root\interface\{120927bf-1700-43bc-810f-fab92549b390} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\mywebsearch\bar --> configdatestamp Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.htmlmenu.2 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> buddyfrequninstalled Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{8e6f1832-9607-4440-8530-13be7c4b1d14} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> flags Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:27 PM Key: hkey_classes_root\interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\run --> mywebsearch email plugin Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{991aac62-b100-47ce-8b75-253965244f69} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.popswattersettingscontrol Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.htmlmenu Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:06 PM Key: hkey_local_machine\software\classes\clsid\{00a6faf1-072e-44cf-8957-5838f569a31d} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_current_user\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} --> url Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearchtoolbar.toolbarplugin Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\focusinteractive\bar\switches --> icqlite.exe Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.popswattersettingscontrol.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.historyswattercontrolbar Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:05 PM Key: hkey_local_machine\software rymedia systems Moved to quarantine Trace.Registry.trymedia!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{07b18ea0-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> googletalkhtml.numactive2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\promos --> msn.numactive2 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.historyswattercontrolbar.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:28 PM Key: hkey_classes_root\interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.iecookiesmanager Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.killerobjmanager Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> un Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> nextconfigrequest Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:37:01 PM c:\program files\mywebsearch\bar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\office\word\addins\mywebsearch.outlookaddin --> friendlyname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{3e720450-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:27 PM Key: hkey_classes_root\interface\{1f52a5fa-a705-4415-b975-88503b291728} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aim.1.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> pid Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:05 PM Value: hkey_classes_root\clsid\{57cadc46-58ff-4105-b733-5a9f3fc9783c} --> appid Moved to quarantine Trace.Registry.els.mywebtattoo.com!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> id Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_local_machine\software\fun web products\msnmessenger --> dlldir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar --> uninstallstring Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{25560540-9571-4d7b-9389-0f166788785a} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\mywebsearchtoolbar.settingsplugin.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:17 PM Value: hkey_local_machine\software\classes\clsid\{25560540-9571-4d7b-9389-0f166788785a}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:34 PM Value: hkey_current_user\software\mywebsearch\bar --> menuextlabel Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{3e720452-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\code store database\distribution units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} --> installer Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> sscset Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{07b18ea1-a523-4961-b6bb-170de4475cca} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{3e720452-b472-4954-b7aa-33069eb53906}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\microsoft\code store database\distribution units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} --> systemcomponent Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\fun web products --> jpegconversionlib Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:19 PM Value: hkey_local_machine\software\classes\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> dir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:16 PM Value: hkey_classes_root\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:33 PM Key: hkey_local_machine\software\microsoft\office\word\addins\mywebsearch.outlookaddin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\myfuncardsimbtn --> lasthtmlmenuurl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> esh Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:51 PM c:\program files\mywebsearch Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{8e6f1832-9607-4440-8530-13be7c4b1d14} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\smileycentralbtn --> htmlmenurevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{98d9753d-d73b-42d5-8c85-4469cda897ab}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:16 PM Value: hkey_local_machine\software\classes\clsid\{00a6faf1-072e-44cf-8957-5838f569a31d}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\smileycentralbtn --> lasthtmlmenuurl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root ypelib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:42 PM Key: hkey_local_machine\software\fun web products Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\funwebproducts.historykillerscheduler Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:33 PM Key: hkey_local_machine\software\microsoft\office\outlook\addins\mywebsearch.outlookaddin Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{d778513b-1c40-4819-b0c5-49e40b39afd0}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{07b18eab-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\searchassistant --> sr Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\mywebsearch.chatsessionplugin.