[nigella]

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=431bcd3b08b2c443bc73d8c12aca7fa4
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-16 09:48:23
# local_time=2012-02-16 09:48:23 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 200024 166961228 0 0
# compatibility_mode=8192 67108863 100 0 3925 3925 0 0
# scanned=11989
# found=0
# cleaned=0
# scan_time=446
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=431bcd3b08b2c443bc73d8c12aca7fa4
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-02-16 11:39:25
# local_time=2012-02-16 11:39:25 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776573 100 100 200743 166961947 0 0
# compatibility_mode=8192 67108863 100 0 4644 4644 0 0
# scanned=125402
# found=9
# cleaned=9
# scan_time=6389
C:\_OTL\MovedFiles\02152012_230258\C_Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\02152012_230258\C_Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\02152012_230258\C_Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\02152012_230258\C_Program Files\Windows iLivid Toolbar\Datamngr\DnsBHO.dll a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\02152012_230258\C_Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll a variant of Win32/Toolbar.SearchSuite application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
D:\NickyNigelKatie\Users\Nicky_2\Downloads\cv.zip Win32/TrojanDownloader.FakeAlert.AXP trojan (deleted - quarantined) 00000000000000000000000000000000 C
D:\NickyNigelKatie\Users\Nicky_2\Downloads\frostwire-4.21.3.windows.exe Win32/OpenCandy application (deleted - quarantined) 00000000000000000000000000000000 C
D:\NickyNigelKatie\Users\Nicky_2\Downloads\SoftonicDownloader_for_free-studio-manager.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
D:\NickyNigelKatie\Users\Nicky_2\Downloads\YouTubeDownloaderSetup263.exe a variant of Win32/Toolbar.Widgi application (deleted - quarantined) 00000000000000000000000000000000 C


Results of screen317's Security Check version 0.99.31
Windows Vista Service Pack 2 x86 (UAC is disabled!)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
SpywareBlaster 4.4
Spybot - Search & Destroy
CCleaner
Java™ 6 Update 30
Java™ 6 Update 22
Java version out of date!
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.2)
Mozilla Firefox (10.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSASCui.exe
Spybot Teatimer.exe is disabled!
Windows Defender MSASCui.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

OTL logfile created on: 16/02/2012 23:55:02 - Run 7
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Pothecary\Documents\Downloads\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 0.86 Gb Available Physical Memory | 43.35% Memory free
4.22 Gb Paging File | 2.89 Gb Available in Paging File | 68.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 3.38 Gb Free Space | 12.10% Space Free | Partition Type: NTFS
Drive D: | 26.48 Gb Total Space | 6.48 Gb Free Space | 24.49% Space Free | Partition Type: NTFS
Drive Y: | 35.48 Gb Total Space | 10.93 Gb Free Space | 30.80% Space Free | Partition Type: NTFS
Drive Z: | 232.83 Gb Total Space | 57.84 Gb Free Space | 24.84% Space Free | Partition Type: FAT

Computer Name: NICKY | User Name: Pothecary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Pothecary\Documents\Downloads\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\SPanel.exe ()
PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
PRC - C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe (Alcatel-Lucent)
PRC - C:\Program Files\Common Files\Motive\McciControlHost.exe (Alcatel-Lucent)
PRC - C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe (Alcatel-Lucent)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

Edited by nigella, 16 February 2012 - 06:07 PM.

[Advertisements]

Please post the entire OTL scan log. If this is all you have then re run step number 3 the otl scan in my previous post.

[CompCav]

Please post the entire OTL scan log. If this is all you have then re run step number 3 the otl scan in my previous post.

