Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Browser Redirect and "Recommended for You" Popups (Windows 7 6


  • This topic is locked This topic is locked

#1
phot

phot

    New Member

  • Member
  • Pip
  • 3 posts
I am experiencing the same problem described in this resolved thread: http://www.geekstogo...owser-redirect/ The solution there warns against applying the fix on other systems, so I figured I'd open a new topic.

Essentially, for several weeks my browser (Firefox and/or Chrome) has been randomly redirected to a 3rd party website and then to another site. Links to and from legitimate websites as well as search engine inquiries are subject to this redirect. When I attempt to use the browser's "Back" button, I am redirected again. I have run several scans with AVG, SpyBot, Malwarebytes, and others. Malwarebytes detected a trojan initially and reported it as resolved, scans since then come up clean - but the problem persists. A small intrusive ad box has begun appearing the lower right hand corner of websites, as well, with the text "Recommended for You." These ads can be collapsed but not closed. As described in the other thread, this does not occur on every website, or even on the same websites with repeated views. I'm not sure where I picked this up - I started noticing an increased number of pop-ups when my Antivirus (MacAfee) subscription lapsed, and this problem began occurring after I had updated my coverage (AVG).

I followed the instructions to fix Google redirects here: http://www.geekstogo...ogle-redirects/ (skipped registry backup)The TDSSKiller scan came up clean.

Information on this problem seems to be pretty patchy, but it is an intrusive and annoying problem that I am sure is compromising my machine's security. I would be happy to provide any additional info you may need. Any help would be greatly appreciated!

OTL log:

OTL logfile created on: 4/18/2012 9:12:16 PM - Run 1
OTL by OldTimer - Version 3.2.40.0 Folder = C:\Users\Phot\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.99 Gb Total Physical Memory | 3.77 Gb Available Physical Memory | 63.03% Memory free
11.98 Gb Paging File | 9.03 Gb Available in Paging File | 75.38% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 448.14 Gb Total Space | 110.72 Gb Free Space | 24.71% Space Free | Partition Type: NTFS

Computer Name: PHOT-MOBILE | User Name: Phot | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/18 21:00:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
PRC - [2012/04/06 23:02:44 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
PRC - [2012/03/17 19:09:24 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/02/14 20:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Phot\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2012/01/24 10:19:14 | 003,478,336 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/29 14:49:28 | 000,505,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/05/21 14:00:52 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
PRC - [2010/05/21 13:58:30 | 000,673,088 | ---- | M] (SoftThinks) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
PRC - [2010/03/06 05:04:24 | 000,310,224 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
PRC - [2010/02/22 17:25:08 | 001,992,008 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe
PRC - [2010/02/22 17:25:08 | 000,095,560 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
PRC - [2010/02/22 17:24:42 | 002,409,800 | ---- | M] (Sensible Vision ) -- c:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe
PRC - [2010/02/09 15:34:00 | 001,807,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
PRC - [2009/07/05 18:12:26 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
PRC - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2006/08/11 11:15:36 | 000,200,704 | ---- | M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2005/02/20 11:45:00 | 001,527,808 | ---- | M] () -- C:\Program Files (x86)\Oni\Oni.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/12 03:26:40 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\262285b3d0afafc5059f3fe9be69bff5\System.Windows.Forms.ni.dll
MOD - [2012/04/12 03:26:34 | 001,590,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8177623eac8f15cf95b587625439eac7\System.Drawing.ni.dll
MOD - [2012/04/06 23:03:06 | 000,214,528 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\mssvoice.asi
MOD - [2012/04/06 23:03:06 | 000,095,744 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\mssmp3.asi
MOD - [2012/04/06 23:03:05 | 020,297,512 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
MOD - [2012/04/06 23:03:05 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
MOD - [2012/04/06 23:03:05 | 000,907,048 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dll
MOD - [2012/04/06 23:03:05 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
MOD - [2012/04/06 23:03:05 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
MOD - [2012/04/02 15:27:21 | 008,797,344 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
MOD - [2012/03/17 19:09:23 | 001,969,080 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/02/15 04:38:06 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\cb5bd98ffa4c82327b0e4db02bb58d2d\System.Management.ni.dll
MOD - [2012/02/15 04:31:12 | 001,840,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a595aa31f93ed043fd02ec9d8ff40b32\System.Web.Services.ni.dll
MOD - [2012/02/15 04:30:19 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012/02/15 04:30:13 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012/02/15 04:30:12 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2011/10/12 17:07:33 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011/09/27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 16:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/05/21 14:00:52 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
MOD - [2010/05/21 13:59:16 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
MOD - [2010/05/21 13:58:56 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
MOD - [2010/05/21 13:58:54 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
MOD - [2010/05/21 13:58:48 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
MOD - [2010/05/21 13:58:46 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
MOD - [2010/05/21 13:58:42 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
MOD - [2010/05/21 13:58:18 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll
MOD - [2010/02/22 17:25:56 | 000,089,416 | ---- | M] () -- C:\Windows\SysWOW64\FAIEExtension.dll
MOD - [2010/02/22 17:25:12 | 000,059,208 | ---- | M] () -- C:\Windows\SysWOW64\FAib.dll
MOD - [2010/02/22 17:24:10 | 000,247,624 | ---- | M] () -- C:\Windows\SysWOW64\FACrashRpt.dll
MOD - [2010/02/09 15:34:00 | 001,807,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
MOD - [2010/02/09 15:34:00 | 000,275,776 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbShared.dll
MOD - [2010/02/09 15:34:00 | 000,152,896 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbShared.XmlSerializers.dll
MOD - [2010/02/09 15:34:00 | 000,095,552 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbUI.dll
MOD - [2010/02/09 15:34:00 | 000,058,688 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\BalloonWindow.dll
MOD - [2010/02/09 15:34:00 | 000,017,728 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\CppUtils.dll
MOD - [2005/02/20 11:45:00 | 001,527,808 | ---- | M] () -- C:\Program Files (x86)\Oni\Oni.exe
MOD - [2000/11/03 04:48:51 | 000,286,208 | R--- | M] () -- C:\Program Files (x86)\Oni\binkw32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/01/21 23:01:12 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/01/20 17:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009/11/26 15:47:36 | 000,665,320 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\atwtusb.exe -- (WTService)
SRV:64bit: - [2009/11/02 14:48:18 | 000,126,352 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009/07/13 22:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV:64bit: - [2009/03/02 15:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)
SRV - [2012/04/02 15:27:21 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/08/16 09:21:04 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2010/08/16 09:20:10 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010/08/16 09:19:25 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe -- (Sound Blaster X-Fi MB Licensing Service)
SRV - [2010/08/16 09:00:33 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2010/05/21 13:58:30 | 000,673,088 | ---- | M] (SoftThinks) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/22 17:24:42 | 002,409,800 | ---- | M] (Sensible Vision ) [Auto | Running] -- c:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe -- (FAService)
SRV - [2010/02/19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/20 17:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe -- (STacSV)
SRV - [2009/07/05 18:12:26 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009/06/26 13:19:12 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2009/06/10 18:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2009/03/02 15:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)
SRV - [2006/08/11 11:15:36 | 000,200,704 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/29 19:20:17 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011/10/07 06:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2011/09/13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011/08/08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011/08/02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2011/07/11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:64bit: - [2011/07/11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:64bit: - [2011/07/11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:64bit: - [2011/03/11 03:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 03:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 08:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/06 23:24:34 | 000,024,176 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV:64bit: - [2010/01/21 23:13:24 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/01/21 22:07:56 | 000,161,280 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/01/20 17:10:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/11/20 03:25:42 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/11/02 14:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009/09/29 22:34:32 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/15 01:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel®
DRV:64bit: - [2009/08/26 14:15:10 | 000,007,552 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\walvhid.sys -- (vhidmini)
DRV:64bit: - [2009/08/24 00:20:22 | 000,285,744 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/09 07:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/07/04 08:27:02 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009/07/01 21:54:52 | 000,060,416 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009/07/01 07:31:58 | 000,080,896 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdpe64.sys -- (risdpcie)
DRV:64bit: - [2009/06/15 15:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/03/09 05:58:00 | 000,060,416 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\itecir.sys -- (itecir)
DRV:64bit: - [2009/03/08 20:16:14 | 000,007,680 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\moufiltr.sys -- (moufiltr)
DRV:64bit: - [2009/02/24 19:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:64bit: - [2008/09/24 21:36:14 | 000,238,848 | ---- | M] (Sensible Vision ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\facap.sys -- (FACAP)
DRV:64bit: - [2006/11/01 14:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/06/26 12:27:28 | 000,065,520 | ---- | M] (Sonic Solutions) [File_System | System | Stopped] -- C:\Windows\SysWOW64\drivers\RxFilter.sys -- (RxFilter)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {1D6EF07C-27D8-429A-B77F-AEA0B493D04F}
IE:64bit: - HKLM\..\SearchScopes\{1D6EF07C-27D8-429A-B77F-AEA0B493D04F}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}
IE - HKLM\..\SearchScopes\{CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
IE - HKCU\..\SearchScopes,DefaultScope = {CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Phot\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Phot\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Phot\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/03/23 17:39:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/17 19:09:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/02/11 15:08:04 | 000,000,000 | ---D | M]

