[bealestreet]

Merged post


Posted Today, 04:07 PM
I've been working hard to get this computer running properly. I installed a PCI wi-fi card, 2 GB kit of RAM, reformatted the PC, etc. Started fresh, basically.
It took 3 months for the computer to stop downloading Windows Updates. It seems they have quit, for now. I checked my computer's hard disk space.
Only 67.5 GB remain, of 111 GB. Using TreeSize to calculate the allocated space, I found some of the major space issues:

16.2 - System Volume Info - Why so much? Is there any way possible to make that smaller?
10 GB - winsxs (needed, I assume)
7 GB - personal files (will not delete)
1.8 GB - Programs and such... (mostly needed for daily use)
2.3 GB - pagefile.sys?
2 GB - hiberfil.sys?

I Thought the RAM would make the PC run smoother. IT did, for a little while. Still says 1.99 GB RAM on comp's properties. Is it possible my computer has a virus? At one point, I thought I got rid of CouponBar and MyFreeze Toolbar..
Using Hijack This, I found two things that stood out:
O4 - HKCU\..\Run: [Toadxitea] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Milaug\urabr.exe"
O4 - HKCU\..\Run: [Bubymaku] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Cuetyn\rygoi.exe"
I've never seen those before.Confirmed viruses. Moved to vault.

I've attached a screen cap of the processes running to show the CPU and Physical memory they're using. Hopefully that can help elaborate. Firefox's plugin container is huge. It makes the comp run slow, too, I think.
Help would be much appreciated.

Blake

Viruses removed. Need help speeding up the comp.

Attached Thumbnails

• 

Edited by bealestreet, 09 April 2012 - 04:15 PM.

[Advertisements]

Hello and welcome to Geekstogo!

We apologize for the delay in responding to your request for help.
If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

If you haven't done so yet, please go to Malware and Spyware Cleaning Guide and follow the steps instructed there. If you have already done this, we still need a new log to see what has changed since you originally posted your problem.

We need to create an OTL Report
Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Check the box that says Scan All Users.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

[Gammo]

Hello and welcome to Geekstogo!

We apologize for the delay in responding to your request for help.
If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Please include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

If you haven't done so yet, please go to Malware and Spyware Cleaning Guide and follow the steps instructed there. If you have already done this, we still need a new log to see what has changed since you originally posted your problem.

We need to create an OTL Report
Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Check the box that says Scan All Users.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

[bealestreet]

Hi, Gammo! Thanks for responding. I've been having trouble out of my computer (shared pc with my brother) over the past
3 months. At first, it could barely run. I had to use it in Safe Mode. After reformatting it, the overall performance speed increased tremendously. Until the Windows Updates bombarded my computer. The speed increased once more after I installed the 2 GB kit of RAM, about
a month or so ago. Then after 2 weeks, the performance speed started dropping. I think I found got rid of some viruses after my first post on this site.

With help of AVG, These 3 were "removed" since (well, hopefully):
Infected, Win32/Cryptor moved to AVG virus vault
O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Bubymaku] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Cuetyn\rygoi.exe" File not found

Warning, foud registry key reference to infected file
O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Toadxitea] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Milaug\urabr.exe" File not found

Infection, Trojan horse, Generic27.BOZQ
Blake and Trevor'sPC\appdata\local\Adobe\wkwzohxt.dll

Also, there was a tracking cookie.

In the OTL log, This line looks really suspicious:
[2012/04/05 19:39:44 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Toyzze
But AVG hasn't picked up anything on it.

The endless amount of updates has ceased. I may have installed them all.
These files seem to be taking up the most space on my HDD.
I would like help on reducing their size, if possible:

16.2 - System Volume Info - Why so much? Is there any way possible to make that smaller?
10 GB - winsxs (needed, I assume)
7 GB - personal files (will not delete)
1.8 GB - Programs and such... (mostly needed for daily use)
2.3 GB - pagefile.sys?
2 GB - hiberfil.sys?


The OTL log did not make an "Extras" log. I followed all the instructions, checked the folder OTL resides in,
and the Extras.txt log didn't pop up.