[nigella]

sorry about that here it is in it's entirity

OTL logfile created on: 16/02/2012 23:55:02 - Run 7
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Pothecary\Documents\Downloads\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 0.86 Gb Available Physical Memory | 43.35% Memory free
4.22 Gb Paging File | 2.89 Gb Available in Paging File | 68.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 3.38 Gb Free Space | 12.10% Space Free | Partition Type: NTFS
Drive D: | 26.48 Gb Total Space | 6.48 Gb Free Space | 24.49% Space Free | Partition Type: NTFS
Drive Y: | 35.48 Gb Total Space | 10.93 Gb Free Space | 30.80% Space Free | Partition Type: NTFS
Drive Z: | 232.83 Gb Total Space | 57.84 Gb Free Space | 24.84% Space Free | Partition Type: FAT

Computer Name: NICKY | User Name: Pothecary | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Pothecary\Documents\Downloads\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\SPanel.exe ()
PRC - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
PRC - C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe (Alcatel-Lucent)
PRC - C:\Program Files\Common Files\Motive\McciControlHost.exe (Alcatel-Lucent)
PRC - C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe (Alcatel-Lucent)
PRC - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\spiomgr.dll ()
MOD - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\SPanel.exe ()
MOD - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\SMBalloon.dll ()
MOD - C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\System32\spool\drivers\w32x86\3\sst3cdu.dll ()
MOD - C:\Program Files\Samsung\Samsung CLP-320 Series\SPanel\SecSNMPR.dll ()
MOD - C:\Program Files\WinZip\WZSHLEXT.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (avast! Firewall) -- File not found
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (Samsung UPD Service) -- C:\Windows\System32\SUPDSvc.exe (Samsung Electronics CO., LTD.)
SRV - (SBSDWSCService) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (dgderdrv) -- C:\Windows\System32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (aswFW) -- C:\Windows\System32\drivers\aswFW.sys (AVAST Software)
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (OemBiosDevice) -- C:\Windows\System32\drivers\royal.sys (PARADOX)
DRV - (sscemdm) -- C:\Windows\System32\drivers\sscemdm.sys (MCCI Corporation)
DRV - (ssceserd) SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM) -- C:\Windows\System32\drivers\ssceserd.sys (MCCI Corporation)
DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\System32\drivers\sscebus.sys (MCCI Corporation)
DRV - (sscemdfl) -- C:\Windows\System32\drivers\sscemdfl.sys (MCCI Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (WacomPen) -- C:\Windows\system32\drivers\wacompen.sys ()
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (DgiVecp) -- C:\Windows\System32\drivers\DgiVecp.sys (DeviceGuys, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========



FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Motive, Inc.)
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Pothecary\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/09/10 14:35:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/15 23:08:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/15 23:03:05 | 000,000,000 | ---D | M]

