[Mobilesites]

OTL logfile created on: 4/18/2012 10:40:02 AM - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Bob\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.96 Gb Total Physical Memory | 2.43 Gb Available Physical Memory | 61.30% Memory free
7.92 Gb Paging File | 6.14 Gb Available in Paging File | 77.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 283.40 Gb Total Space | 160.67 Gb Free Space | 56.69% Space Free | Partition Type: NTFS

Computer Name: BOB-DELL | User Name: Bob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/17 13:35:27 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Downloads\OTL.exe
PRC - [2012/03/22 12:09:12 | 001,014,112 | ---- | M] (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
PRC - [2012/03/21 09:31:35 | 000,108,136 | ---- | M] (Siber Systems) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
PRC - [2012/02/14 19:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Bob\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/02/03 03:55:26 | 000,715,048 | ---- | M] (Anvisoft) -- C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe
PRC - [2012/01/24 18:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2011/06/05 21:41:34 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
PRC - [2011/06/05 21:12:44 | 000,296,808 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
PRC - [2011/05/19 10:55:14 | 000,913,512 | ---- | M] (Enounce Incorporated) -- C:\Program Files (x86)\Enounce\MySpeed\MySpeed.exe
PRC - [2010/12/15 13:31:20 | 000,460,144 | ---- | M] () -- C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
PRC - [2010/12/15 13:22:42 | 001,085,440 | ---- | M] () -- C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe
PRC - [2010/08/20 16:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
PRC - [2010/07/02 14:25:48 | 000,656,896 | ---- | M] (j2 Global Communications, Inc.) -- C:\Program Files (x86)\eFax Messenger 4.4\J2GTray.exe
PRC - [2009/06/24 21:19:50 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
PRC - [2009/06/04 20:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
PRC - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/12/18 15:05:28 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2007/01/01 17:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Users\Bob\AppData\Roaming\Google\Google Talk\googletalk.exe