[2010/08/21 11:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Phot\AppData\Roaming\Mozilla\Extensions
[2012/03/04 12:52:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Phot\AppData\Roaming\Mozilla\Firefox\Profiles\6796u2iq.default\extensions
[2012/03/04 12:52:08 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Phot\AppData\Roaming\Mozilla\Firefox\Profiles\6796u2iq.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/11/11 00:45:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/08/29 23:01:24 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/03/17 19:09:24 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/20 12:22:37 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/20 12:22:37 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Phot\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Google Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AVG Safe Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\
CHR - Extension: Click to call with Skype = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8153_0\
CHR - Extension: Gmail = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/03/30 17:52:31 | 000,001,401 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 68.168.222.226 www.google-analytics.com.
O1 - Hosts: 68.168.222.226 ad-emea.doubleclick.net.
O1 - Hosts: 68.168.222.226 www.statcounter.com.
O1 - Hosts: 108.163.215.51 www.google-analytics.com.
O1 - Hosts: 108.163.215.51 ad-emea.doubleclick.net.
O1 - Hosts: 108.163.215.51 www.statcounter.com.
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (FAIESSOHelper Class) - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - c:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll (Sensible Vision )
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [MacroKeyManager] C:\Windows\SysNative\WTMKM.exe ()
O4:64bit: - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [FAStartup] File not found
O4 - HKLM..\Run: [FATrayAlert] c:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe (Sensible Vision )
O4 - HKLM..\Run: [StartCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [Synergy Client] C:\Program Files\Synergy\synergyc.exe ()
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O4 - Startup: C:\Users\Phot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Phot\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://www.kccsoft.c...les/awswaxd.cab (Macromedia Authorware Web Player Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.222.0.94 24.222.0.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{12C76E18-2641-4E66-984D-7006F58EB0CC}: DhcpNameServer = 24.222.0.94 24.222.0.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CB5ED50-A9A2-48A5-80F4-766C1F0659EE}: DhcpNameServer = 24.222.0.94 24.222.0.95
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20 - Winlogon\Notify\FastAccess: DllName - (c:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll) - c:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0365702f-f185-11df-be8b-f04da245c395}\Shell - "" = AutoRun
O33 - MountPoints2\{0365702f-f185-11df-be8b-f04da245c395}\Shell\AutoRun\command - "" = E:\LaunchU3.exe
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell - "" = AutoRun
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell\AutoRun\command - "" = E:\Setup\rsrc\Autorun.exe
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell\dinstall\command - "" = E:\Directx\dxsetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/18 21:09:38 | 002,072,112 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Phot\Desktop\TDSSKiller.exe
[2012/04/18 21:08:35 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\GooredFix Backups
[2012/04/18 21:07:49 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Phot\Desktop\GooredFix.exe
[2012/04/18 21:00:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
[2012/04/13 02:00:36 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\Anesthesiology + Surgery
[2012/04/06 22:54:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012/04/06 22:54:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2012/04/04 10:09:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Malwarebytes
[2012/04/04 10:09:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/04 10:09:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/04 10:09:01 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/04 10:09:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/04/03 17:37:40 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/03 17:05:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/04/03 17:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012/04/03 17:05:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012/03/30 22:40:55 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F626CF4D-C30F-45FB-AA1F-417831957C7A}
[2012/03/26 01:30:07 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\Suture Review DVDS
[2012/03/25 19:46:41 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D194684D-783E-4845-924A-D1B7F4D07935}
[2012/03/25 19:46:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F6CC96C6-E5B2-481A-9199-B4E157FE9B71}
[2012/03/25 19:34:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{23B16B0F-C7D6-4FEC-B951-390772F8ED6A}
[2012/03/25 19:34:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CF6C31C9-2E4A-4A4C-ACDC-B38108500B24}
[2012/03/25 19:25:30 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D31385CF-B9FC-4396-9691-7C24DF620EA1}
[2012/03/25 19:24:54 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{847DBA19-4FE4-429C-83AF-2F80D0CD7C84}
[2012/03/25 19:15:02 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{27B0661B-2D86-4DD5-A560-0A55B086A14C}
[2012/03/25 19:14:28 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C0DCBE18-06B6-4F24-93E2-DE0B03AF7CFF}
[2012/03/25 19:09:40 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A1452801-9FD4-4683-B3DB-973988A16E32}
[2012/03/25 19:09:28 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{20273D31-DDC2-43CC-A4C4-D301EC614B64}
[2012/03/25 19:05:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CA04405D-7AFE-46B7-B7AA-7F3BDC57CC7D}
[2012/03/25 19:05:01 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{488CC289-B779-4EDD-9107-B4BE8723E61D}
[2012/03/25 19:01:03 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{DAA7A96D-7E23-4035-BC5C-16AA83CC8079}
[2012/03/25 19:00:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C8E57C02-412A-41DA-91ED-00B40DACAAD0}
[2012/03/25 18:58:04 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{35C7124F-9AE7-4C27-A481-5E48A50E511A}
[2012/03/25 18:57:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{3D1EF3DD-E52D-4164-A96B-46830620E7A8}
[2012/03/25 18:51:00 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A46E5E28-5EF4-4CE7-BA9E-E9886303A46C}
[2012/03/25 18:50:48 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8E21743F-3A7C-473A-A3C0-830FBC7ADA14}
[2012/03/25 18:46:20 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EA316CE2-9021-4CE8-B428-E7202BA56969}
[2012/03/25 18:46:03 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AFBB0721-5611-479E-A7E8-D5A41CB31672}
[2012/03/25 18:44:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{9F9BC534-1DA0-47C1-BED7-D7787B9FC585}
[2012/03/25 18:43:54 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D7D5B8DC-7FB8-4E02-9F8D-F258D6843F85}
[2012/03/25 17:52:04 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{364BD3B3-E055-434F-886D-B55BB773E8E7}
[2012/03/25 17:51:30 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F3A92EB2-669F-4962-BDE1-1C94E3F05FB8}
[2012/03/25 17:41:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B711D3A1-32AB-4E0B-B3CE-9A5A7525BDDA}
[2012/03/25 17:40:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EF25DF62-A06F-44A4-B5CC-A04EDC1B893F}
[2012/03/25 17:31:24 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8931F476-8393-4240-8F0C-E92B54C0F0BF}
[2012/03/25 17:30:31 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B55F7AB7-7A72-4DF4-AD81-BBE902D2953B}
[2012/03/25 17:21:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D593C6B2-E0D0-4B22-8861-4DCFAD0A8051}
[2012/03/25 17:21:40 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{77BBEBC2-25B1-47EC-AEE3-2BA3F10F40BB}
[2012/03/25 17:18:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8D3F136A-F34C-48BB-B1C3-CA3357C9AEFA}
[2012/03/25 17:17:29 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A3B34BFD-A413-4080-935C-66654520CE09}
[2012/03/25 17:09:21 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{5A5B65B7-76EB-498F-B487-AB59F146A1D8}
[2012/03/25 17:08:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AC5F7E4C-E186-45BB-9016-B3211A9E621F}
[2012/03/25 17:03:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B5949119-0CAF-4969-8EF0-0729E8B864A4}
[2012/03/25 17:02:37 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{6BC7B6E9-07C1-4327-9FBD-3D3D35E77FB5}
[2012/03/25 16:55:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{297DD095-9271-444D-BF56-EAB7CB461CE1}
[2012/03/25 16:55:12 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{1633A580-CE6A-4798-933D-D8A0A3EBF736}
[2012/03/25 16:49:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{21443549-6283-4457-A408-0329854A3FE2}
[2012/03/25 16:48:34 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EC7FFD6B-53F8-4454-BC7B-E08DCB2717FD}
[2012/03/25 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{BD80A0B2-202D-4F07-B033-391E49002EC4}
[2012/03/25 16:40:57 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D0BE0E98-61DC-44B3-BD07-E23DA9CFF11E}
[2012/03/25 16:34:11 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B6A594A7-A346-4434-B182-1049CF8E3265}
[2012/03/25 16:33:48 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{85FC78B8-CA98-4FF2-B472-8270D216A806}
[2012/03/25 16:27:26 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{6BD4D0D4-E6DE-4D98-ADA9-CCCF48A7B007}
[2012/03/25 16:27:14 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{3003FC76-B116-45CF-9B46-C799C1156123}
[2012/03/25 16:22:38 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{11626E55-BBF0-4F39-9411-23C0970AF84F}
[2012/03/25 16:21:39 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AB505E40-7043-412E-AC83-57D01BDE64C9}
[2012/03/25 16:14:21 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{66087E41-3F9E-45B3-A157-EDC04B945E17}
[2012/03/25 16:13:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{23FAFA4F-ED68-4D68-B495-6696EE3D02B4}
[2012/03/23 22:02:02 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CA6F8A6A-3BA8-471C-B00E-994EBEF57219}