[2012/02/14 14:16:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pothecary\AppData\Roaming\Mozilla\Extensions
[2012/02/14 18:06:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pothecary\AppData\Roaming\Mozilla\Firefox\Profiles\pxxnz8q3.default\extensions
[2011/03/07 08:26:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Pothecary\AppData\Roaming\Mozilla\Firefox\Profiles\pxxnz8q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/09 18:47:40 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\Pothecary\AppData\Roaming\Mozilla\Firefox\Profiles\pxxnz8q3.default\extensions\[email protected]
[2012/02/14 14:16:15 | 000,002,519 | ---- | M] () -- C:\Users\Pothecary\AppData\Roaming\Mozilla\Firefox\Profiles\pxxnz8q3.default\searchplugins\Search_Results.xml
[2012/02/15 23:08:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/10 14:35:57 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
() (No name found) -- C:\USERS\POTHECARY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXXNZ8Q3.DEFAULT\EXTENSIONS\[email protected]
[2012/02/15 23:08:14 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/15 23:08:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/15 23:08:08 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/02/15 23:03:22 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Pothecary\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [UpdateFlow.btbb] C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe (Alcatel-Lucent)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Free YouTube Download - C:\Users\Pothecary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pothecary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{94F98224-CFCD-43D3-BEA9-0DB21A6C0119}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF3A3BAE-1521-4154-959A-421C61B7001D}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Pothecary\Documents\Downloads\Desktop\Ella and Archie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Pothecary\Documents\Downloads\Desktop\Ella and Archie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/16 21:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/02/16 00:38:36 | 000,000,000 | ---D | C] -- C:\CPQSYSTEM
[2012/02/15 23:11:13 | 002,061,360 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Pothecary\Documents\Downloads\Desktop\tdsskiller.exe
[2012/02/15 23:02:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/02/14 23:38:39 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Local\Adobe
[2012/02/14 23:11:37 | 004,733,440 | ---- | C] (AVAST Software) -- C:\Users\Pothecary\Documents\Downloads\Desktop\aswMBR.exe
[2012/02/14 18:17:53 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Pothecary\Documents\Downloads\Desktop\OTL.exe
[2012/02/06 23:46:18 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Local\{F0BC70E2-FB9A-4096-8D77-0736FB6A4973}
[2012/02/06 23:45:53 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Local\{59B67A4E-A6D8-4ED4-BAB4-9480D455826B}
[2012/02/04 16:14:07 | 000,000,000 | ---D | C] -- C:\ProgramData\HardwareHelper
[2012/02/04 16:13:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hardware Helper
[2012/02/04 16:13:29 | 000,000,000 | ---D | C] -- C:\Program Files\Driver-Soft
[2012/02/04 13:48:52 | 000,000,000 | ---D | C] -- C:\Program Files\BetterCareerSearch_2bEI
[2012/02/03 23:20:57 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Roaming\libimobiledevice
[2012/02/03 23:20:55 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Roaming\log
[2012/02/03 23:17:04 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\Documents\Aiseesoft Studio
[2012/02/03 23:10:35 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Roaming\GetRightToGo
[2012/01/21 00:22:21 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Local\{A28B1549-977F-4565-8B4F-FFDB3B3905AB}
[2012/01/21 00:21:57 | 000,000,000 | ---D | C] -- C:\Users\Pothecary\AppData\Local\{7C9CB007-8A4B-4534-AF07-CCDBBB8959FA}
[2012/01/19 09:33:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Convert VOB to AVI
[2012/01/19 09:33:34 | 000,000,000 | ---D | C] -- C:\Program Files\Convert VOB to AVI
[2 C:\Users\Pothecary\Documents\*.tmp files -> C:\Users\Pothecary\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/16 23:46:04 | 000,879,700 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\SecurityCheck.exe
[2012/02/16 23:12:23 | 000,000,944 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3288798915-3054387470-3783549070-1000UA.job
[2012/02/16 22:15:12 | 000,005,600 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/16 22:15:12 | 000,005,600 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/16 21:07:18 | 000,015,780 | ---- | M] () -- C:\Users\Pothecary\received.xml
[2012/02/16 20:09:02 | 000,000,430 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012/02/16 20:08:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/02/15 23:11:23 | 002,061,360 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Pothecary\Documents\Downloads\Desktop\tdsskiller.exe
[2012/02/15 23:03:22 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2012/02/15 17:12:01 | 000,000,922 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3288798915-3054387470-3783549070-1000Core.job
[2012/02/14 23:34:08 | 000,000,512 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\MBR.dat
[2012/02/14 23:11:45 | 004,733,440 | ---- | M] (AVAST Software) -- C:\Users\Pothecary\Documents\Downloads\Desktop\aswMBR.exe