========== Modules (No Company Name) ==========

MOD - [2012/03/16 15:42:58 | 000,315,392 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libtidy.dll
MOD - [2012/03/16 15:42:56 | 000,433,664 | ---- | M] () -- C:\Program Files (x86)\Evernote\Evernote\libxml2.dll
MOD - [2012/02/16 04:44:03 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012/02/16 04:34:29 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2012/01/31 22:15:02 | 000,547,112 | ---- | M] () -- C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\sqlite3.dll
MOD - [2011/11/15 04:18:27 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/08/04 15:09:16 | 000,053,528 | ---- | M] (Mozy, Inc.) [Auto | Running] -- C:\Program Files\MozyPro\mozyprobackup.exe -- (mozyprobackup)
SRV:64bit: - [2010/12/03 12:09:08 | 000,341,296 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Program Files\Common Files\Nitro PDF\Reader\1.0\NitroPDFReaderDriverServicex64.exe -- (NitroReaderDriverReadSpool)
SRV:64bit: - [2009/07/16 21:06:22 | 000,033,280 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/29 00:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe -- (STacSV)
SRV:64bit: - [2008/12/18 15:05:28 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2012/02/03 03:55:28 | 000,296,232 | ---- | M] (Anvisoft) [Auto | Stopped] -- C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDSrv.exe -- (asdsrv)
SRV - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/08/10 15:22:12 | 000,032,336 | ---- | M] (Sanford, L.P.) [Auto | Running] -- C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe -- (DymoPnpService)
SRV - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/06/05 21:12:44 | 000,296,808 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe -- (DragonSvc)
SRV - [2010/12/15 13:31:20 | 000,460,144 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2010/12/15 13:22:42 | 001,085,440 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe -- (FlipShareServer)
SRV - [2010/10/22 14:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/08/20 16:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/10/23 06:51:52 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2009/06/29 00:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe -- (STacSV)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 20:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®
SRV - [2009/05/21 09:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2004/04/18 07:11:14 | 000,036,864 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\OpenSSH\bin\cygrunsrv.exe -- (OpenSSHd)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 02:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/09 04:26:30 | 000,024,360 | ---- | M] (Anvisoft) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\avhips.sys -- (avhips)
DRV:64bit: - [2012/01/09 04:26:30 | 000,020,264 | ---- | M] (Anvisoft) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avfsmn.sys -- (avfsmn)
DRV:64bit: - [2011/10/07 06:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2011/09/13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011/08/08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011/08/04 15:09:04 | 000,066,552 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mozypro.sys -- (mozyproFilter)
DRV:64bit: - [2011/07/11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2011/07/11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:64bit: - [2011/07/11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:64bit: - [2011/07/11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:64bit: - [2011/03/11 02:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 02:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/18 16:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/09/23 01:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010/07/03 15:43:39 | 000,198,944 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman)
DRV:64bit: - [2009/07/16 21:06:20 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:64bit: - [2009/07/16 21:06:18 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/07/09 06:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/29 00:44:38 | 000,487,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/06/15 14:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/04 06:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/06/02 23:16:56 | 007,333,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/05/19 23:10:00 | 000,393,728 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/08 04:15:18 | 000,215,552 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/02/05 07:54:10 | 000,225,328 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:64bit: - [2009/01/09 15:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2006/11/01 13:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.mybasicisp.net