[2012/03/23 22:01:27 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{22689A3F-3FC2-4229-8E78-4BCE2F89D507}
[2012/03/23 18:33:12 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/03/23 17:49:34 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\AVG2012
[2012/03/23 17:39:48 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/03/23 17:39:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2012/03/23 17:39:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2012/03/23 17:39:22 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2012/03/23 17:39:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG
[2012/03/23 17:38:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2012/03/23 17:34:28 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/03/22 20:38:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D166DEFC-A4BC-4065-8D4F-3E3A54211D92}
[2012/03/22 20:38:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{412A475D-8610-46F0-B32E-325CBBBEE45C}
[2012/03/22 20:19:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Sony Creative Software Inc
[2012/03/22 20:06:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{34A7D310-8EDE-4411-9141-24DF53659734}
[2012/03/22 20:06:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{0D34B2D9-5561-4623-AF11-8625159B61A7}
[2012/03/22 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Ulead Systems
[2012/03/22 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\Ulead DVD MovieFactory
[2012/03/22 20:00:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InterVideo
[2012/03/22 19:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\InterVideo
[2012/03/22 19:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead DVD MovieFactory 6
[2012/03/22 19:58:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Ulead Systems
[2012/03/22 19:58:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Ulead Systems
[2012/03/22 19:58:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ulead Systems
[2012/03/22 19:19:29 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{5911D39D-67F9-4A7E-AEF5-0731605652A0}
[2012/03/22 19:18:55 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C8C8FAA2-E72F-4818-A0F9-6578A7F5D438}
[2012/03/22 16:05:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\URTTEMP
[2012/03/22 15:11:26 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{DFA2E6B5-1EB0-49EC-8614-36F45B8FBDCB}
[2012/03/22 15:10:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{02B09796-B947-49A7-AA63-EC2930CF9F1A}
[2012/03/22 15:03:25 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{2F111255-85DE-450D-9D6F-C672D8E00A0E}
[2012/03/22 15:03:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B02841B6-7CF1-4802-BD0C-F9102A3800DB}
[2012/03/22 14:56:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{16779A19-2566-418F-B009-D15BD815EE81}
[2012/03/22 14:55:32 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{E480E1A3-3DF5-4291-8F07-51DE4F0EDE64}
[2012/03/22 14:48:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C0522C54-C74C-4527-9ED2-4E13F8305DD9}
[2012/03/22 14:47:38 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B0BEABF0-E601-4E3F-A6BF-0268BA44A662}
[2012/03/22 14:40:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\suture review dvd
[2012/03/22 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{88F28DDB-2685-44F2-8619-7078FF4A4629}
[2012/03/22 14:15:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{24CC242F-38A5-4799-9769-3F43A238ADFB}
[2012/03/22 14:01:45 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\dvdcss
[2012/03/22 13:37:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\DVD Creator
[2012/03/22 13:14:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{713EF5A7-FF1D-44FF-B36E-219DE0D24E03}
[2012/03/22 13:14:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A55D5BDB-0884-464C-94AF-A815773F6550}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/18 21:09:30 | 002,052,792 | ---- | M] () -- C:\Users\Phot\Desktop\tdsskiller.zip
[2012/04/18 21:07:49 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Phot\Desktop\GooredFix.exe
[2012/04/18 21:01:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2588051313-1996247885-2346166555-1001UA.job
[2012/04/18 21:00:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
[2012/04/18 20:55:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/18 20:35:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/18 18:50:33 | 095,529,528 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/04/18 18:01:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2588051313-1996247885-2346166555-1001Core.job
[2012/04/18 16:45:34 | 002,072,112 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Phot\Desktop\TDSSKiller.exe
[2012/04/18 15:28:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/18 12:39:51 | 000,372,383 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/04/18 11:24:36 | 000,744,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/18 11:24:36 | 000,636,230 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/04/18 11:24:36 | 000,111,772 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/04/18 04:55:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/17 18:06:03 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/17 18:06:03 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/17 17:58:09 | 527,826,943 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/17 17:56:28 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/16 23:35:41 | 000,098,959 | R--- | M] () -- C:\Users\Phot\Desktop\IMG00128-20120416-2332.jpg
[2012/04/13 03:11:34 | 000,002,346 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/04/06 23:05:46 | 000,000,220 | ---- | M] () -- C:\Users\Phot\Desktop\Plants vs. Zombies Game of the Year.url
[2012/04/06 22:54:43 | 000,000,879 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2012/04/06 22:14:05 | 001,606,656 | ---- | M] () -- C:\Users\Phot\Desktop\SteamInstall.msi
[2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/03 17:37:42 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/03 17:06:02 | 000,001,224 | ---- | M] () -- C:\Users\Phot\Desktop\Spybot - Search & Destroy.lnk
[2012/03/31 22:30:56 | 000,000,843 | ---- | M] () -- C:\Users\Phot\.recently-used.xbel
[2012/03/30 17:52:31 | 000,001,401 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120403-174607.backup
[2012/03/30 17:52:31 | 000,001,401 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120403-171333.backup
[2012/03/30 17:52:31 | 000,001,401 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/03/28 14:37:37 | 000,000,067 | ---- | M] () -- C:\Windows\synergy.sgc
[2012/03/23 22:27:09 | 000,000,000 | -H-- | M] () -- C:\Users\Phot\Documents\Default.rdp
[2012/03/23 17:39:44 | 000,000,927 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/23 17:39:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/23 17:39:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/23 09:28:35 | 005,038,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/22 19:59:36 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Ulead DVD MovieFactory 6 Launcher.lnk
[2012/03/22 16:06:09 | 000,760,802 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/18 21:09:14 | 002,052,792 | ---- | C] () -- C:\Users\Phot\Desktop\tdsskiller.zip
[2012/04/18 18:50:33 | 095,529,528 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/04/18 12:39:51 | 000,372,383 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/04/16 23:35:43 | 000,098,959 | R--- | C] () -- C:\Users\Phot\Desktop\IMG00128-20120416-2332.jpg
[2012/04/06 23:05:46 | 000,000,220 | ---- | C] () -- C:\Users\Phot\Desktop\Plants vs. Zombies Game of the Year.url
[2012/04/06 22:54:43 | 000,000,879 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2012/04/06 22:14:04 | 001,606,656 | ---- | C] () -- C:\Users\Phot\Desktop\SteamInstall.msi
[2012/04/04 10:09:02 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/03 17:37:42 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/03 17:06:02 | 000,001,224 | ---- | C] () -- C:\Users\Phot\Desktop\Spybot - Search & Destroy.lnk
[2012/04/02 15:27:25 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/03/31 22:30:56 | 000,000,843 | ---- | C] () -- C:\Users\Phot\.recently-used.xbel
[2012/03/23 22:27:09 | 000,000,000 | -H-- | C] () -- C:\Users\Phot\Documents\Default.rdp
[2012/03/23 17:39:44 | 000,000,927 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/23 17:39:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/23 17:39:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/22 19:59:53 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2012/03/22 19:59:53 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2012/03/22 19:59:53 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2012/03/22 19:59:53 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2012/03/22 19:59:53 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2012/03/22 19:59:53 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2012/03/22 19:59:36 | 000,002,505 | ---- | C] () -- C:\Users\Public\Desktop\Ulead DVD MovieFactory 6 Launcher.lnk
[2012/01/22 15:36:22 | 000,000,132 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2012/01/18 01:46:14 | 000,210,268 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/11/24 20:09:54 | 000,004,858 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\certb.html
[2011/11/12 18:40:36 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/02/01 22:25:07 | 000,000,132 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/12/10 23:16:05 | 000,760,802 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/10 00:08:50 | 000,008,229 | ---- | C] () -- C:\Windows\aiptbl.ini
[2010/08/31 21:37:20 | 000,044,544 | ---- | C] () -- C:\Windows\SysWow64\GIF89.DLL
[2010/08/31 21:37:19 | 000,037,280 | ---- | C] () -- C:\Windows\SysWow64\license.bin
[2010/08/22 14:29:26 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/08/21 21:48:46 | 000,007,600 | ---- | C] () -- C:\Users\Phot\AppData\Local\Resmon.ResmonCfg
[2010/08/21 11:53:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/08/16 10:49:45 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/08/16 09:21:27 | 000,002,265 | ---- | C] () -- C:\Windows\FF08_Render_Spk_Hp.ini
[2010/08/16 09:21:27 | 000,001,650 | ---- | C] () -- C:\Windows\FF08_Capture.ini
[2010/08/16 09:21:27 | 000,001,540 | ---- | C] () -- C:\Windows\FF08_Render.ini
[2010/08/16 09:21:11 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010/08/16 09:21:11 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/26 08:51:47 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