OTL LOG BELOW~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OTL logfile created on: 4/9/2012 4:52:45 PM - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Blake and Trevor'sPC\Desktop\Downloads
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.14 Gb Available Physical Memory | 57.05% Memory free
4.21 Gb Paging File | 3.15 Gb Available in Paging File | 74.68% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 70.02 Gb Free Space | 62.64% Space Free | Partition Type: NTFS

Computer Name: BLAKEANDTREV-PC | User Name: Blake and Trevor'sPC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/05 16:26:22 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Blake and Trevor'sPC\Desktop\Downloads\OTL.exe
PRC - [2012/03/22 10:04:23 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/01/24 18:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2011/11/28 02:19:04 | 001,229,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2011/10/12 07:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/10/10 07:23:34 | 000,973,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2011/09/08 21:53:26 | 000,743,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2011/08/15 07:21:40 | 000,337,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/08/02 07:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2009/06/24 16:38:04 | 000,897,024 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\Airlink101\Airlink101 802.11g Wireless LAN Monitor\RtWLan.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/05 11:34:54 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files\Airlink101\Airlink101 802.11g Wireless LAN Monitor\RtlService.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe


========== Modules (No Company Name) ==========

MOD - [2012/03/22 10:04:23 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/01/09 20:44:20 | 000,166,912 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2011/12/31 22:02:36 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2006/11/02 04:46:05 | 000,061,440 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2011/10/12 07:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/08/02 07:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2009/02/05 11:34:54 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files\Airlink101\Airlink101 802.11g Wireless LAN Monitor\RtlService.exe -- (Realtek92SU)
SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012/01/18 01:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2011/10/07 07:23:48 | 000,230,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2011/10/04 07:21:16 | 000,016,720 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/09/13 07:30:10 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/08/08 07:08:58 | 000,040,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/07/11 02:14:38 | 000,295,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/07/11 02:14:02 | 000,024,272 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/07/11 02:14:00 | 000,023,120 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV - [2011/07/11 02:13:58 | 000,134,736 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/03/18 11:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2010/11/26 18:02:28 | 000,015,672 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV - [2009/09/14 20:57:32 | 000,368,128 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL85n86.sys -- (RTL85n86)
DRV - [2007/06/29 10:11:02 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/06/20 04:28:38 | 000,267,264 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/11/02 02:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [1996/04/03 14:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FD D5 EC 5E 6D 13 CD 01 [binary data]
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2452623742-903163796-337912196-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Users\Blake and Trevor'sPC\Desktop\Trevor's Folder\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/01/31 17:34:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/22 10:04:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2011/12/24 16:47:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Mozilla\Extensions
[2012/04/05 16:05:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Mozilla\Firefox\Profiles\rro737ck.default\extensions
[2012/04/06 15:46:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/04/06 15:46:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\BLAKE AND TREVOR'SPC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RRO737CK.DEFAULT\EXTENSIONS\{258735DC-6743-4805-95FC-F95941FFFDAD}.XPI
[2012/03/22 10:04:23 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/13 20:36:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/13 20:36:19 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Bubymaku] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Cuetyn\rygoi.exe" File not found
O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Toadxitea] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Milaug\urabr.exe" File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-2452623742-903163796-337912196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.55.24.10 209.55.27.13 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0E8C681-B8EC-49AE-BDFE-CB446DA161E9}: DhcpNameServer = 209.55.24.10 209.55.27.13 8.8.8.8
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Blake and Trevor'sPC\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Blake and Trevor'sPC\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{07d3e33f-2e80-11e1-8684-001bb95cc63b}\Shell - "" = AutoRun
O33 - MountPoints2\{07d3e33f-2e80-11e1-8684-001bb95cc63b}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/09 16:51:58 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\Desktop\New Folder
[2012/04/07 17:07:56 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\Opera
[2012/04/07 13:34:40 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\K-Meleon
[2012/04/07 13:14:27 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012/04/07 13:14:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012/04/07 13:14:27 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedFan
[2012/04/06 15:46:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012/04/05 19:39:44 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Toyzze
[2012/04/05 17:37:34 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\AVG
[2012/04/05 17:36:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012/04/05 17:36:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011
[2012/04/05 16:59:58 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/04/05 15:50:37 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\Apps
[2012/04/05 15:35:54 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\JAM Software
[2012/04/05 15:35:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize Free
[2012/04/05 15:35:52 | 000,000,000 | ---D | C] -- C:\Program Files\JAM Software
[2012/04/05 15:32:34 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\IObit
[2012/04/05 15:32:33 | 000,029,016 | ---- | C] (IObit) -- C:\Windows\System32\SmartDefragBootTime.exe
[2012/04/05 15:32:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 2
[2012/04/05 15:32:28 | 000,000,000 | ---D | C] -- C:\Program Files\IObit
[2012/04/05 14:31:04 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012/04/05 14:31:03 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/03/31 11:48:37 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\Apple Computer
[2012/03/31 11:48:36 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Apple Computer
[2012/03/31 11:48:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/03/31 11:47:32 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2012/03/31 11:47:30 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\Desktop\Mozilla Plugins