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE:64bit: - HKLM\..\SearchScopes\{BFE8C948-10C3-45AC-A59F-A5BA19C19A9A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {F89CA8A7-8F5E-4E94-9E14-DCB324E15A43}
IE - HKLM\..\SearchScopes\{F89CA8A7-8F5E-4E94-9E14-DCB324E15A43}: "URL" = http://www.bing.com/...rc=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@dymo.com/DymoLabelFramework: C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll ( Sanford L.P.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/01/27 10:11:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/02/01 09:17:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Siber Systems\AI RoboForm\Firefox [2012/03/21 09:32:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/13 23:00:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/03/21 09:06:57 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012/01/27 10:11:23 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{240E3ABF-7AC8-11E1-826D-B8AC6F996F26}: C:\Users\Bob\AppData\Local\{240E3ABF-7AC8-11E1-826D-B8AC6F996F26}\

[2011/05/17 20:38:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Extensions
[2011/05/17 20:38:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Extensions\{ea278cf8-93cd-484f-b951-57360482d33a}
[2012/04/14 07:20:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions
[2010/09/11 21:33:24 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2012/03/21 09:14:47 | 000,000,000 | ---D | M] (Mobile Marketing Resources Community Toolbar) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{06849336-9cf6-4fd5-82dc-316e56d03ff7}
[2011/05/14 09:23:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/04/11 06:44:37 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2010/07/03 20:01:03 | 000,000,000 | ---D | M] (del.icio.us) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{5a2b4e34-ce62-42e9-a658-06ba4490adf8}
[2010/07/03 20:01:03 | 000,000,000 | ---D | M] (Niche Watch Tool) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{5c1a272d-6af9-4229-b821-11703c6b5ccf}
[2012/01/19 09:32:50 | 000,000,000 | ---D | M] (MeasureIt) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}
[2010/07/03 20:01:04 | 000,000,000 | ---D | M] (CATS Toolbar) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{8ca292c6-ec28-4eec-baa5-87c950ecd07d}
[2011/05/27 09:46:58 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2011/03/22 11:34:29 | 000,000,000 | ---D | M] (Pixlr Grabber) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{d47a9f51-8281-43fa-f450-f28ef8735e9a}
[2012/03/21 12:53:01 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2012/01/19 09:32:50 | 000,000,000 | ---D | M] (LinkedIn Companion for Firefox) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{e2337727-f9c9-411b-929e-287584341d1a}
[2012/03/21 12:53:05 | 000,000,000 | ---D | M] (Recruiter.com Community Toolbar) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{f4ae7cd3-d355-4e66-a8dc-a050070d29cf}
[2010/07/03 20:01:11 | 000,000,000 | ---D | M] ("KeywordSpyâ„¢ SEO/PPC") -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\{fae5bcbc-dd73-439a-a15e-5b9ff39c0e9b}
[2012/03/21 09:14:41 | 000,000,000 | ---D | M] (CATS Toolbar) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\[email protected]
[2010/07/03 20:01:00 | 000,000,000 | ---D | M] (TimeTracker) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\0ryqupsn.default\extensions\[email protected]
[2010/06/28 23:57:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\hzsuutp1.default\extensions
[2010/02/06 10:22:57 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\hzsuutp1.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2012/04/13 23:00:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/11/29 20:27:07 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/03/13 00:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/11/12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/13 00:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/13 00:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Screen Capture Plugin (Enabled) = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpngackimfmofbokmjmljamhdncknpmg\5.0.3_0\plugin/screen_capture.dll
CHR - plugin: RoboForm Plugin for Google Chrome/Opera/etc. (Enabled) = C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\plugin/rf-chrome-plugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: DYMO Label Framework (Enabled) = C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: WildTangent Games App Presence Detector (Enabled) = C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Screen Capture (by Google) = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpngackimfmofbokmjmljamhdncknpmg\5.0.4_0\
CHR - Extension: AVG Safe Search = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\
CHR - Extension: Japanese Vocab Tutor = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldemblkooloonmjfiainhkhmmlelfnfb\1.3_0\
CHR - Extension: Skype Click to Call = C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\