========== LOP Check ==========

[2011/08/14 18:27:53 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\.mono
[2011/08/14 19:11:27 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AtomZombieData
[2011/03/23 21:32:34 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AtomZombieDemoData
[2012/03/23 17:49:34 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AVG2012
[2012/01/13 22:56:16 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Braid
[2010/12/09 13:49:53 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/09/10 23:01:47 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Crayon Physics Deluxe
[2012/04/03 17:55:16 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\DAEMON Tools Lite
[2012/04/17 18:00:00 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Dropbox
[2011/11/24 20:10:48 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\ekarr
[2011/07/11 16:18:23 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\fltk.org
[2011/09/25 13:55:00 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\gedit
[2011/06/28 01:34:03 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\gtk-2.0
[2010/08/21 21:49:02 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\LolClient
[2011/04/25 22:30:20 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Painter
[2012/01/19 23:07:03 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Publish Providers
[2012/03/22 13:23:37 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Sony
[2012/03/22 20:19:09 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Sony Creative Software Inc
[2011/05/12 01:38:11 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/03/22 20:05:09 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Ulead Systems
[2012/04/17 17:56:40 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\uTorrent
[2012/03/15 03:20:18 | 000,032,650 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there it appears to be the same - so I will cut straight to the chase rather than try to use a tool to fix it


Download Take Ownership to your desktop
Unzip the reg file to the desktop
Right click it and select Merge
Accept the warnings

Go to Control Panel
Select Folder Options
Select the view tab

Show Hidden files and Folders

Deselect Hide Protected Systems files

Posted Image

Accept all warnings and click apply

Using Windows explorer go to
C:\Windows\System32\drivers\etc
Right click the file named Host
Select take ownership
Double click the Host file and select notepad to open the file with

Delete the following lines :

68.168.222.226 www.google-analytics.com.
68.168.222.226 ad-emea.doubleclick.net.
68.168.222.226 www.statcounter.com.
108.163.215.51 www.google-analytics.com.
108.163.215.51 ad-emea.doubleclick.net.
108.163.215.51 www.statcounter.com.
.

Save the Host file
When you save it, it will try to rename it to Host.txt
In the drop down box at the bottom select All files
Allow it to overwrite

Posted Image

THEN

  • Run OTL.
  • Select All Users
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    consrv.dll
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    C:\Windows\assembly\tmp\U\*.* /s
    %Temp%\smtmp\1\*.*
    %Temp%\smtmp\2\*.*
    %Temp%\smtmp\3\*.*
    %Temp%\smtmp\4\*.*
    >C:\commands.txt echo list vol /raw /hide /c
    /wait
    >C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
    /wait
    type c:\diskreport.txt /c
    /wait
    erase c:\commands.txt /hide /c
    /wait
    erase c:\diskreport.txt /hide /c
    CREATERESTOREPOINT
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open one notepad window.
  • Post this log

  • 0

#3
phot

phot

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Thanks for your prompt response! I followed those steps and got this OTL log:

OTL logfile created on: 4/20/2012 5:01:28 PM - Run 2
OTL by OldTimer - Version 3.2.40.0 Folder = C:\Users\Phot\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.99 Gb Total Physical Memory | 3.88 Gb Available Physical Memory | 64.73% Memory free
11.98 Gb Paging File | 9.41 Gb Available in Paging File | 78.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 448.14 Gb Total Space | 106.77 Gb Free Space | 23.82% Space Free | Partition Type: NTFS