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> yahoo.5.old Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{98d9753d-d73b-42d5-8c85-4469cda897ab} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> sscurl Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:37:09 PM C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE File locked, removal on reboot Adware.Win32.MyWebSearch!E1 6/15/2012 11:37:09 PM C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL File not found Adware.Win32.MyWebSearch!E1 6/15/2012 11:37:08 PM C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL File not found Adware.Win32.MyWebSearch!E1 6/15/2012 11:37:08 PM C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSOEMON.EXE File locked, removal on reboot Adware.Win32.MyWebSearch!E1 6/15/2012 11:37:07 PM c:\program files\funwebproducts Moved to quarantine Trace.File.funwebproducts!E1 6/15/2012 11:37:07 PM c:\program files\search toolbar Moved to quarantine Trace.File.huntbar.stoolbar!E1 6/15/2012 11:37:07 PM c:\program files\mywebsearch\bar\1.bin\f3brovly.dll Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:06 PM c:\program files\mywebsearch\srchastt Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:06 PM c:\program files\mywebsearch\bar\settings Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:06 PM c:\program files\mywebsearch\bar\history Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:05 PM c:\program files\mywebsearch\bar\game Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:04 PM c:\program files\mywebsearch\bar\cache Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:04 PM c:\program files\mywebsearch\bar\avatar Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:03 PM c:\program files\mywebsearch\bar\1.bin Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:37:00 PM c:\program files\funwebproducts\shared\cache Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:36:59 PM c:\program files\funwebproducts\shared Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:36:59 PM c:\program files\funwebproducts\screensaver\images Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:36:59 PM c:\program files\funwebproducts\screensaver Moved to quarantine Trace.File.mywebsearch toolbar!E1 6/15/2012 11:36:59 PM c:\windows\system32\f3pssavr.scr Moved to quarantine Trace.File.mywebsearchtoobar!E1 6/15/2012 11:36:51 PM c:\program files\yourscreen\freeze.desktopmanager.browserhelper.dll Moved to quarantine Trace.File.your screen!E1 6/15/2012 11:36:50 PM c:\program files\yourscreen Moved to quarantine Trace.File.your screen!E1 6/15/2012 11:36:47 PM c:\program files\mywebsearch\bar\notifier Moved to quarantine Trace.File.zwinky toolbar!E1 6/15/2012 11:36:47 PM c:\program files\mywebsearch\bar\message Moved to quarantine Trace.File.zwinky toolbar!E1 6/15/2012 11:36:47 PM c:\program files\relevantknowledge\ Moved to quarantine Trace.File.filesubmit.a!E1 6/15/2012 11:36:46 PM c:\program files\freeze.com Moved to quarantine Trace.File.freeze!E1 6/15/2012 11:36:46 PM c:\program files\free offers from freeze.com Moved to quarantine Trace.File.freeze!E1 6/15/2012 11:36:45 PM c:\program files\free offers from freeze.com\ Moved to quarantine Trace.File.freeze!E1 6/15/2012 11:36:44 PM c:\program files\relevantknowledge Moved to quarantine Trace.File.relevantknowledge!E1 6/15/2012 11:36:44 PM c:\program files\divx\divx player 2.0 alpha\skins\default.dps Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:43 PM c:\program files\divx\divx player 2.0 alpha\readme.txt Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:43 PM c:\program files\divx\divx player 2.0 alpha\license.txt Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:42 PM c:\program files\divx\divx player 2.0 alpha\divx player 2.0 alpha.exe Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:42 PM c:\program files\divx\divx player 2.0 alpha\divxplayer.dbf Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:42 PM c:\program files\divx\divx player 2.0 alpha\divx.com.url Moved to quarantine Trace.File.divx 5.0.3 pro bundle!E1 6/15/2012 11:36:42 PM Key: hkey_local_machine\software\fun web products Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:41 PM Key: hkey_classes_root\funwebproducts.historykillerscheduler.1 Moved to quarantine Trace.Registry.funwebproducts!E1 6/15/2012 11:36:40 PM Value: hkey_local_machine\software\mywebsearch\oehosts --> windows3 Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:39 PM Value: hkey_local_machine\software\mywebsearch\mwsoeplg\promo --> aim.numactive Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:38 PM Value: hkey_local_machine\software\mywebsearch\bar --> curinstall Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:37 PM Value: hkey_local_machine\software\microsoft\office\word\addins\mywebsearch.outlookaddin --> friendlyname Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:36 PM Value: hkey_local_machine\software\fun web products --> cachedir Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:35 PM Value: hkey_local_machine\software\fun web products\settings\cursormaniabtn --> htmlmenurevision Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:34 PM Value: hkey_current_user\software\microsoft\internet explorer\searchscopes\{56256a51-b582-467e-b8d4-7786eda79ae0} --> url Moved to quarantine Trace.Registry.mywebsearch toolbar!E1 6/15/2012 11:36:33 PM Key: hkey_classes_root ypelib\{e47caee0-deea-464a-9326-3f2801535a4d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:32 PM Key: hkey_classes_root\screensavercontrol.screensaverinstaller.1 Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:31 PM Key: hkey_classes_root\interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:30 PM Key: hkey_classes_root\interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:29 PM Key: hkey_classes_root\interface\{3e720451-b472-4954-b7aa-33069eb53906} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:28 PM Key: hkey_classes_root\interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:27 PM Key: hkey_classes_root\interface\{1093995a-ba37-41d2-836e-091067c4ad17} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:26 PM Key: hkey_classes_root\clsid\{a4730ebe-43a6-443e-9776-36915d323ad3} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:25 PM Key: hkey_classes_root\clsid\{53ced2d0-5e9a-4761-9005-648404e6f7e5} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:24 PM Key: hkey_classes_root\clsid\{00a6faf6-072e-44cf-8957-5838f569a31d} Moved to quarantine Trace.Registry.mywebsearchtoobar!E1 6/15/2012 11:36:23 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search toolbar Moved to quarantine Trace.Registry.searchtoolbar!E1 6/15/2012 11:36:22 PM Value: hkey_local_machine\software\classes\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:21 PM Value: hkey_local_machine\software\classes\clsid\{a6573479-9075-4a65-98a6-19fd29cf7374}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:20 PM Value: hkey_local_machine\software\classes\clsid\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:19 PM Value: hkey_local_machine\software\classes\clsid\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:18 PM Value: hkey_local_machine\software\classes\clsid\{2eff3cf7-99c1-4c29-bc2b-68e057e22340}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:17 PM Value: hkey_local_machine\software\classes\clsid\{25560540-9571-4d7b-9389-0f166788785a}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:16 PM Value: hkey_classes_root\clsid\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:15 PM Value: hkey_classes_root\clsid\{84da4fdf-a1cf-4195-8688-3e961f505983}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:14 PM Value: hkey_classes_root\clsid\{07b18eab-a523-4961-b6bb-170de4475cca}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.zwinky toolbar!E1 6/15/2012 11:36:13 PM Key: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\ Moved to quarantine Trace.Registry.filesubmit.a!E1 6/15/2012 11:36:12 PM Key: hkey_current_user\software\freeze.com\ Moved to quarantine Trace.Registry.freeze!E1 6/15/2012 11:36:11 PM Key: hkey_local_machine\software\classes\mywebsearch.htmlpanel.1 Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:10 PM Key: hkey_local_machine\software\classes\funwebproducts.iecookiesmanager Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:09 PM Key: hkey_local_machine\software\classes\clsid\{d9fffb27-d62a-4d64-8cec-1ff006528805} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:08 PM Key: hkey_local_machine\software\classes\clsid\{938aa51a-996c-4884-98ce-80dd16a5c9da} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:07 PM Key: hkey_local_machine\software\classes\clsid\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} Moved to quarantine Trace.Registry.mywebsearch!E1 6/15/2012 11:36:06 PM Value: hkey_classes_root\clsid\{57cadc46-58ff-4105-b733-5a9f3fc9783c}\inprocserver32 --> threadingmodel Moved to quarantine Trace.Registry.els.mywebtattoo.com!E1 6/15/2012 11:36:05 PM Key: hkey_local_machine\software rymedia systems Moved to quarantine Trace.Registry.trymedia!E1 6/15/2012 11:36:05 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlservice.exe Moved to quarantine Adware.RelevantKnowledge.bq!E2 6/15/2012 11:36:04 PM C:\WINDOWS\Temp\~os5.tmp\rlservice.exe Moved to quarantine Adware.RelevantKnowledge.bq!E2 6/15/2012 11:36:04 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCC.tmp\rlls64.dll Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:04 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCC.tmp\rlvknlg64.exe Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:03 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlvknlg64.exe Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:03 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlls64.dll Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:03 PM C:\WINDOWS\Temp\~os5.tmp\rlvknlg64.exe Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:02 PM C:\WINDOWS\Temp\~os5.tmp\rlls64.dll Moved to quarantine Riskware.WebToolbar.Win64!E2 6/15/2012 11:36:02 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlxg.dll Moved to quarantine Gen.AdWare!E2 6/15/2012 11:36:02 PM C:\Program Files\RelevantKnowledge\components\rlxg.dll Moved to quarantine Gen.AdWare!E2 6/15/2012 11:36:01 PM C:\WINDOWS\Temp\~os5.tmp\rlxg.dll Moved to quarantine Gen.AdWare!E2 6/15/2012 11:36:01 PM C:\WINDOWS\Temp\~os2.tmp\OSSService.exe Moved to quarantine Riskware.AdWare.Win32.RK!E2 6/15/2012 11:36:01 PM C:\WINDOWS\Temp\~os2F.tmp\OSSService.exe Moved to quarantine Riskware.AdWare.Win32.RK!E2 6/15/2012 11:36:00 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlvknlg.exe Moved to quarantine Riskware.AdWare.RelevantKnowledge!E2 6/15/2012 11:36:00 PM C:\Program Files\RelevantKnowledge\RLLS.VIR Moved to quarantine Riskware.AdWare.RelevantKnowledge!E2 6/15/2012 11:35:59 PM C:\WINDOWS\Temp\~os5.tmp\rlvknlg.exe Moved to quarantine Riskware.AdWare.RelevantKnowledge!E2 6/15/2012 11:35:59 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlph.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:59 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlxf.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:58 PM C:\Documents and Settings\Administrator\Local Settings\Temp\~osCF.tmp\rlls.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:58 PM C:\WINDOWS\Temp\~os5.tmp\rlxf.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:58 PM C:\WINDOWS\Temp\~os5.tmp\rlls.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:57 PM C:\WINDOWS\Temp\~os5.tmp\rlph.dll Moved to quarantine Adware.Win32.Agent!E1 6/15/2012 11:35:56 PM C:\Program Files\EagleSoft\Shared Files\PINPadDevice.dll Moved to quarantine Virus.Win32.Parite!E2 6/15/2012 11:35:56 PM C:\WINDOWS\system32\PINPadDevice.dll Moved to quarantine Virus.Win32.Parite!E2 6/15/2012 11:35:55 PM C:\Program Files\OneStepSearch\osopt.exe Moved to quarantine Riskware.AdWare.Win32.OneStep!E2 6/15/2012 11:35:55 PM C:\Program Files\OneStepSearch\onestep.exe Moved to quarantine Riskware.AdWare.Win32.OneStep!E2 6/15/2012 11:35:55 PM C:\Program Files\OneStepSearch\uninstall.exe Moved to quarantine AdWare.OneStep!E2 6/15/2012 11:35:55 PM C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:54 PM C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:54 PM C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:54 PM C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:54 PM C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:54 PM C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:53 PM C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:53 PM C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL Moved to quarantine Adware.Win32.MyWebSearchToolbar!E1 6/15/2012 11:35:53 PM C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL Moved to quarantine Riskware.WebToolbar.Win32.MyWebSearch.ed!E1 6/15/2012 11:35:53 PM C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE Moved to quarantine Adware.Win32.FunWeb!E1 6/15/2012 11:35:52 PM C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL Moved to quarantine Adware.Win32.FunWeb!E1 6/15/2012 11:35:52 PM C:\Program Files\Internet Explorer\msimg32.dll Moved to quarantine Adware.Win32.Toolbar.MyWebSearch.AMN!E1 6/15/2012 11:35:52 PM C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL Moved to quarantine Adware.Win32.Toolbar.MyWebSearch.AMN!E1 6/15/2012 11:35:52 PM C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL Moved to quarantine Riskware.WebToolbar.Win32.MyWebSearch!E2 6/15/2012 11:35:51 PM C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL Moved to quarantine Riskware.AdTool.Win32.MyWebSearch!E1
  5. Thanks. The computer is still running slowly and freezing up occasionally. I realize you said that there would be more steps involved for a complete removal of mywebsearch. I have the logs from EAM and HiJackthis. Would you like me to create a new OTL log, or post these logs?
  6. I ran the fix. Unfortunately when I started it, it closed crossloop. By the time I was able to get back on, there were no logs. I asked the secretary about them and she said that there was nothing there when she arrived this morning. She also said the computer still isn't running well. I can try running another scan with emsisoft after they close today and see if the toolbar seems to still be there. Any other suggestions?
  7. I will get the other log in a little while and attach it. Regarding your other question, I will ask someone from Emsisoft to contact you.
  8. I am working on a client's computer remotely, and I installed Emsisoft (which he is purchasing). One of his computers was loaded with malware, including the mywebsearch toolbar. When I click "Quarantine" or "Delete" nothing happens. I was hoping you could give me a way to remove the toolbar. (Please keep in mind, I am working remotely, and cannot disconnect the computer from the network and still work on it.) Also, I had already installed Emsisoft, run the scan, and pressed quarantine before I realized this was going to be an issue. I thought the EEK scan and log might be less informative and possibly redundant, so I've attached the scan log from the actual program, not the EEK.
  9. I found this program in my list of programs. I went to their website to see what it was and something immediately tried to make changes to my computer (purportedly to the flash player, but I suspect this could have been a trick). I tried to remove it in the control panel and during removal I received another message that a program from an unknown publisher wanted to make changes to my computer. I could only find one website that tried to explain what the company does, but the description sounded typical of a publisher that tries to install unwanted ad-ons to your system in the name of "user optimization." I have run more than one detailed scan, and I have also run a scan from a usb drive using the EEK. The scans haven't picked anything up, but it seems suspicious to me that an updater needs to be connected to the internet to remove a program. It seems that I should be able to remove programs with or without internet connectivity. Any information you can provide would be appreciated.