O1 HOSTS File: ([2012/04/17 22:41:53 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O2:64bit: - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [Anvi Smart Defender] C:\Program Files (x86)\Anvisoft\Anvi Smart Defender\ASDTray.exe (Anvisoft)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DNS7reminder] C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001..\Run: [3xAV] C:\Program Files (x86)\Enounce\MySpeed\MySpeed.exe (Enounce Incorporated)
O4 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001..\Run: [googletalk] C:\Users\Bob\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O4 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001..\Run: [RoboForm] C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKLM..\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" File not found
O4 - Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2011/12/24 10:05:19 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Bob\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eFax 4.4.lnk = C:\Program Files (x86)\eFax Messenger 4.4\J2GTray.exe (j2 Global Communications, Inc.)
O4 - Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8:64bit: - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8:64bit: - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Customize Menu - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: Show RoboForm Toolbar - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..Trusted Domains: highrisehq.com ([careergoals] https in Trusted sites)
O15 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-1873536395-2207681481-3875897620-1001\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3BEA45FA-D3ED-4EE9-80D5-FE21F8ECA9FB}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8CC56B0F-565F-487F-9FFA-580F9C6808C9}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/18 09:19:04 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Bob\Desktop\GooredFix.exe
[2012/04/17 22:41:46 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/04/17 14:22:33 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/04/17 14:14:03 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Bob\Desktop\aswMBR.exe
[2012/04/17 13:11:23 | 000,000,000 | ---D | C] -- C:\Users\Bob\Documents\@Read Review
[2012/04/16 20:39:03 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{53484B47-6DEF-4D50-9109-8D2EA4F56CD9}
[2012/04/16 20:38:50 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{032931A3-6E18-4E5D-8EB0-722E3C9C2DCF}
[2012/04/16 19:59:37 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/04/16 18:53:49 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/04/15 08:23:08 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/04/15 08:23:08 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/04/15 08:23:08 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/04/15 08:23:00 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/04/15 08:20:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/04/14 15:40:52 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{88C36626-9CB8-40A3-AA56-D05EF34F6850}
[2012/04/14 15:40:41 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{C7DE92E0-FA99-4563-87EE-AE1137C0647E}
[2012/04/14 15:36:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MALWAREBYTES ANTI-MALWARE
[2012/04/13 09:05:48 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{98438F55-FFC3-4B9B-A1A3-4C91190B37E3}
[2012/04/13 09:05:37 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{58F67726-F003-4F02-B208-693296DD946B}
[2012/04/12 21:08:13 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{31B37272-024E-46D5-BFDF-C5DECDEDEBE0}
[2012/04/12 08:04:55 | 000,000,000 | ---D | C] -- C:\Users\Bob\Desktop\GooredFix Backups
[2012/04/12 04:47:40 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{78607B35-ECC1-48E1-801A-CAD833B5E797}
[2012/04/10 15:44:13 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{ED7C3B49-6486-4C57-91C7-17BB02B45BA2}
[2012/04/09 07:32:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Tools
[2012/04/09 07:21:42 | 000,230,952 | ---- | C] (PC Tools) -- C:\Windows\SysNative\drivers\PCTSD64.sys
[2012/04/09 07:21:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PC Tools
[2012/04/09 07:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/04/09 07:21:06 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\TestApp
[2012/04/08 13:42:16 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{0463CC8D-EAD6-4BE9-8BC2-F8B6704B8969}
[2012/04/06 09:56:45 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\Malwarebytes
[2012/04/06 09:56:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/06 09:49:46 | 002,073,136 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Bob\Desktop\tdsskiller.exe
[2012/04/04 10:23:16 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{15C15D85-78C8-4F82-B347-CEF4E8ECBD0C}