Computer Name: PHOT-MOBILE | User Name: Phot | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/18 21:00:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
PRC - [2012/03/30 16:00:44 | 000,161,336 | ---- | M] (Google) -- C:\Users\Phot\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2012/03/17 19:09:24 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/02/14 20:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Phot\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/01/24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2010/10/29 14:49:28 | 000,505,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/08/26 20:34:22 | 000,107,008 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
PRC - [2010/05/21 14:00:52 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
PRC - [2010/05/21 13:58:30 | 000,673,088 | ---- | M] (SoftThinks) -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
PRC - [2010/02/22 17:25:08 | 001,992,008 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayAlert.exe
PRC - [2010/02/22 17:25:08 | 000,095,560 | ---- | M] (Sensible Vision ) -- C:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe
PRC - [2010/02/22 17:24:42 | 002,409,800 | ---- | M] (Sensible Vision ) -- c:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe
PRC - [2010/02/09 15:34:00 | 001,807,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
PRC - [2009/07/05 18:12:26 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe
PRC - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
PRC - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2006/08/11 11:15:36 | 000,200,704 | ---- | M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/12 03:26:40 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\262285b3d0afafc5059f3fe9be69bff5\System.Windows.Forms.ni.dll
MOD - [2012/04/12 03:26:34 | 001,590,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8177623eac8f15cf95b587625439eac7\System.Drawing.ni.dll
MOD - [2012/04/02 15:27:21 | 008,797,344 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
MOD - [2012/03/17 19:09:23 | 001,969,080 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/02/15 04:38:06 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\cb5bd98ffa4c82327b0e4db02bb58d2d\System.Management.ni.dll
MOD - [2012/02/15 04:31:12 | 001,840,640 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a595aa31f93ed043fd02ec9d8ff40b32\System.Web.Services.ni.dll
MOD - [2012/02/15 04:30:19 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll
MOD - [2012/02/15 04:30:13 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll
MOD - [2012/02/15 04:30:12 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll
MOD - [2011/10/12 17:07:33 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011/09/27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/03/17 01:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 16:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/08/26 20:34:36 | 001,711,616 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libvorbis_plugin.dll
MOD - [2010/08/26 20:34:36 | 001,141,248 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libxml_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,078,848 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libzip_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,046,592 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libwaveout_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,040,448 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libyuy2_i420_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,038,912 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libvout_wrapper_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libyuy2_i422_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libyuvp_plugin.dll
MOD - [2010/08/26 20:34:36 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libugly_resampler_plugin.dll
MOD - [2010/08/26 20:34:34 | 001,199,104 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libtaglib_plugin.dll
MOD - [2010/08/26 20:34:34 | 000,367,616 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libtheora_plugin.dll
MOD - [2010/08/26 20:34:34 | 000,243,200 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libswscale_plugin.dll
MOD - [2010/08/26 20:34:34 | 000,032,256 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libtrivial_channel_mixer_plugin.dll
MOD - [2010/08/26 20:34:32 | 011,043,840 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libqt4_plugin.dll
MOD - [2010/08/26 20:34:32 | 002,153,984 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libskins2_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,768,512 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libschroedinger_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,130,048 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libspeex_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,036,864 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libscaletempo_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,034,304 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_filter_rar_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libsimple_channel_mixer_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libscale_plugin.dll
MOD - [2010/08/26 20:34:32 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libstream_filter_record_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,237,568 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libpng_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,194,048 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libmp4_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,128,000 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libmpgatofixed32_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,108,032 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libplaylist_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,038,912 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libmono_plugin.dll
MOD - [2010/08/26 20:34:30 | 000,037,888 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libmpeg_audio_plugin.dll
MOD - [2010/08/26 20:34:28 | 001,761,280 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liblibass_plugin.dll
MOD - [2010/08/26 20:34:28 | 001,760,256 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfreetype_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,336,384 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liblua_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,265,216 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libflac_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,258,048 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfluidsynth_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,135,680 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_rgb_sse2_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,073,728 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_rgb_mmx_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,052,224 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_rgb_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,048,640 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_yuy2_sse2_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,046,592 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libhotkeys_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,046,080 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_yuy2_sse2_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,039,936 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_yuy2_mmx_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,039,424 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfilesystem_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,038,400 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi420_yuy2_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,037,888 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_yuy2_mmx_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,036,352 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_yuy2_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,035,840 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liblpcm_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libmemcpymmxext_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libglobalhotkeys_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libi422_i420_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libgrey_yuv_plugin.dll
MOD - [2010/08/26 20:34:28 | 000,031,744 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfloat32_mixer_plugin.dll
MOD - [2010/08/26 20:34:26 | 000,309,760 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfaad_plugin.dll
MOD - [2010/08/26 20:34:26 | 000,037,376 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libfake_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,231,424 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdvdnav_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,210,944 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdshow_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,178,176 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdtstofloat32_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libavi_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,067,072 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdirectx_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdirect3d_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,057,344 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libblend_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,047,104 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libbandlimited_resampler_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,039,424 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdts_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,034,304 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libcdg_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,032,768 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libconverter_fixed_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,032,256 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdtstospdif_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,032,256 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdolby_surround_decoder_plugin.dll
MOD - [2010/08/26 20:34:24 | 000,031,232 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libdrawable_plugin.dll
MOD - [2010/08/26 20:34:22 | 007,124,992 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libavcodec_plugin.dll
MOD - [2010/08/26 20:34:22 | 002,263,552 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
MOD - [2010/08/26 20:34:22 | 000,107,008 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
MOD - [2010/08/26 20:34:22 | 000,101,376 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
MOD - [2010/08/26 20:34:22 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libaccess_bd_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,065,536 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,047,104 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libaout_directx_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,045,568 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libaraw_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,041,472 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libaudio_format_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,036,352 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,033,280 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\libaes3_plugin.dll
MOD - [2010/08/26 20:34:22 | 000,030,720 | ---- | M] () -- C:\Program Files (x86)\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll
MOD - [2010/05/21 14:00:52 | 000,783,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
MOD - [2010/05/21 13:59:16 | 000,079,168 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
MOD - [2010/05/21 13:58:56 | 000,075,072 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
MOD - [2010/05/21 13:58:54 | 000,111,936 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
MOD - [2010/05/21 13:58:48 | 000,121,152 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
MOD - [2010/05/21 13:58:46 | 000,128,320 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
MOD - [2010/05/21 13:58:42 | 000,234,816 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
MOD - [2010/05/21 13:58:18 | 001,123,648 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\libxml2.dll
MOD - [2010/02/22 17:25:56 | 000,089,416 | ---- | M] () -- C:\Windows\SysWOW64\FAIEExtension.dll
MOD - [2010/02/22 17:25:12 | 000,059,208 | ---- | M] () -- C:\Windows\SysWOW64\FAib.dll
MOD - [2010/02/22 17:24:10 | 000,247,624 | ---- | M] () -- C:\Windows\SysWOW64\FACrashRpt.dll
MOD - [2010/02/09 15:34:00 | 001,807,680 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
MOD - [2010/02/09 15:34:00 | 000,275,776 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbShared.dll
MOD - [2010/02/09 15:34:00 | 000,152,896 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbShared.XmlSerializers.dll
MOD - [2010/02/09 15:34:00 | 000,095,552 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\SdbUI.dll
MOD - [2010/02/09 15:34:00 | 000,058,688 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\BalloonWindow.dll
MOD - [2010/02/09 15:34:00 | 000,017,728 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Online\CppUtils.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/01/21 23:01:12 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/01/20 17:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009/11/26 15:47:36 | 000,665,320 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\atwtusb.exe -- (WTService)
SRV:64bit: - [2009/11/02 14:48:18 | 000,126,352 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009/07/13 22:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/09 11:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV:64bit: - [2009/03/02 15:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)
SRV - [2012/04/02 15:27:21 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/08/16 09:21:04 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2010/08/16 09:20:10 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010/08/16 09:19:25 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe -- (Sound Blaster X-Fi MB Licensing Service)
SRV - [2010/08/16 09:00:33 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2010/05/21 13:58:30 | 000,673,088 | ---- | M] (SoftThinks) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe -- (SftService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/22 17:24:42 | 002,409,800 | ---- | M] (Sensible Vision ) [Auto | Running] -- c:\Program Files (x86)\Sensible Vision\Fast Access\FAService.exe -- (FAService)
SRV - [2010/02/19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/20 17:10:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\STacSV64.exe -- (STacSV)
SRV - [2009/07/05 18:12:26 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2009/06/26 13:19:12 | 001,124,848 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\RoxMediaDB10.exe -- (RoxMediaDB10)
SRV - [2009/06/10 18:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/21 10:59:08 | 000,206,064 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2009/03/02 15:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_0057cbec48a2d7cf\AESTSr64.exe -- (AESTFilters)
SRV - [2006/08/11 11:15:36 | 000,200,704 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/29 19:20:17 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011/10/07 06:23:46 | 000,283,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2011/09/13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011/08/08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011/08/02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2011/07/11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:64bit: - [2011/07/11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:64bit: - [2011/07/11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:64bit: - [2011/03/11 03:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 03:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 08:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/06 23:24:34 | 000,024,176 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV:64bit: - [2010/01/21 23:13:24 | 006,233,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/01/21 22:07:56 | 000,161,280 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/01/20 17:10:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/11/20 03:25:42 | 000,321,064 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink ™
DRV:64bit: - [2009/11/02 14:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009/09/29 22:34:32 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/09/15 01:40:42 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel®
DRV:64bit: - [2009/08/26 14:15:10 | 000,007,552 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\walvhid.sys -- (vhidmini)
DRV:64bit: - [2009/08/24 00:20:22 | 000,285,744 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/09 07:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/07/04 08:27:02 | 000,055,808 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpe64.sys -- (rixdpcie)
DRV:64bit: - [2009/07/01 21:54:52 | 000,060,416 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009/07/01 07:31:58 | 000,080,896 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdpe64.sys -- (risdpcie)
DRV:64bit: - [2009/06/15 15:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/03/09 05:58:00 | 000,060,416 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\itecir.sys -- (itecir)
DRV:64bit: - [2009/03/08 20:16:14 | 000,007,680 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\moufiltr.sys -- (moufiltr)
DRV:64bit: - [2009/02/24 19:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:64bit: - [2008/09/24 21:36:14 | 000,238,848 | ---- | M] (Sensible Vision ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\facap.sys -- (FACAP)
DRV:64bit: - [2006/11/01 14:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/06/26 12:27:28 | 000,065,520 | ---- | M] (Sonic Solutions) [File_System | System | Stopped] -- C:\Windows\SysWOW64\drivers\RxFilter.sys -- (RxFilter)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {1D6EF07C-27D8-429A-B77F-AEA0B493D04F}
IE:64bit: - HKLM\..\SearchScopes\{1D6EF07C-27D8-429A-B77F-AEA0B493D04F}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}
IE - HKLM\..\SearchScopes\{CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}: "URL" = http://www.bing.com/...rc=IE-SearchBox