[2012/02/14 18:17:58 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Pothecary\Documents\Downloads\Desktop\OTL.exe
[2012/02/14 18:05:33 | 000,000,930 | ---- | M] () -- C:\Users\Pothecary\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
[2012/02/14 18:05:33 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/14 14:19:11 | 000,000,117 | ---- | M] () -- C:\Users\Public\Desktop\Chat with fTalk.url
[2012/02/07 16:20:10 | 000,131,552 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\429844_10150759050253272_680588271_12250402_1382774368_n.jpg
[2012/02/07 16:17:24 | 000,028,589 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Image2.jpg
[2012/02/07 16:16:59 | 000,027,976 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Image1.jpg
[2012/02/05 12:52:20 | 000,074,339 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\37891_1151116875551_1756522498_294300_5898579_n.jpg
[2012/02/04 16:25:31 | 000,598,900 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/02/04 16:25:31 | 000,104,914 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/02/04 16:13:32 | 000,001,036 | ---- | M] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Hardware Helper.lnk
[2012/02/04 15:24:09 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/01/27 00:21:24 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012/01/19 10:00:36 | 000,044,032 | ---- | M] () -- C:\Users\Pothecary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/19 09:33:36 | 000,000,837 | ---- | M] () -- C:\Users\Public\Desktop\Convert VOB to AVI.lnk
[2 C:\Users\Pothecary\Documents\*.tmp files -> C:\Users\Pothecary\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/16 23:45:57 | 000,879,700 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\SecurityCheck.exe
[2012/02/16 21:07:18 | 000,015,780 | ---- | C] () -- C:\Users\Pothecary\received.xml
[2012/02/14 23:34:08 | 000,000,512 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\MBR.dat
[2012/02/14 18:05:33 | 000,000,930 | ---- | C] () -- C:\Users\Pothecary\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes Anti-Malware.lnk
[2012/02/14 18:05:33 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/14 14:19:11 | 000,000,117 | ---- | C] () -- C:\Users\Public\Desktop\Chat with fTalk.url
[2012/02/07 16:17:24 | 000,028,589 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Image2.jpg
[2012/02/07 16:16:59 | 000,027,976 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Image1.jpg
[2012/02/07 16:15:11 | 000,131,552 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\429844_10150759050253272_680588271_12250402_1382774368_n.jpg
[2012/02/05 12:52:19 | 000,074,339 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\37891_1151116875551_1756522498_294300_5898579_n.jpg
[2012/02/04 16:13:32 | 000,001,036 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Hardware Helper.lnk
[2012/02/02 23:07:47 | 000,346,763 | ---- | C] () -- C:\Users\Pothecary\Documents\Downloads\Desktop\Ella and Archie.jpg
[2012/01/19 09:33:36 | 000,000,837 | ---- | C] () -- C:\Users\Public\Desktop\Convert VOB to AVI.lnk
[2011/12/23 20:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011/12/22 23:46:08 | 000,026,624 | ---- | C] () -- C:\Windows\System32\spd__l.dll
[2011/12/22 23:46:07 | 000,283,136 | ---- | C] () -- C:\Windows\System32\DscPnt.dll
[2011/12/22 23:46:07 | 000,259,888 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2011/12/22 23:46:06 | 000,151,552 | ---- | C] () -- C:\Windows\System32\spd__ci.exe
[2011/10/12 20:57:38 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/09/17 08:52:59 | 000,152,696 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/04/24 18:44:17 | 000,000,048 | ---- | C] () -- C:\Windows\winfile.ini
[2011/03/06 11:11:52 | 000,000,000 | ---- | C] () -- C:\Windows\System32\dxdiag.exe
[2011/03/06 01:22:32 | 000,044,032 | ---- | C] () -- C:\Users\Pothecary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/06 00:38:37 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011/03/06 00:37:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/06 00:37:29 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/05 21:22:26 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011/03/05 21:04:42 | 000,000,739 | ---- | C] () -- C:\Windows\entpack.ini
[2011/03/05 18:26:26 | 000,000,036 | ---- | C] () -- C:\Windows\Tiny_Run.ini
[2011/03/05 18:10:56 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2011/03/05 17:48:14 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/01/29 17:00:22 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011/01/29 17:00:22 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011/01/29 17:00:22 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011/01/29 17:00:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2009/10/06 07:16:00 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/02/11 18:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll
[2006/11/02 12:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 12:44:53 | 000,347,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 10:33:01 | 000,598,900 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,104,914 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 08:52:52 | 000,020,608 | ---- | C] () -- C:\Windows\System32\drivers\wacompen.sys
[2006/11/02 08:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001/07/13 07:04:00 | 000,373,248 | ---- | C] () -- C:\Windows\EyeCand3.INI