[2012/03/31 11:46:30 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/03/31 11:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012/03/31 11:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/03/31 11:45:12 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\Apple
[2012/03/31 11:45:09 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2012/03/31 11:43:27 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012/03/31 11:43:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2012/03/31 11:43:10 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012/03/18 17:56:51 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Local\Spotify
[2012/03/18 17:55:48 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Spotify
[2012/03/17 01:19:26 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2012/03/16 18:27:53 | 000,000,000 | ---D | C] -- C:\Program Files\Origin Games
[2012/03/16 18:27:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2012/03/16 18:25:58 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Origin
[2012/03/16 17:16:25 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2012/03/16 17:16:25 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2012/03/16 17:16:25 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2012/03/16 16:38:55 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/09 15:31:42 | 000,004,768 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/09 15:31:42 | 000,004,768 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/09 09:43:23 | 094,259,061 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012/04/09 09:31:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/07 18:59:31 | 000,015,397 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\Ned+Gerblansky+NedSP.jpg
[2012/04/07 18:29:18 | 000,218,223 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\census.cache
[2012/04/07 18:29:02 | 000,155,078 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\ars.cache
[2012/04/07 18:09:35 | 000,000,036 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\housecall.guid.cache
[2012/04/07 17:27:26 | 000,000,943 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/04/07 13:14:28 | 000,000,804 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\SpeedFan.lnk
[2012/04/07 13:14:27 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
[2012/04/06 17:36:21 | 000,262,660 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/04/06 15:24:55 | 2138,628,096 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/05 17:42:45 | 000,069,694 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\error.jpg
[2012/04/05 17:36:22 | 000,000,959 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\AVG PC Tuneup 2011.lnk
[2012/04/05 17:36:22 | 000,000,935 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\AVG PC Tuneup 2011.lnk
[2012/04/05 16:55:03 | 000,062,279 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\scrn_Cap.jpg
[2012/04/05 16:01:16 | 000,604,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/05 16:01:16 | 000,103,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/05 15:38:29 | 000,000,104 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\Computer - Shortcut.lnk
[2012/04/05 15:35:53 | 000,001,038 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\TreeSize Free.lnk
[2012/04/05 15:32:32 | 000,000,987 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Defrag 2.lnk
[2012/04/05 15:32:32 | 000,000,963 | ---- | M] () -- C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012/04/05 14:31:04 | 000,001,057 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\Revo Uninstaller.lnk
[2012/03/31 12:26:32 | 000,001,535 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/23 20:11:58 | 000,014,336 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/18 17:56:49 | 000,001,786 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\Spotify.lnk
[2012/03/17 21:54:47 | 000,270,825 | ---- | M] () -- C:\Users\Blake and Trevor'sPC\Desktop\dog medications weekly monthly.pdf
[2012/03/17 14:09:57 | 000,230,208 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/17 01:18:50 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2012/03/17 01:18:28 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2012/03/17 01:03:04 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2012/03/17 01:03:04 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2012/03/17 01:02:46 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012/03/14 03:04:17 | 000,000,127 | ---- | M] () -- C:\Windows\System32\MRT.INI
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/07 18:59:29 | 000,015,397 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\Ned+Gerblansky+NedSP.jpg
[2012/04/07 18:29:18 | 000,218,223 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\census.cache
[2012/04/07 18:29:02 | 000,155,078 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\ars.cache
[2012/04/07 18:09:35 | 000,000,036 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\housecall.guid.cache
[2012/04/07 13:14:28 | 000,000,804 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\SpeedFan.lnk
[2012/04/07 13:14:25 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
[2012/04/05 17:42:45 | 000,069,694 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\error.jpg
[2012/04/05 17:36:22 | 000,000,959 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\AVG PC Tuneup 2011.lnk
[2012/04/05 17:36:22 | 000,000,935 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\AVG PC Tuneup 2011.lnk
[2012/04/05 16:55:03 | 000,062,279 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\scrn_Cap.jpg
[2012/04/05 15:38:29 | 000,000,104 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\Computer - Shortcut.lnk
[2012/04/05 15:35:53 | 000,001,038 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\TreeSize Free.lnk
[2012/04/05 15:32:33 | 000,015,672 | ---- | C] () -- C:\Windows\System32\drivers\SmartDefragDriver.sys
[2012/04/05 15:32:32 | 000,000,987 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Application Data\Microsoft\Internet Explorer\Quick Launch\Smart Defrag 2.lnk
[2012/04/05 15:32:32 | 000,000,963 | ---- | C] () -- C:\Users\Public\Desktop\Smart Defrag 2.lnk
[2012/04/05 14:31:04 | 000,001,057 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\Revo Uninstaller.lnk
[2012/03/31 12:26:32 | 000,001,535 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/31 11:45:10 | 000,001,830 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/03/18 17:56:49 | 000,001,786 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\Spotify.lnk
[2012/03/18 17:56:49 | 000,001,772 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2012/03/17 21:44:36 | 000,270,825 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\Desktop\dog medications weekly monthly.pdf
[2012/03/17 01:18:50 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2012/03/17 01:18:28 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2012/03/17 01:02:46 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012/03/14 03:04:17 | 000,000,127 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2012/03/08 12:39:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012/03/08 12:39:28 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012/03/06 09:47:14 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012/01/02 19:56:16 | 000,183,808 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2012/01/02 19:56:15 | 000,810,496 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2012/01/02 19:56:15 | 000,080,896 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/12/25 09:25:46 | 000,014,336 | ---- | C] () -- C:\Users\Blake and Trevor'sPC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/26 01:48:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