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USCON/1
IE - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\..\SearchScopes,DefaultScope = {CA9BF000-BEDA-4988-A9E1-C7BAF7CC07F2}
IE - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.4: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Phot\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Phot\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Phot\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2012/03/23 17:39:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/03/17 19:09:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/02/11 15:08:04 | 000,000,000 | ---D | M]

[2010/08/21 11:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Phot\AppData\Roaming\Mozilla\Extensions
[2012/03/04 12:52:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Phot\AppData\Roaming\Mozilla\Firefox\Profiles\6796u2iq.default\extensions
[2012/03/04 12:52:08 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Phot\AppData\Roaming\Mozilla\Firefox\Profiles\6796u2iq.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/11/11 00:45:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/08/29 23:01:24 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/03/17 19:09:24 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/04/14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011/02/02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012/02/20 12:22:37 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/02/20 12:22:37 | 000,002,040 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.162\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\Phot\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Phot\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.17_0\
CHR - Extension: Google Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AVG Safe Search = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.1901_0\
CHR - Extension: Click to call with Skype = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8153_0\
CHR - Extension: Gmail = C:\Users\Phot\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/04/20 16:58:59 | 000,001,161 | -HS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (FAIESSOHelper Class) - {A2F122DA-055F-4df7-8F24-7354DBDBA85B} - c:\Program Files (x86)\Sensible Vision\Fast Access\FAIESSO.dll (Sensible Vision )
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [] File not found
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [MacroKeyManager] C:\Windows\SysNative\WTMKM.exe ()
O4:64bit: - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe ()
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [FAStartup] File not found
O4 - HKLM..\Run: [FATrayAlert] c:\Program Files (x86)\Sensible Vision\Fast Access\FATrayMon.exe (Sensible Vision )
O4 - HKLM..\Run: [StartCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001..\Run: [Synergy Client] C:\Program Files\Synergy\synergyc.exe ()
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKLM..\RunOnceEx: [ContentMerger] c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCom\ContentMerger10.exe (Sonic Solutions)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = File not found
O4 - Startup: C:\Users\Phot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Phot\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2588051313-1996247885-2346166555-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://www.kccsoft.c...les/awswaxd.cab (Macromedia Authorware Web Player Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.222.0.94 24.222.0.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{12C76E18-2641-4E66-984D-7006F58EB0CC}: DhcpNameServer = 24.222.0.94 24.222.0.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CB5ED50-A9A2-48A5-80F4-766C1F0659EE}: DhcpNameServer = 24.222.0.94 24.222.0.95
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll) - File not found
O20 - Winlogon\Notify\FastAccess: DllName - (c:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll) - c:\Program Files (x86)\Sensible Vision\Fast Access\FALogNot.dll ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0365702f-f185-11df-be8b-f04da245c395}\Shell - "" = AutoRun
O33 - MountPoints2\{0365702f-f185-11df-be8b-f04da245c395}\Shell\AutoRun\command - "" = E:\LaunchU3.exe
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell - "" = AutoRun
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell\AutoRun\command - "" = E:\Setup\rsrc\Autorun.exe
O33 - MountPoints2\{1ca034d9-337e-11e0-9141-f04da245c395}\Shell\dinstall\command - "" = E:\Directx\dxsetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/18 21:09:38 | 002,072,112 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Phot\Desktop\TDSSKiller.exe
[2012/04/18 21:08:35 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\GooredFix Backups
[2012/04/18 21:07:49 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Phot\Desktop\GooredFix.exe
[2012/04/18 21:00:18 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
[2012/04/13 02:00:36 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\Anesthesiology + Surgery
[2012/04/06 22:54:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012/04/06 22:54:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2012/04/04 10:09:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Malwarebytes
[2012/04/04 10:09:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/04 10:09:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/04 10:09:01 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/04 10:09:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/04/03 17:37:40 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/04/03 17:05:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012/04/03 17:05:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012/04/03 17:05:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012/03/30 22:40:55 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F626CF4D-C30F-45FB-AA1F-417831957C7A}
[2012/03/26 01:30:07 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\Suture Review DVDS
[2012/03/25 19:46:41 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D194684D-783E-4845-924A-D1B7F4D07935}
[2012/03/25 19:46:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F6CC96C6-E5B2-481A-9199-B4E157FE9B71}
[2012/03/25 19:34:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{23B16B0F-C7D6-4FEC-B951-390772F8ED6A}
[2012/03/25 19:34:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CF6C31C9-2E4A-4A4C-ACDC-B38108500B24}
[2012/03/25 19:25:30 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D31385CF-B9FC-4396-9691-7C24DF620EA1}
[2012/03/25 19:24:54 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{847DBA19-4FE4-429C-83AF-2F80D0CD7C84}
[2012/03/25 19:15:02 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{27B0661B-2D86-4DD5-A560-0A55B086A14C}
[2012/03/25 19:14:28 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C0DCBE18-06B6-4F24-93E2-DE0B03AF7CFF}
[2012/03/25 19:09:40 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A1452801-9FD4-4683-B3DB-973988A16E32}
[2012/03/25 19:09:28 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{20273D31-DDC2-43CC-A4C4-D301EC614B64}
[2012/03/25 19:05:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CA04405D-7AFE-46B7-B7AA-7F3BDC57CC7D}
[2012/03/25 19:05:01 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{488CC289-B779-4EDD-9107-B4BE8723E61D}
[2012/03/25 19:01:03 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{DAA7A96D-7E23-4035-BC5C-16AA83CC8079}
[2012/03/25 19:00:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C8E57C02-412A-41DA-91ED-00B40DACAAD0}
[2012/03/25 18:58:04 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{35C7124F-9AE7-4C27-A481-5E48A50E511A}
[2012/03/25 18:57:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{3D1EF3DD-E52D-4164-A96B-46830620E7A8}
[2012/03/25 18:51:00 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A46E5E28-5EF4-4CE7-BA9E-E9886303A46C}
[2012/03/25 18:50:48 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8E21743F-3A7C-473A-A3C0-830FBC7ADA14}
[2012/03/25 18:46:20 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EA316CE2-9021-4CE8-B428-E7202BA56969}
[2012/03/25 18:46:03 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AFBB0721-5611-479E-A7E8-D5A41CB31672}
[2012/03/25 18:44:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{9F9BC534-1DA0-47C1-BED7-D7787B9FC585}
[2012/03/25 18:43:54 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D7D5B8DC-7FB8-4E02-9F8D-F258D6843F85}
[2012/03/25 17:52:04 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{364BD3B3-E055-434F-886D-B55BB773E8E7}
[2012/03/25 17:51:30 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{F3A92EB2-669F-4962-BDE1-1C94E3F05FB8}
[2012/03/25 17:41:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B711D3A1-32AB-4E0B-B3CE-9A5A7525BDDA}
[2012/03/25 17:40:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EF25DF62-A06F-44A4-B5CC-A04EDC1B893F}
[2012/03/25 17:31:24 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8931F476-8393-4240-8F0C-E92B54C0F0BF}
[2012/03/25 17:30:31 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B55F7AB7-7A72-4DF4-AD81-BBE902D2953B}
[2012/03/25 17:21:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D593C6B2-E0D0-4B22-8861-4DCFAD0A8051}
[2012/03/25 17:21:40 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{77BBEBC2-25B1-47EC-AEE3-2BA3F10F40BB}
[2012/03/25 17:18:05 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{8D3F136A-F34C-48BB-B1C3-CA3357C9AEFA}
[2012/03/25 17:17:29 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A3B34BFD-A413-4080-935C-66654520CE09}
[2012/03/25 17:09:21 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{5A5B65B7-76EB-498F-B487-AB59F146A1D8}
[2012/03/25 17:08:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AC5F7E4C-E186-45BB-9016-B3211A9E621F}
[2012/03/25 17:03:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B5949119-0CAF-4969-8EF0-0729E8B864A4}
[2012/03/25 17:02:37 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{6BC7B6E9-07C1-4327-9FBD-3D3D35E77FB5}
[2012/03/25 16:55:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{297DD095-9271-444D-BF56-EAB7CB461CE1}
[2012/03/25 16:55:12 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{1633A580-CE6A-4798-933D-D8A0A3EBF736}
[2012/03/25 16:49:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{21443549-6283-4457-A408-0329854A3FE2}
[2012/03/25 16:48:34 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{EC7FFD6B-53F8-4454-BC7B-E08DCB2717FD}
[2012/03/25 16:41:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{BD80A0B2-202D-4F07-B033-391E49002EC4}
[2012/03/25 16:40:57 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D0BE0E98-61DC-44B3-BD07-E23DA9CFF11E}
[2012/03/25 16:34:11 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B6A594A7-A346-4434-B182-1049CF8E3265}
[2012/03/25 16:33:48 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{85FC78B8-CA98-4FF2-B472-8270D216A806}
[2012/03/25 16:27:26 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{6BD4D0D4-E6DE-4D98-ADA9-CCCF48A7B007}
[2012/03/25 16:27:14 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{3003FC76-B116-45CF-9B46-C799C1156123}
[2012/03/25 16:22:38 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{11626E55-BBF0-4F39-9411-23C0970AF84F}
[2012/03/25 16:21:39 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{AB505E40-7043-412E-AC83-57D01BDE64C9}
[2012/03/25 16:14:21 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{66087E41-3F9E-45B3-A157-EDC04B945E17}
[2012/03/25 16:13:46 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{23FAFA4F-ED68-4D68-B495-6696EE3D02B4}
[2012/03/23 22:02:02 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{CA6F8A6A-3BA8-471C-B00E-994EBEF57219}
[2012/03/23 22:01:27 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{22689A3F-3FC2-4229-8E78-4BCE2F89D507}
[2012/03/23 18:33:12 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/03/23 17:49:34 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\AVG2012
[2012/03/23 17:39:48 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/03/23 17:39:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2012/03/23 17:39:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2012/03/23 17:39:22 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2012/03/23 17:39:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG
[2012/03/23 17:38:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2012/03/23 17:34:28 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/03/22 20:38:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{D166DEFC-A4BC-4065-8D4F-3E3A54211D92}
[2012/03/22 20:38:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{412A475D-8610-46F0-B32E-325CBBBEE45C}
[2012/03/22 20:19:09 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Sony Creative Software Inc
[2012/03/22 20:06:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{34A7D310-8EDE-4411-9141-24DF53659734}
[2012/03/22 20:06:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{0D34B2D9-5561-4623-AF11-8625159B61A7}
[2012/03/22 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\Ulead Systems
[2012/03/22 20:01:18 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\Ulead DVD MovieFactory
[2012/03/22 20:00:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InterVideo
[2012/03/22 19:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\InterVideo
[2012/03/22 19:59:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead DVD MovieFactory 6
[2012/03/22 19:58:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Ulead Systems
[2012/03/22 19:58:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Ulead Systems
[2012/03/22 19:58:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ulead Systems
[2012/03/22 19:19:29 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{5911D39D-67F9-4A7E-AEF5-0731605652A0}
[2012/03/22 19:18:55 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C8C8FAA2-E72F-4818-A0F9-6578A7F5D438}
[2012/03/22 16:05:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\URTTEMP
[2012/03/22 15:11:26 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{DFA2E6B5-1EB0-49EC-8614-36F45B8FBDCB}
[2012/03/22 15:10:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{02B09796-B947-49A7-AA63-EC2930CF9F1A}
[2012/03/22 15:03:25 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{2F111255-85DE-450D-9D6F-C672D8E00A0E}
[2012/03/22 15:03:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B02841B6-7CF1-4802-BD0C-F9102A3800DB}
[2012/03/22 14:56:06 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{16779A19-2566-418F-B009-D15BD815EE81}
[2012/03/22 14:55:32 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{E480E1A3-3DF5-4291-8F07-51DE4F0EDE64}
[2012/03/22 14:48:13 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{C0522C54-C74C-4527-9ED2-4E13F8305DD9}
[2012/03/22 14:47:38 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{B0BEABF0-E601-4E3F-A6BF-0268BA44A662}
[2012/03/22 14:40:51 | 000,000,000 | ---D | C] -- C:\Users\Phot\Desktop\suture review dvd
[2012/03/22 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{88F28DDB-2685-44F2-8619-7078FF4A4629}
[2012/03/22 14:15:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{24CC242F-38A5-4799-9769-3F43A238ADFB}
[2012/03/22 14:01:45 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Roaming\dvdcss
[2012/03/22 13:37:16 | 000,000,000 | ---D | C] -- C:\Users\Phot\Documents\DVD Creator
[2012/03/22 13:14:52 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{713EF5A7-FF1D-44FF-B36E-219DE0D24E03}
[2012/03/22 13:14:17 | 000,000,000 | ---D | C] -- C:\Users\Phot\AppData\Local\{A55D5BDB-0884-464C-94AF-A815773F6550}