< End of report >

[CompCav]

Thank you I will have the next post of updates tomorrow after my instructor approves it

[nigella]

cool talkto you tomorrow!!!thanks

[CompCav]

Step 1.

• Open User Accounts by clicking the Start button , clicking Control Panel, clicking User Accounts and Family Safety (or clicking User Accounts, if you are connected to a network domain), and then clicking User Accounts.
• Click Turn User Account Control on. Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Step 2.

We just need to do a little update of Java and reenable Teatimer.

Update Java:

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Reenable Teatimer

• Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
• If prompted with a legal dialog, accept the warning.
• Click Mode and then on "Advanced Mode".
  
• You may be presented with a warning dialog. If so, press Yes.
• Click on
• Click on
• Check these checkboxes:
  
• Close/Exit Spybot Search and Destroy.

Step 3.

Now let's discuss the USB drive you have.

something else that I have a problem with is a 32Gb flash drive that is unrecognisable and I am looking fora way of recovering the data, any ideas ?

How long has it been unrecognizeable?

Did anything happen to it (i.e. dropped, spilled liquid on it or init, fell in liquid, etc.)?

Is the USB port end of it OK or is it deformed or broken?

Can it insert normally into a USB port on your computer or does it feel different when you attach it or remove it?

Do other USB drives attach and work on your computer now?



Please confirm completion of steps 1 and 2 then answer my quesitons in step 3

[nigella]

Now let's discuss the USB drive you have.

something else that I have a problem with is a 32Gb flash drive that is unrecognisable and I am looking fora way of recovering the data, any ideas ?

How long has it been unrecognizeable?

Did anything happen to it (i.e. dropped, spilled liquid on it or init, fell in liquid, etc.)?

Is the USB port end of it OK or is it deformed or broken?

Can it insert normally into a USB port on your computer or does it feel different when you attach it or remove it?

Do other USB drives attach and work on your computer now?



Please confirm completion of steps 1 and 2 then answer my quesitons in step 3

I have turned on User Access Control and removed old versions of Java and installed the latest JRE.


I plugged the USB stick in two weeks ago and it was not recognised. It was a number of months since I had last accessed it.

Nothing has happened to it, it has either been in my pocket or a drawer.

The USB port end looks to be fine - not misshaped.

It inserts normally,

I don't have another USB stick to try but I have connected my phone to the USB port and that is completely visible.

[CompCav]

I will get back to you with an approach to recover the data tomorrow after my instructor approves it. We needed to see if there were any physical issues before deciding on a tool to use. Check back tomorrow please.

CompCav

[nigella]

ok I will thanks again

[CompCav]

nigella,

We need to download Test Disk and Photorec to your desktop.

Double click on version 6.13 to extract it to a folder on your desktop labeled testdisk-6.13.

Double click the folder, it will open, and you will see photorec_win.exe

Before you execute the program insert the flash drive.

Right click on photorec_win.exe and click Run as administrator


A command like window will open.

At this point you need to refer to the step by step instructions here.

Go to Disk Selection on the page.


You should see the USB drive in the list to select.

Continue the steps as listed.

[nigella]

it doesn't display in the command window??

[CompCav]

With the drive in the computer close up PhotoRec and do this:


Run disk Management

Do the following:
Start -> Run
type diskmgmt.msc
Click "OK"

Disk management will open.

Click and hold the right side of the disk management Window and drag it to the right until you can see all the columns.

Take a screen Shot of the disk management Window and attach the screen shot to your reply. To do this hit CTRL-Print Screen and paste it into your next reply.

I also need to know the make and any model number information on the USB drive.

[nigella]

For some reason I cannot paste directly into a post

[CompCav]

Take a screen Shot of the disk management Window and attach the screen shot to your reply. To do this hit ALT-Print Screen or if necessary Fn-Alt-Print Screen to copy the screen.

Click Start >> All Programs >> Accessories >> Paint

Click Edit >> Paste

Save as .jpg file

Go to the box here to post. Click use Full Editor

Then click to attach files browse to where you saved the picture on your computer, click on the picture, then click Open to upload it.

Then click Add to post.

[nigella]

It was purchased from mymemory. I've just Looked on their website and here is a link to the page for the 32Gb USB stick

http://www.mymemory....sh-Drive---Blue