========== LOP Check ==========

[2012/03/26 15:51:44 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Audacity
[2012/04/05 17:37:37 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\AVG
[2012/01/01 16:21:06 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\AVG2012
[2012/04/05 15:32:34 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\IObit
[2012/04/05 15:35:54 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\JAM Software
[2011/12/24 17:20:55 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Leadertech
[2012/03/16 18:27:54 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Origin
[2012/04/05 16:00:39 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\SoftGrid Client
[2012/03/18 17:56:56 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Spotify
[2012/04/05 19:39:47 | 000,000,000 | ---D | M] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Toyzze
[2012/04/05 16:14:37 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >

Edited by bealestreet, 09 April 2012 - 04:28 PM.

[Gammo]

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Bubymaku] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Cuetyn\rygoi.exe" File not found
  O4 - HKU\S-1-5-21-2452623742-903163796-337912196-1000..\Run: [Toadxitea] "C:\Users\Blake and Trevor'sPC\AppData\Roaming\Milaug\urabr.exe" File not found
  [2012/04/05 19:39:44 | 000,000,000 | ---D | C] -- C:\Users\Blake and Trevor'sPC\AppData\Roaming\Toyzze
  [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
  [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  
  :Services
  
  :Reg
  
  :Files
  ipconfig /flushdns /c
  C:\Users\Blake and Trevor'sPC\AppData\Roaming\Cuetyn
  C:\Users\Blake and Trevor'sPC\AppData\Roaming\Milaug
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [emptyflash]
  [createrestorepoint]
  [reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

16.2 - System Volume Info - Why so much? Is there any way possible to make that smaller?

Contains your system restore points.It's possible to make your PC store less restore points, although I don't recommend it.

2.3 GB - pagefile.sys?

Contains your 'virtual memory'. If your PC runs out of RAM, it uses this files instead (which is slower of course).

2 GB - hiberfil.sys?

Contains a copy of your RAM. Is necessary for hibernation to work.



Was that all? Are you still experiencing any problems? Do you still have questions? If not, I'll give you my cleanup and prevention instructions.

[bealestreet]

Was that all? Are you still experiencing any problems? Do you still have questions? If not, I'll give you my cleanup and prevention instructions.

That's really it. I followed your instructions and the computer isn't running at the max CPU usage with just one tab of Firefox up, so it has improved a bit. However, Firefox is using 60-70k. I think the plugins are causing it to slow my pc. BUT, that's for another forum, I think.

I'm ready for your next instructions.

[Gammo]

Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. ^_^

• Download OTC to your desktop and run it
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files
Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall
You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated
It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser
Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.

If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.

• A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
• SpywareBlaster to help prevent spyware from installing in the first place.
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful
Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?
If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,
Gammo