[2012/04/03 08:37:17 | 000,024,360 | ---- | C] (Anvisoft) -- C:\Windows\SysNative\drivers\avhips.sys
[2012/04/03 08:37:17 | 000,020,264 | ---- | C] (Anvisoft) -- C:\Windows\SysNative\drivers\avfsmn.sys
[2012/04/03 08:37:17 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anvisoft
[2012/04/03 08:37:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Anvisoft
[2012/04/03 06:18:19 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/04/02 18:34:12 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{0F873F8A-7403-445A-969B-D7526FBCAD0A}
[2012/04/02 07:53:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote
[2012/03/31 10:11:14 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{FC852DBB-DDCA-444D-B91E-7DB27FFD0C26}
[2012/03/29 21:14:14 | 000,000,000 | ---D | C] -- C:\Users\Bob\Documents\facebook
[2012/03/29 10:42:43 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{FC9CC576-C7C6-4EF5-901F-EC812B39EBD7}
[2012/03/27 12:28:27 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{B082F103-FE44-47DD-9F59-CEEC343D442C}
[2012/03/27 12:28:13 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{B1105F89-E26A-4E93-A1A8-2EA949830C3E}
[2012/03/23 22:05:20 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\CurationSoft
[2012/03/23 22:05:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CurationSoft
[2012/03/20 14:04:25 | 000,000,000 | ---D | C] -- C:\Users\Bob\Documents\BU
[2012/03/20 11:34:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ad Spot Sniper
[2012/03/20 03:28:19 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{B1B54B1A-6B23-4B3F-A272-60ED9DF65544}
[2012/03/20 03:27:54 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{4EA0F713-27DB-4F59-9770-38E6086990C8}
[2012/03/19 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{E4DF19A0-D7BC-4BC3-9194-85245E6C2204}
[2012/03/19 22:20:30 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Local\{83ED9E45-982B-4E28-9361-CD7EB6DE817B}
[1 C:\Users\Bob\Desktop\*.tmp files -> C:\Users\Bob\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/18 10:47:09 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/18 10:47:09 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/18 10:43:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/18 10:36:58 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/18 10:35:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/18 10:35:48 | 3190,050,816 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/18 10:21:29 | 000,000,066 | ---- | M] () -- C:\Users\Bob\AppData\Local\CATSWord.ini
[2012/04/18 09:19:06 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Bob\Desktop\GooredFix.exe
[2012/04/18 06:20:39 | 095,468,922 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/04/17 22:41:53 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2012/04/17 21:30:56 | 000,001,258 | ---- | M] () -- C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
[2012/04/17 14:44:55 | 617,221,003 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/04/17 14:14:20 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Bob\Desktop\aswMBR.exe
[2012/04/17 05:19:05 | 000,002,844 | ---- | M] () -- C:\Windows\mozypro.blk
[2012/04/17 05:19:05 | 000,001,410 | ---- | M] () -- C:\Windows\mozypro.flt
[2012/04/16 22:46:31 | 000,491,489 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/04/16 19:59:43 | 000,060,304 | ---- | M] () -- C:\Users\Bob\g2mdlhlpx.exe
[2012/04/16 18:41:12 | 000,007,588 | ---- | M] () -- C:\Users\Bob\AppData\Local\resmon.resmoncfg
[2012/04/15 12:13:05 | 000,783,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/15 12:13:05 | 000,663,450 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/04/15 12:13:05 | 000,122,286 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/04/13 23:01:02 | 000,001,096 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/04/13 15:45:49 | 000,002,346 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/04/12 14:01:55 | 001,802,332 | ---- | M] () -- C:\Users\Bob\Desktop\bookmarks-2012-04-12.json
[2012/04/11 05:49:37 | 000,001,097 | ---- | M] () -- C:\Users\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk
[2012/04/06 09:49:48 | 002,073,136 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Bob\Desktop\tdsskiller.exe
[2012/04/06 07:05:25 | 000,000,000 | ---- | M] () -- C:\Users\Bob\defogger_reenable
[2012/04/04 19:11:20 | 000,005,333 | ---- | M] () -- C:\Users\Bob\.recently-used.xbel
[2012/04/03 15:00:24 | 000,205,236 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2012/04/03 08:37:17 | 000,001,150 | ---- | M] () -- C:\Users\Bob\Desktop\Anvi Smart Defender.lnk
[2012/03/28 15:54:20 | 000,001,159 | ---- | M] () -- C:\Users\Bob\Desktop\Deck 3 8 12 - Shortcut.lnk
[2012/03/23 22:05:06 | 000,000,873 | ---- | M] () -- C:\Users\Public\Desktop\CurationSoft.lnk