========== Files - Modified Within 30 Days ==========

[2012/04/20 17:01:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2588051313-1996247885-2346166555-1001UA.job
[2012/04/20 16:58:59 | 000,001,161 | -HS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/04/20 16:55:00 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/20 16:47:09 | 000,000,841 | ---- | M] () -- C:\Users\Phot\Desktop\Take_Ownership.zip
[2012/04/20 16:35:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/20 14:54:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/20 12:37:53 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/20 12:37:53 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/20 12:34:58 | 000,744,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/04/20 12:34:58 | 000,636,230 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/04/20 12:34:58 | 000,111,772 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/04/20 12:30:55 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/20 12:30:34 | 527,826,943 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/20 08:14:57 | 095,695,681 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/04/19 18:01:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2588051313-1996247885-2346166555-1001Core.job
[2012/04/19 15:03:17 | 000,000,993 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/18 21:09:30 | 002,052,792 | ---- | M] () -- C:\Users\Phot\Desktop\tdsskiller.zip
[2012/04/18 21:07:49 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Phot\Desktop\GooredFix.exe
[2012/04/18 21:00:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Phot\Desktop\OTL.exe
[2012/04/18 16:45:34 | 002,072,112 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Phot\Desktop\TDSSKiller.exe
[2012/04/18 12:39:51 | 000,372,383 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/04/17 17:56:28 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/16 23:35:41 | 000,098,959 | R--- | M] () -- C:\Users\Phot\Desktop\IMG00128-20120416-2332.jpg
[2012/04/13 03:11:34 | 000,002,346 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012/04/06 23:05:46 | 000,000,220 | ---- | M] () -- C:\Users\Phot\Desktop\Plants vs. Zombies Game of the Year.url
[2012/04/06 22:54:43 | 000,000,879 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
[2012/04/06 22:14:05 | 001,606,656 | ---- | M] () -- C:\Users\Phot\Desktop\SteamInstall.msi
[2012/04/04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/04/03 17:06:02 | 000,001,224 | ---- | M] () -- C:\Users\Phot\Desktop\Spybot - Search & Destroy.lnk
[2012/03/31 22:30:56 | 000,000,843 | ---- | M] () -- C:\Users\Phot\.recently-used.xbel
[2012/03/30 17:52:31 | 000,001,401 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120403-174607.backup
[2012/03/30 17:52:31 | 000,001,401 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120403-171333.backup
[2012/03/28 14:37:37 | 000,000,067 | ---- | M] () -- C:\Windows\synergy.sgc
[2012/03/23 22:27:09 | 000,000,000 | -H-- | M] () -- C:\Users\Phot\Documents\Default.rdp
[2012/03/23 17:39:44 | 000,000,927 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/23 17:39:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/23 17:39:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/23 09:28:35 | 005,038,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/03/22 19:59:36 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Ulead DVD MovieFactory 6 Launcher.lnk
[2012/03/22 16:06:09 | 000,760,802 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