[2012/03/23 22:04:01 | 001,730,710 | ---- | M] () -- C:\Users\Bob\Desktop\CurationSoft.air
[2012/03/23 14:26:28 | 000,040,426 | ---- | M] () -- C:\Users\Bob\Documents\The-Godfather-Switch-for-Recruiters-Handout.pdf
[2012/03/20 11:34:28 | 000,000,893 | ---- | M] () -- C:\Users\Public\Desktop\Ad Spot Sniper.lnk
[2012/03/20 03:08:31 | 000,777,526 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/19 11:35:51 | 017,767,424 | ---- | M] () -- C:\Users\Bob\AppData\Local\LocalMarketingTitanSetup.msi
[1 C:\Users\Bob\Desktop\*.tmp files -> C:\Users\Bob\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/16 19:59:43 | 000,060,304 | ---- | C] () -- C:\Users\Bob\g2mdlhlpx.exe
[2012/04/15 08:23:08 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/04/15 08:23:08 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/04/15 08:23:08 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/04/15 08:23:08 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/04/15 08:23:08 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/04/13 23:01:01 | 000,001,108 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/04/13 23:01:01 | 000,001,096 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/04/12 14:01:48 | 001,802,332 | ---- | C] () -- C:\Users\Bob\Desktop\bookmarks-2012-04-12.json
[2012/04/06 07:05:25 | 000,000,000 | ---- | C] () -- C:\Users\Bob\defogger_reenable
[2012/04/04 19:11:20 | 000,005,333 | ---- | C] () -- C:\Users\Bob\.recently-used.xbel
[2012/04/03 15:00:24 | 000,205,236 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012/04/03 08:37:17 | 000,001,150 | ---- | C] () -- C:\Users\Bob\Desktop\Anvi Smart Defender.lnk
[2012/03/28 15:54:20 | 000,001,159 | ---- | C] () -- C:\Users\Bob\Desktop\Deck 3 8 12 - Shortcut.lnk
[2012/03/23 22:05:06 | 000,000,885 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CurationSoft.lnk
[2012/03/23 22:05:06 | 000,000,873 | ---- | C] () -- C:\Users\Public\Desktop\CurationSoft.lnk
[2012/03/23 22:04:09 | 001,730,710 | ---- | C] () -- C:\Users\Bob\Desktop\CurationSoft.air
[2012/03/23 14:26:27 | 000,040,426 | ---- | C] () -- C:\Users\Bob\Documents\The-Godfather-Switch-for-Recruiters-Handout.pdf
[2012/03/20 11:34:28 | 000,000,905 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad Spot Sniper.lnk
[2012/03/20 11:34:28 | 000,000,893 | ---- | C] () -- C:\Users\Public\Desktop\Ad Spot Sniper.lnk
[2012/01/27 10:03:39 | 000,221,302 | ---- | C] () -- C:\Windows\hpoins19.dat
[2012/01/27 10:03:39 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2012/01/26 12:20:52 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat.temp
[2012/01/14 12:19:10 | 000,003,235 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\SAS7_000.DAT
[2012/01/13 11:43:25 | 000,000,066 | ---- | C] () -- C:\Users\Bob\AppData\Local\CATSWord.ini
[2012/01/04 23:38:29 | 017,767,424 | ---- | C] () -- C:\Users\Bob\AppData\Local\LocalMarketingTitanSetup.msi
[2011/11/12 11:46:30 | 000,038,451 | ---- | C] () -- C:\Users\Bob\AppData\Local\CATSOutlookCompanies.inf
[2011/10/14 06:47:42 | 000,840,971 | ---- | C] () -- C:\Users\Bob\AppData\Local\census.cache
[2011/10/14 06:46:54 | 000,127,874 | ---- | C] () -- C:\Users\Bob\AppData\Local\ars.cache
[2011/10/14 06:36:14 | 000,000,036 | ---- | C] () -- C:\Users\Bob\AppData\Local\housecall.guid.cache
[2011/09/21 20:52:23 | 000,000,110 | ---- | C] () -- C:\Windows\Adweek.INI
[2011/09/21 11:13:49 | 000,777,526 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/08/24 21:13:33 | 000,009,352 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\Microsoft Excel 97-2003.EML
[2011/08/20 12:05:58 | 000,011,446 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\Microsoft Excel 97-2003.TSK
[2011/08/08 12:40:29 | 000,000,126 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2011/08/08 07:06:57 | 000,038,458 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2011/07/05 14:20:53 | 000,016,896 | ---- | C] () -- C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/24 13:20:54 | 001,526,468 | ---- | C] () -- C:\Windows\SysWow64\libeay32.dll
[2011/04/24 13:20:54 | 000,312,885 | ---- | C] () -- C:\Windows\SysWow64\ssleay32.dll
[2011/04/24 13:20:54 | 000,000,320 | ---- | C] () -- C:\Users\Bob\AppData\Local\CATSOutlook.ini
[2011/04/23 22:20:19 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011/04/23 22:20:19 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011/03/29 17:04:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/02/17 10:53:18 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2011/01/13 11:05:11 | 000,623,642 | ---- | C] () -- C:\Windows\XHeader Uninstaller.exe
[2010/09/06 13:02:04 | 000,023,140 | ---- | C] () -- C:\Windows\hpqins15.dat
[2010/07/03 19:32:26 | 000,007,588 | ---- | C] () -- C:\Users\Bob\AppData\Local\resmon.resmoncfg

========== LOP Check ==========

[2010/01/27 09:47:17 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Absolute
[2010/12/29 07:53:05 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Absolute Software
[2011/05/03 11:53:08 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Affilorama
[2009/12/04 15:58:17 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Artisteer
[2011/12/03 15:51:17 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\AVG
[2011/10/14 08:00:38 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\AVG2012
[2012/02/07 10:08:02 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\CATS Software, Inc
[2011/12/20 20:30:16 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\com.blueprintcentral.keywordblaze
[2011/12/07 12:24:31 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\com.springbox.mobilizer
[2012/03/23 22:05:20 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\CurationSoft
[2012/04/18 10:38:04 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Dropbox
[2010/06/11 21:00:24 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Echo Software
[2011/12/14 11:48:40 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\eFax Messenger
[2011/05/14 21:28:11 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\EurekaLog
[2012/04/17 17:02:49 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\FileZilla
[2011/10/20 19:39:27 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Flip Video
[2012/04/04 19:11:20 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\gtk-2.0
[2011/04/20 10:23:36 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\j2 Global
[2009/12/08 09:36:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\KompoZer
[2011/02/19 09:38:00 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\kompozer.net
[2011/12/12 16:33:14 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Niche
[2012/04/16 16:48:11 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Nitro PDF
[2011/03/02 07:54:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Notepad++
[2012/01/10 19:35:39 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Nuance
[2011/03/19 11:27:44 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\OpenOffice.org
[2010/08/08 11:28:36 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\OverDrive
[2011/04/17 16:40:47 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\PrimoPDF
[2011/03/19 11:52:46 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\RoboForm
[2011/12/12 22:22:12 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\RockstarSuite
[2011/12/26 23:02:35 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\SEORankFinderv2
[2011/06/09 11:17:46 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\TeamViewer
[2012/04/09 07:21:06 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\TestApp
[2011/12/30 22:18:40 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\TightVNC
[2011/09/19 16:17:07 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2011/03/24 13:55:28 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\ViralSubmitter
[2011/03/02 13:05:30 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Windows Live Writer
[2011/12/08 12:05:25 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\YourLocalShorcut
[2011/10/28 08:03:04 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 873 bytes -> C:\Users\Bob\Documents\KPMG Connect!.eml:OECustomProperty
@Alternate Data Stream - 235 bytes -> C:\ProgramData\Temp:0FF263E8
@Alternate Data Stream - 143 bytes -> C:\Users\Bob\AppData\Roaming\Microsoft Excel 97-2003.EML:OECustomProperty
@Alternate Data Stream - 137 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84
@Alternate Data Stream - 109 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >

[Advertisements]

Are the redirects still occuring ?

[Essexboy]

Are the redirects still occuring ?

[Mobilesites]

No! I tried a few searches and no redirects. Firefox working quickly again.
That is outstanding. Thank you.

[Mobilesites]

I have been connected to the internet directly through my ISP Modem. When the infection started, I was using a wireless router.
Is it possible that the infection is in the router? Should I not use the router?

[Essexboy]

Please try the router to see if the infections is there. If it is we will cure that next

If not let me know and I will remove my tools

[Mobilesites]

I tried some searched and no redirects. Seems to be clean. Thank you very much.

[Essexboy]

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
• Right click Disc cleanup and select run as administrator
• Select Your main drive and accept the warning if you get one
• For a few moments the system will make some calculations
• Select the More Options tab
• In the System Restore and Shadow Backups select Clean up
• Select Delete on the pop up
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe

[Mobilesites]

I performed the last steps and so far, it seems fine. I'll let you know in 24 hours.

My computer, though, runs slowly. Can you recommend any good PC performance tools? Free or paid?

Thanks again for the help.

[Essexboy]

Initially I would reduce the autorun startups - use the small tool found here
Download link at the bottom of the page, disable all bar any security programmes
Let me know if there is an improvement

[Mobilesites]

Thanks. I will try that. I checked today and no redirects. You are brilliant.

[Mobilesites]

One thought - I use Mozypro to backup my files. If I need to recover files through mozypro backup, would that re-activate the redirect virus?

Thanks.

[Essexboy]

The bad boy was an extension - so I would recommend that you delete the extensions backup and create a new one

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

[Essexboy]

User returned

Could I have a fresh OTL scan please

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  consrv.dll
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  %Temp%\smtmp\1\*.*
  %Temp%\smtmp\2\*.*
  %Temp%\smtmp\3\*.*
  %Temp%\smtmp\4\*.*
  >C:\commands.txt echo list vol /raw /hide /c
  /wait
  >C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
  /wait
  type c:\diskreport.txt /c
  /wait
  erase c:\commands.txt /hide /c
  /wait
  erase c:\diskreport.txt /hide /c
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.