========== Files Created - No Company Name ==========

[2012/04/20 16:47:57 | 000,001,629 | ---- | C] () -- C:\Users\Phot\Desktop\Add_Take_Ownership.reg
[2012/04/20 16:47:57 | 000,000,816 | ---- | C] () -- C:\Users\Phot\Desktop\Remove_Take_Ownership.reg
[2012/04/20 16:47:07 | 000,000,841 | ---- | C] () -- C:\Users\Phot\Desktop\Take_Ownership.zip
[2012/04/20 08:14:57 | 095,695,681 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012/04/18 21:09:14 | 002,052,792 | ---- | C] () -- C:\Users\Phot\Desktop\tdsskiller.zip
[2012/04/18 12:39:51 | 000,372,383 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012/04/16 23:35:43 | 000,098,959 | R--- | C] () -- C:\Users\Phot\Desktop\IMG00128-20120416-2332.jpg
[2012/04/06 23:05:46 | 000,000,220 | ---- | C] () -- C:\Users\Phot\Desktop\Plants vs. Zombies Game of the Year.url
[2012/04/06 22:54:43 | 000,000,879 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
[2012/04/06 22:14:04 | 001,606,656 | ---- | C] () -- C:\Users\Phot\Desktop\SteamInstall.msi
[2012/04/04 10:09:02 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/03 17:37:42 | 000,000,993 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/04/03 17:06:02 | 000,001,224 | ---- | C] () -- C:\Users\Phot\Desktop\Spybot - Search & Destroy.lnk
[2012/04/02 15:27:25 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/03/31 22:30:56 | 000,000,843 | ---- | C] () -- C:\Users\Phot\.recently-used.xbel
[2012/03/23 22:27:09 | 000,000,000 | -H-- | C] () -- C:\Users\Phot\Documents\Default.rdp
[2012/03/23 17:39:44 | 000,000,927 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2012.lnk
[2012/03/23 17:39:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2012/03/23 17:39:42 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2012/03/22 19:59:53 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeW7.dll
[2012/03/22 19:59:53 | 000,200,704 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeA6.dll
[2012/03/22 19:59:53 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeP6.dll
[2012/03/22 19:59:53 | 000,192,512 | ---- | C] () -- C:\Windows\SysWow64\IVIresizeM6.dll
[2012/03/22 19:59:53 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\IVIresizePX.dll
[2012/03/22 19:59:53 | 000,020,480 | ---- | C] () -- C:\Windows\SysWow64\IVIresize.dll
[2012/03/22 19:59:36 | 000,002,505 | ---- | C] () -- C:\Users\Public\Desktop\Ulead DVD MovieFactory 6 Launcher.lnk
[2012/01/22 15:36:22 | 000,000,132 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2012/01/18 01:46:14 | 000,210,268 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/11/24 20:09:54 | 000,004,858 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\certb.html
[2011/11/12 18:40:36 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/02/01 22:25:07 | 000,000,132 | ---- | C] () -- C:\Users\Phot\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/12/10 23:16:05 | 000,760,802 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/12/10 00:08:50 | 000,008,229 | ---- | C] () -- C:\Windows\aiptbl.ini
[2010/08/31 21:37:20 | 000,044,544 | ---- | C] () -- C:\Windows\SysWow64\GIF89.DLL
[2010/08/31 21:37:19 | 000,037,280 | ---- | C] () -- C:\Windows\SysWow64\license.bin
[2010/08/22 14:29:26 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/08/21 21:48:46 | 000,007,600 | ---- | C] () -- C:\Users\Phot\AppData\Local\Resmon.ResmonCfg
[2010/08/21 11:53:26 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010/08/16 10:49:45 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010/08/16 09:21:27 | 000,002,265 | ---- | C] () -- C:\Windows\FF08_Render_Spk_Hp.ini
[2010/08/16 09:21:27 | 000,001,650 | ---- | C] () -- C:\Windows\FF08_Capture.ini
[2010/08/16 09:21:27 | 000,001,540 | ---- | C] () -- C:\Windows\FF08_Render.ini
[2010/08/16 09:21:11 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010/08/16 09:21:11 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010/06/26 08:51:47 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

========== LOP Check ==========

[2011/08/14 18:27:53 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\.mono
[2011/08/14 19:11:27 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AtomZombieData
[2011/03/23 21:32:34 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AtomZombieDemoData
[2012/03/23 17:49:34 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\AVG2012
[2012/01/13 22:56:16 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Braid
[2010/12/09 13:49:53 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/09/10 23:01:47 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Crayon Physics Deluxe
[2012/04/03 17:55:16 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\DAEMON Tools Lite
[2012/04/20 12:31:29 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Dropbox
[2011/11/24 20:10:48 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\ekarr
[2011/07/11 16:18:23 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\fltk.org
[2011/09/25 13:55:00 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\gedit
[2011/06/28 01:34:03 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\gtk-2.0
[2010/08/21 21:49:02 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\LolClient
[2011/04/25 22:30:20 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Painter
[2012/01/19 23:07:03 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Publish Providers
[2012/03/22 13:23:37 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Sony
[2012/03/22 20:19:09 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Sony Creative Software Inc
[2011/05/12 01:38:11 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012/03/22 20:05:09 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\Ulead Systems
[2012/04/20 17:00:20 | 000,000,000 | ---D | M] -- C:\Users\Phot\AppData\Roaming\uTorrent
[2012/03/15 03:20:18 | 000,032,650 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2010/08/16 11:33:19 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011/02/26 03:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 02:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 22:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 02:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/08/16 11:33:35 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 02:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 03:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 03:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 03:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 09:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/08/16 11:33:19 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2010/08/16 11:33:25 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 02:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/25 02:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/08/16 11:33:35 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/08/16 11:33:25 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 10:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/08/16 11:33:35 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/08/16 11:33:25 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 22:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/08/16 11:33:35 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2010/08/16 11:33:19 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011/02/26 03:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/08/16 11:33:25 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2010/08/16 11:33:19 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe

< MD5 for: SVCHOST.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009/07/13 22:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 22:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 22:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 22:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 09:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 09:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 22:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 22:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 10:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 10:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/11/20 10:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 10:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/13 22:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2010/08/16 11:33:35 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2010/08/16 11:33:35 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< type c:\diskreport.txt /c >
Microsoft DiskPart version 6.1.7601
Copyright © 1999-2008 Microsoft Corporation.
On computer: PHOT-MOBILE
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 D DVD-ROM 0 B No Media
Volume 1 E DVD-ROM 0 B No Media
Volume 2 F DVD-ROM 0 B No Media
Volume 3 RECOVERY NTFS Partition 17 GB Healthy System
Volume 4 C OS NTFS Partition 448 GB Healthy Boot

< End of report >
  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you confirm that the redirects have ceased
  • 0

#5
phot

phot

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Been browsing normally all evening, and I have experienced no redirects. :) The annoying ads are gone, too.
  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Commands
    [resethosts]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

Posted Image
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
  • Go to this site and click Do I have Java
  • It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point
  • Go to Control Panel and select System
  • Select System
  • On the left select System Protection and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create

Now we can purge the infected ones
  • GoStart > All programs > Accessories > system tools
  • Right click Disc cleanup and select run as administrator
  • Select Your main drive and accept the warning if you get one
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Posted Image
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe :wave:
  • 0

#7
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP