[Garysam43]

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{031949b3-28b6-43a4-90e2-dde1cfe21390}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031949b3-28b6-43a4-90e2-dde1cfe21390}\ not found.
Registry key HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Internet Explorer\SearchScopes\{031949b3-28b6-43a4-90e2-dde1cfe21390}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031949b3-28b6-43a4-90e2-dde1cfe21390}\ not found.
Registry key HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Internet Explorer\SearchScopes\{45751D25-4CDF-4ECB-AE06-6C79A5BBC31E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45751D25-4CDF-4ECB-AE06-6C79A5BBC31E}\ not found.
Registry key HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Internet Explorer\SearchScopes\{88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6}\ not found.
Registry key HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\searchplugins\askcom.xml moved successfully.
C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\searchplugins\search.xml moved successfully.
C:\Users\Dad\AppData\Local\517aqq2h75674sh3hggnyr2175hq6fw02 moved successfully.
C:\ProgramData\517aqq2h75674sh3hggnyr2175hq6fw02 moved successfully.
C:\ProgramData\syry.exe moved successfully.
C:\ProgramData\rqda.exe moved successfully.
C:\ProgramData\miog.exe moved successfully.
C:\ProgramData\cowu.exe moved successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.49.0 log created on 06222012_154932

[Advertisements]

OTL logfile created on: 6/22/2012 4:03:52 PM - Run 3
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\Dad\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.32 Gb Available Physical Memory | 66.09% Memory free
4.00 Gb Paging File | 3.12 Gb Available in Paging File | 77.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66.10 Gb Total Space | 36.99 Gb Free Space | 55.97% Space Free | Partition Type: NTFS
Drive D: | 74.53 Gb Total Space | 45.72 Gb Free Space | 61.35% Space Free | Partition Type: NTFS
Drive E: | 8.33 Gb Total Space | 1.27 Gb Free Space | 15.28% Space Free | Partition Type: NTFS

Computer Name: OURPC | User Name: Dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/18 05:04:21 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
PRC - [2012/05/03 14:07:40 | 000,217,256 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/23 01:39:24 | 000,803,432 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/03/05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe


========== Modules (No Company Name) ==========

MOD - [2007/03/02 00:54:32 | 000,657,920 | ---- | M] () -- C:\Program Files\File Shredder\fsshell.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012/06/19 16:59:23 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/02/24 16:16:38 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/04/29 04:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Dad\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:14 | 000,044,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:48 | 000,057,688 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/12 09:26:20 | 000,101,112 | R--- | M] (GFI Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/08/31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/02/23 02:57:00 | 010,468,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/22 17:13:28 | 000,041,912 | ---- | M] (FSPro Labs) [File_System | Boot | Running] -- C:\Windows\System32\drivers\FSPFltd.sys -- (FSProFilter)
DRV - [2009/07/13 18:13:47 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2009/04/29 04:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2009/02/13 06:58:30 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2009/02/13 06:56:32 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\SearchScopes,DefaultScope = {45751D25-4CDF-4ECB-AE06-6C79A5BBC31E}
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: [email protected]:1.3.4
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..keyword.URL: "http://blekko.com/ws...&u=USERGUID&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/16 06:58:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/03/29 04:58:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/16 06:58:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2012/02/16 06:57:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/02/06 13:31:06 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/16 06:58:57 | 000,000,000 | ---D | M]

[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions
[2010/04/29 16:11:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012/06/14 06:03:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\extensions
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Sunbird\Profiles\zyd2w965.default\extensions
[2012/02/17 08:09:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/29 04:58:26 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/06/19 16:59:24 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 07:14:01 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/19 16:59:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/09 08:38:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/06/19 16:59:20 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/06/19 17:25:19 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-82361716-3830150136-294940581-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: albertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: myalbertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: mysupervalu.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: star401kplan.com ([karentkaczyk] * in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: supervalu.com ([]* in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...tDetection2.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C152CCA5-F351-4D72-A386-E444466A89B8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/22 15:49:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/06/19 17:35:45 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\temp
[2012/06/19 17:04:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/06/19 17:04:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/06/19 17:04:36 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/06/19 17:03:03 | 004,562,361 | R--- | C] (Swearware) -- C:\Users\Dad\Desktop\G2GMR.exe
[2012/06/18 05:29:43 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Dad\Desktop\aswMBR.exe
[2012/06/18 05:04:17 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\SpeedMaxPc
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\DriverCure
[2012/06/17 14:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2012/06/17 14:12:31 | 000,000,000 | ---D | C] -- C:\Users\Dad\Desktop\tdsskiller
[2012/06/17 14:09:39 | 000,000,000 | ---D | C] -- C:\Users\Dad\Desktop\GooredFix Backups
[2012/06/17 14:09:02 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Dad\Desktop\GooredFix.exe
[2012/06/15 06:57:09 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012/06/15 06:51:37 | 000,203,088 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2012/06/15 06:51:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012/06/15 06:51:06 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/06/15 06:51:04 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\TestApp
[2012/06/14 07:49:13 | 000,101,112 | R--- | C] (GFI Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2012/06/14 06:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/14 06:34:55 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/06/14 06:34:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/14 06:33:14 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Dad\Desktop\mbam.exe
[2012/06/13 10:49:09 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\Wise Registry Cleaner
[2012/06/13 10:48:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
[2012/06/13 10:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Wise
[2012/06/13 10:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/06/13 10:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XdN Software
[2012/06/13 10:03:53 | 000,000,000 | ---D | C] -- C:\Program Files\XdN Software
[2012/06/13 10:03:26 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\blekkotb_031
[2012/06/13 10:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Anti-phishing Domain Advisor
[2012/06/13 09:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities
[2012/06/13 09:07:08 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\GlarySoft
[2012/06/13 09:07:07 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
[2012/06/13 06:59:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/13 06:58:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2012/06/22 16:03:01 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/22 16:03:01 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/22 15:56:19 | 000,000,308 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/22 15:55:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/22 15:55:18 | 1610,113,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/21 06:41:43 | 000,080,384 | ---- | M] () -- C:\Users\Dad\Desktop\MBRCheck.exe
[2012/06/19 17:25:19 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/06/19 17:03:12 | 004,562,361 | R--- | M] (Swearware) -- C:\Users\Dad\Desktop\G2GMR.exe
[2012/06/18 15:38:14 | 261,317,735 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/18 05:30:08 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Dad\Desktop\aswMBR.exe
[2012/06/18 05:04:21 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/17 14:11:35 | 002,109,032 | ---- | M] () -- C:\Users\Dad\Desktop\tdsskiller.zip
[2012/06/17 14:09:05 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Dad\Desktop\GooredFix.exe
[2012/06/15 16:21:48 | 000,007,840 | ---- | M] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 06:53:56 | 001,472,019 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/15 05:13:49 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012/06/14 07:55:06 | 000,442,332 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.old
[2012/06/14 06:35:00 | 000,001,047 | ---- | M] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:35:00 | 000,001,023 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:33:27 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Dad\Desktop\mbam.exe
[2012/06/14 06:24:46 | 001,008,141 | ---- | M] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | M] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 07:38:00 | 000,371,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/13 07:33:20 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/13 07:33:20 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/13 07:17:51 | 000,015,602 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:13 | 000,046,870 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/06/13 06:58:09 | 000,007,627 | ---- | M] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2012/05/29 08:32:04 | 000,002,175 | ---- | M] () -- C:\Users\Dad\Desktop\Kindle.lnk

========== Files Created - No Company Name ==========

[2012/06/21 06:41:39 | 000,080,384 | ---- | C] () -- C:\Users\Dad\Desktop\MBRCheck.exe
[2012/06/19 17:04:36 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/06/19 17:04:36 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/06/19 17:04:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/06/19 17:04:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/06/19 17:04:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/06/17 14:11:27 | 002,109,032 | ---- | C] () -- C:\Users\Dad\Desktop\tdsskiller.zip
[2012/06/15 16:18:09 | 000,007,840 | ---- | C] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 07:11:38 | 261,317,735 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/06/15 06:51:59 | 001,472,019 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/14 06:35:00 | 000,001,047 | ---- | C] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:35:00 | 000,001,023 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:24:44 | 001,008,141 | ---- | C] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | C] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 09:07:15 | 000,000,308 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/13 07:17:48 | 000,015,602 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:01 | 000,046,870 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/05/16 07:43:45 | 000,007,627 | ---- | C] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2011/10/12 07:21:53 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI

========== LOP Check ==========

[2011/02/22 14:22:35 | 000,000,000 | ---D | M] -- C:\Users\Bethany\AppData\Roaming\enchant
[2010/07/28 12:02:49 | 000,000,000 | ---D | M] -- C:\Users\Bethany\AppData\Roaming\Thunderbird
[2012/04/14 06:47:40 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Aaron Stewart
[2011/05/24 06:53:28 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Amazon
[2011/12/11 13:33:17 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\AMS Software
[2012/06/17 14:27:03 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\DriverCure
[2009/12/23 17:41:47 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\enchant
[2012/05/06 07:22:39 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Free Download Manager
[2011/07/17 13:06:14 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\FreeFLVConverter
[2012/06/13 09:16:02 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\GlarySoft
[2011/08/07 18:01:14 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\GrabPro
[2010/04/30 11:14:12 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\gtk-2.0
[2012/04/14 07:01:44 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Hulubulu
[2012/05/06 07:15:38 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\IObit
[2011/05/19 05:36:32 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\LibreOffice
[2012/05/08 06:28:55 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Orbit
[2011/12/09 08:14:59 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\PhotoCollageMax
[2011/06/26 09:17:58 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\ProgSense
[2012/06/17 14:27:03 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\SpeedMaxPc
[2010/04/30 11:32:20 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Sylpheed
[2012/06/15 06:51:04 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\TestApp
[2010/04/29 16:11:52 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Thunderbird
[2011/11/21 07:35:01 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Visan
[2011/07/15 13:09:57 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\WeatherBug
[2011/07/20 10:06:28 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Winff
[2012/06/13 10:56:35 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Wise Registry Cleaner
[2010/11/07 17:07:17 | 000,000,000 | ---D | M] -- C:\Users\Gary\AppData\Roaming\Thunderbird
[2011/01/03 12:33:56 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\enchant
[2012/05/06 08:52:00 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\IObit
[2010/04/30 06:16:12 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\Thunderbird
[2012/06/22 15:56:19 | 000,000,308 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012/05/27 13:14:01 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:D74B6CF5

< End of report >

[Garysam43]

OTL logfile created on: 6/22/2012 4:03:52 PM - Run 3
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\Dad\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.32 Gb Available Physical Memory | 66.09% Memory free
4.00 Gb Paging File | 3.12 Gb Available in Paging File | 77.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66.10 Gb Total Space | 36.99 Gb Free Space | 55.97% Space Free | Partition Type: NTFS
Drive D: | 74.53 Gb Total Space | 45.72 Gb Free Space | 61.35% Space Free | Partition Type: NTFS
Drive E: | 8.33 Gb Total Space | 1.27 Gb Free Space | 15.28% Space Free | Partition Type: NTFS

Computer Name: OURPC | User Name: Dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/18 05:04:21 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
PRC - [2012/05/03 14:07:40 | 000,217,256 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/23 01:39:24 | 000,803,432 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/03/05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe


========== Modules (No Company Name) ==========

MOD - [2007/03/02 00:54:32 | 000,657,920 | ---- | M] () -- C:\Program Files\File Shredder\fsshell.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012/06/19 16:59:23 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/08/31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/06 13:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/02/24 16:16:38 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/04/29 04:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Dad\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:14 | 000,044,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:48 | 000,057,688 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/12 09:26:20 | 000,101,112 | R--- | M] (GFI Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/08/31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/02/23 02:57:00 | 010,468,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/22 17:13:28 | 000,041,912 | ---- | M] (FSPro Labs) [File_System | Boot | Running] -- C:\Windows\System32\drivers\FSPFltd.sys -- (FSProFilter)
DRV - [2009/07/13 18:13:47 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2009/04/29 04:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2009/02/13 06:58:30 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2009/02/13 06:56:32 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\SearchScopes,DefaultScope = {45751D25-4CDF-4ECB-AE06-6C79A5BBC31E}
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: [email protected]:1.3.4
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..keyword.URL: "http://blekko.com/ws...&u=USERGUID&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.2.72: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.2.72: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/02/16 06:58:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/03/29 04:58:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/16 06:58:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2012/02/16 06:57:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/02/06 13:31:06 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/16 06:58:57 | 000,000,000 | ---D | M]

[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions
[2010/04/29 16:11:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012/06/14 06:03:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\extensions
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Sunbird\Profiles\zyd2w965.default\extensions
[2012/02/17 08:09:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/29 04:58:26 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/06/19 16:59:24 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 07:14:01 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/06/19 16:59:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/09 08:38:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/06/19 16:59:20 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/06/19 17:25:19 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-82361716-3830150136-294940581-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: albertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: myalbertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: mysupervalu.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: star401kplan.com ([karentkaczyk] * in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: supervalu.com ([]* in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...tDetection2.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C152CCA5-F351-4D72-A386-E444466A89B8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/22 15:49:32 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/06/19 17:35:45 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\temp
[2012/06/19 17:04:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/06/19 17:04:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/06/19 17:04:36 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/06/19 17:03:03 | 004,562,361 | R--- | C] (Swearware) -- C:\Users\Dad\Desktop\G2GMR.exe
[2012/06/18 05:29:43 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Dad\Desktop\aswMBR.exe
[2012/06/18 05:04:17 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\SpeedMaxPc
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\DriverCure
[2012/06/17 14:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2012/06/17 14:12:31 | 000,000,000 | ---D | C] -- C:\Users\Dad\Desktop\tdsskiller
[2012/06/17 14:09:39 | 000,000,000 | ---D | C] -- C:\Users\Dad\Desktop\GooredFix Backups
[2012/06/17 14:09:02 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Users\Dad\Desktop\GooredFix.exe
[2012/06/15 06:57:09 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012/06/15 06:51:37 | 000,203,088 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2012/06/15 06:51:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012/06/15 06:51:06 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/06/15 06:51:04 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\TestApp
[2012/06/14 07:49:13 | 000,101,112 | R--- | C] (GFI Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2012/06/14 06:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/14 06:34:55 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/06/14 06:34:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/14 06:33:14 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Dad\Desktop\mbam.exe
[2012/06/13 10:49:09 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\Wise Registry Cleaner
[2012/06/13 10:48:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
[2012/06/13 10:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Wise
[2012/06/13 10:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/06/13 10:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XdN Software
[2012/06/13 10:03:53 | 000,000,000 | ---D | C] -- C:\Program Files\XdN Software
[2012/06/13 10:03:26 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\blekkotb_031
[2012/06/13 10:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Anti-phishing Domain Advisor
[2012/06/13 09:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities
[2012/06/13 09:07:08 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\GlarySoft
[2012/06/13 09:07:07 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
[2012/06/13 06:59:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/13 06:58:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2012/06/22 16:03:01 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/22 16:03:01 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/22 15:56:19 | 000,000,308 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/22 15:55:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/22 15:55:18 | 1610,113,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/21 06:41:43 | 000,080,384 | ---- | M] () -- C:\Users\Dad\Desktop\MBRCheck.exe
[2012/06/19 17:25:19 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/06/19 17:03:12 | 004,562,361 | R--- | M] (Swearware) -- C:\Users\Dad\Desktop\G2GMR.exe
[2012/06/18 15:38:14 | 261,317,735 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/18 05:30:08 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Dad\Desktop\aswMBR.exe
[2012/06/18 05:04:21 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/17 14:11:35 | 002,109,032 | ---- | M] () -- C:\Users\Dad\Desktop\tdsskiller.zip
[2012/06/17 14:09:05 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Users\Dad\Desktop\GooredFix.exe
[2012/06/15 16:21:48 | 000,007,840 | ---- | M] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 06:53:56 | 001,472,019 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/15 05:13:49 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012/06/14 07:55:06 | 000,442,332 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.old
[2012/06/14 06:35:00 | 000,001,047 | ---- | M] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:35:00 | 000,001,023 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:33:27 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Dad\Desktop\mbam.exe
[2012/06/14 06:24:46 | 001,008,141 | ---- | M] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | M] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 07:38:00 | 000,371,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/13 07:33:20 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/13 07:33:20 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/13 07:17:51 | 000,015,602 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:13 | 000,046,870 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/06/13 06:58:09 | 000,007,627 | ---- | M] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2012/05/29 08:32:04 | 000,002,175 | ---- | M] () -- C:\Users\Dad\Desktop\Kindle.lnk

========== Files Created - No Company Name ==========

[2012/06/21 06:41:39 | 000,080,384 | ---- | C] () -- C:\Users\Dad\Desktop\MBRCheck.exe
[2012/06/19 17:04:36 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/06/19 17:04:36 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/06/19 17:04:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/06/19 17:04:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/06/19 17:04:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/06/17 14:11:27 | 002,109,032 | ---- | C] () -- C:\Users\Dad\Desktop\tdsskiller.zip
[2012/06/15 16:18:09 | 000,007,840 | ---- | C] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 07:11:38 | 261,317,735 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/06/15 06:51:59 | 001,472,019 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/14 06:35:00 | 000,001,047 | ---- | C] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:35:00 | 000,001,023 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2012/06/14 06:24:44 | 001,008,141 | ---- | C] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | C] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 09:07:15 | 000,000,308 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/13 07:17:48 | 000,015,602 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:01 | 000,046,870 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/05/16 07:43:45 | 000,007,627 | ---- | C] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2011/10/12 07:21:53 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI

========== LOP Check ==========

[2011/02/22 14:22:35 | 000,000,000 | ---D | M] -- C:\Users\Bethany\AppData\Roaming\enchant
[2010/07/28 12:02:49 | 000,000,000 | ---D | M] -- C:\Users\Bethany\AppData\Roaming\Thunderbird
[2012/04/14 06:47:40 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Aaron Stewart
[2011/05/24 06:53:28 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Amazon
[2011/12/11 13:33:17 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\AMS Software
[2012/06/17 14:27:03 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\DriverCure
[2009/12/23 17:41:47 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\enchant
[2012/05/06 07:22:39 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Free Download Manager
[2011/07/17 13:06:14 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\FreeFLVConverter
[2012/06/13 09:16:02 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\GlarySoft
[2011/08/07 18:01:14 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\GrabPro
[2010/04/30 11:14:12 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\gtk-2.0
[2012/04/14 07:01:44 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Hulubulu
[2012/05/06 07:15:38 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\IObit
[2011/05/19 05:36:32 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\LibreOffice
[2012/05/08 06:28:55 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Orbit
[2011/12/09 08:14:59 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\PhotoCollageMax
[2011/06/26 09:17:58 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\ProgSense
[2012/06/17 14:27:03 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\SpeedMaxPc
[2010/04/30 11:32:20 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Sylpheed
[2012/06/15 06:51:04 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\TestApp
[2010/04/29 16:11:52 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Thunderbird
[2011/11/21 07:35:01 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Visan
[2011/07/15 13:09:57 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\WeatherBug
[2011/07/20 10:06:28 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Winff
[2012/06/13 10:56:35 | 000,000,000 | ---D | M] -- C:\Users\Dad\AppData\Roaming\Wise Registry Cleaner
[2010/11/07 17:07:17 | 000,000,000 | ---D | M] -- C:\Users\Gary\AppData\Roaming\Thunderbird
[2011/01/03 12:33:56 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\enchant
[2012/05/06 08:52:00 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\IObit
[2010/04/30 06:16:12 | 000,000,000 | ---D | M] -- C:\Users\Mom\AppData\Roaming\Thunderbird
[2012/06/22 15:56:19 | 000,000,308 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012/05/27 13:14:01 | 000,032,586 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:D74B6CF5

< End of report >

[WhiteHat]

Hello,

How is your computer?

Disable your antivirus software

• Acess the Eset Online Scanner website using Internet Explorer navigator.
  http://www.eset.com/us/online-scanner/
• Do the scan according the image:
  
  
• At the end, check the box "Delete Quarantined files" and click in [FINISH]
• It will be generated a log in C:\Program Files\EsetOnlineScanner\Log.txt
  PS: If you didn't find the log.txt file in \EsetOnlineScanner\, look on \Program Files\Eset\EsetOnlineScanner\log.txt
• Post that log.

[Garysam43]

Findgala is gone: I think the PC is all set. Thank you WhiteHat.
Here is the ESET log file contents:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

FYI, the log appears to have been created when ESET started, and it's the only log file in the ESET folders. Also, ESET reported finding and deleting 2 infections.

[WhiteHat]

Findgala is gone: I think the PC is all set.

I'm glad to hear this

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

The following will implement some cleanup procedures as well as reset System Restore points:

Remove OTL:

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• (If you use Windows 7/Vista)
• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

• (If you use Windows XP)
• Go to Start > All Programs > Acessories > System Tools > System Restore.
• Select the option Create a restore point and click in Next.
• Type in a name i.e. Clean
• Select Create

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place??

Keep safe.

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

The following will implement some cleanup procedures as well as reset System Restore points:

Remove OTL:

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• (If you use Windows 7/Vista)
• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

• (If you use Windows XP)
• Go to Start > All Programs > Acessories > System Tools > System Restore.
• Select the option Create a restore point and click in Next.
• Type in a name i.e. Clean
• Select Create

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place??

Keep safe.

[Garysam43]

Hi WhiteHat. I have several questions:
1. OTL "Cleanup" did not remove all the programs you used: should I usw WIN7 Uninstall to remove GOOREDFIX, MBRCheck, aswMBR,and G2GMR?
2. Malwarebytes PRO has expired. I uninstalled it, but the daily reminder popup is still there, saying "Your Free Trial Has Expired", then the PC freezes. This happens only on user IDs. I'd like to purchase MB Pro, but don't want to do anything more with MB until I can get this popup off my PC. Can you tell me how to proceed on this?

I did everything on your latest post: OTL Cleanup, Do Not Show Hidden Files, JAVA update, Restore Point, Windows 7 Update,. I've printed off "Preventing Malware and Safe Computing" and am starting on the items listed. Thank you.

[WhiteHat]

1. To uninstall GooredFix, MBRCheck and aswMBR, you only need to delete the .exe file

To delete the G2GMR do this:

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

2. Run the MalwareBytes uninstall tool:
http://www.malwareby.../mbam-clean.exe

It will ask to restart your computer (please allow it to).

[Garysam43]

Thanks WhiteHat - that took care of all of my last-post questions, especially getting the old Malwarebytes "cleaned" off the PC so users now run fast and clean.I spent the rest of the day implementing as many of the "Preventing Malware and Safe Computing" tips as possible. Some would not work with WIN7: SysRestorePoint, Windows Recovery Console (I think it's been moved to the WIN7 Install disk).
Norton Safeweb is not compatible with Firefox current version. I do have several questions:
1. How do you identify all/any peer-to-peer programs so that you can uninstall them?
2. Is it OK to run Spyware Search and Destroy, MBAM and SUPERAntiSpyware together, and if not, which one should be always active versus scan all, once per week?
3. TLC ran, then asked for a restart to finish, then went into a never-ending shutdown. Any ideas on how fix this?
Thanks.

[WhiteHat]

1. How do you identify all/any peer-to-peer programs so that you can uninstall them?

Ex: uTorrent, BitTorrent, LimeWire, Ares, Kazaa, Shareaza, BearShare and similar.

2. Is it OK to run Spyware Search and Destroy, MBAM and SUPERAntiSpyware together, and if not, which one should be always active versus scan all, once per week?

You can keep all but one should have resident protection on.

3. TLC ran, then asked for a restart to finish, then went into a never-ending shutdown. Any ideas on how fix this?

No idea.

[Garysam43]

I changed startup settings and now only Malwarebytes Pro is resident. We are experiencing a problem, consistently: if we log off an Id, then log onto another ID, the PC freezes, and we must turn off the power to get back up. Should I post this issue to another forum?

[Garysam43]

WhiteHat - our PC is now completely unstable: freezes randomly during logon, running a program, during power-up. Only fix is to turn off the power and try again. If successful, freezes again in a few minutes.

[WhiteHat]

Hi Garysam43,

our PC is now completely unstable: freezes randomly during logon, running a program, during power-up. Only fix is to turn off the power and try again. If successful, freezes again in a few minutes.

Can you give more details? Do you installed or modified any program during this time?

# Step 1 #

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• In Extra Registry, select Use SafeList
• Under the Custom Scan box paste this in
  

  netsvcs
  msconfig
  drives
  %SYSTEMDRIVE%\*.*
  %systemdrive%\drivers\*.exe
  %systemroot%\system32\drivers\*.* /90
  %PROGRAMFILES%\*.*
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /rs
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /64 /rs
  CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

# Step 2 #

Please download Farbar Service Scanner and run it on the computer.

• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

[Garysam43]

Hi WhiteHat: the freeze problem started a week ago, when I wasn't changing anything unless you instructed me to. It's become more severe in the last 2 days, and yes, I changed a number of things:
1. I removed all of your tools, following your instructions.
2. I made sure hidden files are "Do Not Show".
3. I updated JAVA
4. Created a restore point.
5. Remove free Malwarebytes (clean option), then installed MBAM Pro Edition.
6. Installed FileHippo and updated outdated programs.
7. Updated WIN7 with KB915597
8. Updated AVAST and turned off Windows Defender.
Following the Geekstogo instructions in "Preventing Malware and Safe Computing:
9. Backed up the registry with ERUNT (Erunt does not say WIN7 is supported).
10. Downloaded SysRestorePoint, but discovered it does not support WIN7.
11. Installed SUPERAntiSpyware and SpywareBlaster, but did not make them resident, as MBAM Pro is resident.
12. Updated Spybot Search & Destroy, but made it non-resident.
13. Added NoScript to Firefox.
14. Tried to add Norton Safeweb to FF, but it's not compatible, so I uninstalled it (Safeweb).
15. Followed the change settings instructions to make IE9 more secure (don't use IE unless a web site really needs it.
16. Installed KeyScrambler.
17. Installed OpenDNS, but haven't got it working yet.
18. Uninstalled Adobe Reader.
19. Installed Foxit for PDF files.
20. Installed Oldtimer's TFC, but it did not run to normal EOJ.

As I said at top, the system frrezes have gotten worse, but were already happening a week ago. Thanks in advance, for your help.
OTL logfile created on: 6/27/2012 6:08:04 PM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Dad\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.68% Memory free
4.00 Gb Paging File | 3.12 Gb Available in Paging File | 78.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66.10 Gb Total Space | 39.17 Gb Free Space | 59.25% Space Free | Partition Type: NTFS
Drive D: | 74.53 Gb Total Space | 48.69 Gb Free Space | 65.34% Space Free | Partition Type: NTFS
Drive E: | 8.33 Gb Total Space | 1.27 Gb Free Space | 15.28% Space Free | Partition Type: NTFS

Computer Name: OURPC | User Name: Dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/27 18:04:53 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
PRC - [2012/05/03 14:07:40 | 000,217,256 | ---- | M] (Visicom Media Inc. (Powered by Panda Security)) -- C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe
PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/03/26 03:34:22 | 000,306,688 | ---- | M] (FileHippo.com) -- C:\Program Files\FileHippo.com\UpdateChecker.exe
PRC - [2012/03/06 19:15:17 | 004,241,512 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/08/11 19:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
PRC - [2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/23 01:39:24 | 000,803,432 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2010/11/20 08:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/06/16 17:42:58 | 000,839,680 | ---- | M] () -- C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/13 11:18:41 | 001,670,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6c59a14a23f734093e80d6093e25302a\Microsoft.VisualBasic.ni.dll
MOD - [2012/06/13 07:41:10 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/13 07:40:19 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 07:40:07 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/10 07:19:00 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/10 07:17:01 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/10 07:16:55 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/10 07:16:53 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/10 07:16:37 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2010/06/16 17:42:58 | 000,839,680 | ---- | M] () -- C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012/06/19 16:59:23 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/03/06 19:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/08/11 19:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2010/02/24 16:16:38 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/04/29 04:21:04 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)


========== Driver Services (SafeList) ==========

DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/03/06 19:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/03/06 19:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/03/06 19:02:14 | 000,044,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012/03/06 19:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/03/06 19:01:48 | 000,057,688 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012/03/06 19:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/01/12 09:26:20 | 000,101,112 | R--- | M] (GFI Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/12/14 20:41:38 | 000,173,880 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\keyscrambler.sys -- (KeyScrambler)
DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/02/23 02:57:00 | 010,468,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/22 17:13:28 | 000,041,912 | ---- | M] (FSPro Labs) [File_System | Boot | Running] -- C:\Windows\System32\drivers\FSPFltd.sys -- (FSProFilter)
DRV - [2009/07/13 19:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009/07/13 18:13:47 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2009/04/29 04:20:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2009/02/13 06:58:30 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2009/02/13 06:56:32 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: [email protected]:1.3.4
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..keyword.URL: "http://blekko.com/ws...&u=USERGUID&q="
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/25 07:58:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/03/29 04:58:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/06/25 07:58:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/25 14:16:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components [2012/06/25 07:58:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/06/25 12:51:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/19 16:59:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/25 14:16:10 | 000,000,000 | ---D | M]

[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions
[2010/04/29 16:11:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012/06/25 13:35:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\extensions
[2012/06/25 13:35:56 | 000,000,000 | ---D | M] (KeyScrambler) -- C:\Users\Dad\AppData\Roaming\Mozilla\Firefox\Profiles\2pwyj0go.default\extensions\[email protected]
[2011/12/11 13:12:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dad\AppData\Roaming\Mozilla\Sunbird\Profiles\zyd2w965.default\extensions
[2012/02/17 08:09:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/03/29 04:58:26 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/06/25 13:12:31 | 000,525,301 | ---- | M] () (No name found) -- C:\USERS\DAD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2PWYJ0GO.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2012/06/19 16:59:24 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/25 07:58:04 | 000,129,144 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/06/19 16:59:20 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/09 08:38:11 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/06/19 16:59:20 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - Extension: YouTube = C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google Search = C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: Gmail = C:\Users\Dad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

O1 HOSTS File: ([2012/06/24 06:51:35 | 000,442,125 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15216 more lines...
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [Anti-phishing Domain Advisor] C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe (Visicom Media Inc. (Powered by Panda Security))
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-82361716-3830150136-294940581-1000..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKU\S-1-5-21-82361716-3830150136-294940581-1000..\Run: [OpenDNS Updater] C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: albertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: myalbertsons.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: mysupervalu.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: star401kplan.com ([karentkaczyk] * in Trusted sites)
O15 - HKU\S-1-5-21-82361716-3830150136-294940581-1000\..Trusted Domains: supervalu.com ([]* in Trusted sites)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.h...tDetection2.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.5.0)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C152CCA5-F351-4D72-A386-E444466A89B8}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/27 18:04:47 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/25 16:55:10 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\Malwarebytes
[2012/06/25 16:55:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/25 16:55:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/06/25 16:55:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/06/25 16:55:01 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/25 16:22:05 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\OpenDNS Updater
[2012/06/25 16:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\OpenDNS Updater
[2012/06/25 14:14:18 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\Foxit Software
[2012/06/25 14:14:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[2012/06/25 14:14:00 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2012/06/25 13:36:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\QFX Software
[2012/06/25 13:36:03 | 000,000,000 | ---D | C] -- C:\ProgramData\QFX Software
[2012/06/25 13:35:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyScrambler
[2012/06/25 13:35:38 | 000,173,880 | ---- | C] (QFX Software Corporation) -- C:\Windows\System32\drivers\keyscrambler.sys
[2012/06/25 13:35:37 | 000,000,000 | ---D | C] -- C:\Program Files\KeyScrambler
[2012/06/25 13:21:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012/06/25 13:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012/06/25 13:05:37 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSSTDFMT.DLL
[2012/06/25 13:05:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2012/06/25 13:05:35 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2012/06/25 12:28:31 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\SUPERAntiSpyware.com
[2012/06/25 12:28:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/06/25 12:28:17 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/06/25 12:28:17 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012/06/25 12:15:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/06/25 12:15:26 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2012/06/25 07:58:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\xing shared
[2012/06/25 07:57:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks
[2012/06/25 07:54:36 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\Macromedia
[2012/06/25 07:36:50 | 000,000,000 | ---D | C] -- C:\Program Files\FileHippo.com
[2012/06/25 07:29:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012/06/25 07:28:32 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2012/06/25 07:28:05 | 000,772,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012/06/25 07:28:05 | 000,227,824 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012/06/23 13:32:05 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/06/22 06:27:06 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012/06/22 06:27:06 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012/06/22 06:26:50 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012/06/22 06:26:50 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012/06/22 06:26:50 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012/06/22 06:26:38 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012/06/22 06:26:38 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012/06/19 17:35:45 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/06/19 17:35:38 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\temp
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\SpeedMaxPc
[2012/06/17 14:27:03 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\DriverCure
[2012/06/17 14:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedMaxPc
[2012/06/15 06:57:09 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012/06/15 06:51:37 | 000,203,088 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2012/06/15 06:51:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012/06/15 06:51:06 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/06/15 06:51:04 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\TestApp
[2012/06/14 07:49:13 | 000,101,112 | R--- | C] (GFI Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2012/06/13 10:49:09 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\Wise Registry Cleaner
[2012/06/13 10:48:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
[2012/06/13 10:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Wise
[2012/06/13 10:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2012/06/13 10:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XdN Software
[2012/06/13 10:03:53 | 000,000,000 | ---D | C] -- C:\Program Files\XdN Software
[2012/06/13 10:03:26 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Local\blekkotb_031
[2012/06/13 10:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Anti-phishing Domain Advisor
[2012/06/13 09:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities
[2012/06/13 09:07:08 | 000,000,000 | ---D | C] -- C:\Users\Dad\AppData\Roaming\GlarySoft
[2012/06/13 09:07:07 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
[2012/06/13 07:24:39 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012/06/13 07:24:37 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/06/13 07:24:37 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/06/13 07:24:36 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012/06/13 07:24:34 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/06/13 07:24:34 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/06/13 07:24:32 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/06/13 07:23:20 | 002,343,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/06/13 07:23:03 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012/06/13 07:23:02 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/06/13 07:23:02 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/06/13 07:23:01 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/06/13 06:59:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/06/13 06:58:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2012/06/27 18:05:11 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 18:05:11 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/27 18:04:53 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Dad\Desktop\OTL.exe
[2012/06/27 17:56:57 | 000,000,308 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/27 17:56:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/06/27 17:56:04 | 1610,113,024 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/25 16:55:05 | 000,001,023 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/25 14:14:06 | 000,001,076 | ---- | M] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/06/25 14:14:05 | 000,001,052 | ---- | M] () -- C:\Users\Public\Desktop\Foxit Reader.lnk
[2012/06/25 13:05:38 | 000,000,993 | ---- | M] () -- C:\Users\Dad\Desktop\SpywareBlaster.lnk
[2012/06/25 12:51:11 | 000,001,931 | ---- | M] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
[2012/06/25 12:51:11 | 000,001,907 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012/06/25 12:49:12 | 000,000,921 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/25 12:28:23 | 000,001,917 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/06/25 12:15:27 | 000,000,855 | ---- | M] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2012/06/25 07:59:23 | 000,001,190 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2012/06/25 07:58:28 | 000,198,832 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2012/06/25 07:57:59 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2012/06/25 07:57:59 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2012/06/25 07:57:56 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2012/06/25 07:53:50 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/06/25 07:53:50 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/06/25 07:36:50 | 000,001,871 | ---- | M] () -- C:\Users\Dad\Desktop\Update Checker.lnk
[2012/06/25 07:27:33 | 000,227,824 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012/06/25 07:27:33 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012/06/25 07:27:33 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012/06/24 06:51:35 | 000,442,125 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/06/24 06:48:23 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012/06/19 17:25:19 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.20120624-065135.backup
[2012/06/18 15:38:14 | 261,317,735 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/06/15 16:21:48 | 000,007,840 | ---- | M] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 06:53:56 | 001,472,019 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/14 07:55:06 | 000,442,332 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.old
[2012/06/14 06:24:46 | 001,008,141 | ---- | M] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | M] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | M] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 07:38:00 | 000,371,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/06/13 07:33:20 | 000,623,940 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/06/13 07:33:20 | 000,106,316 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/06/13 07:17:51 | 000,015,602 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:13 | 000,046,870 | ---- | M] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/06/13 06:58:09 | 000,007,627 | ---- | M] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2012/06/02 18:19:33 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012/06/02 18:19:32 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012/06/02 18:19:23 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012/06/02 18:12:32 | 002,422,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012/06/02 18:12:13 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012/06/02 15:19:42 | 000,171,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012/06/02 15:12:20 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012/05/29 08:32:04 | 000,002,175 | ---- | M] () -- C:\Users\Dad\Desktop\Kindle.lnk

========== Files Created - No Company Name ==========

[2012/06/25 16:55:05 | 000,001,023 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/25 16:22:05 | 000,001,922 | ---- | C] () -- C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenDNS Updater.lnk
[2012/06/25 14:14:06 | 000,001,076 | ---- | C] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2012/06/25 14:14:05 | 000,001,052 | ---- | C] () -- C:\Users\Public\Desktop\Foxit Reader.lnk
[2012/06/25 13:05:38 | 000,000,993 | ---- | C] () -- C:\Users\Dad\Desktop\SpywareBlaster.lnk
[2012/06/25 12:51:11 | 000,001,907 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012/06/25 12:49:12 | 000,000,921 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/06/25 12:28:23 | 000,001,917 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/06/25 12:15:27 | 000,000,855 | ---- | C] () -- C:\Users\Dad\Application Data\Microsoft\Internet Explorer\Quick Launch\ERUNT.lnk
[2012/06/25 07:59:23 | 000,001,190 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2012/06/25 07:36:50 | 000,001,901 | ---- | C] () -- C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
[2012/06/25 07:36:50 | 000,001,871 | ---- | C] () -- C:\Users\Dad\Desktop\Update Checker.lnk
[2012/06/15 16:18:09 | 000,007,840 | ---- | C] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2012/06/15 07:11:38 | 261,317,735 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/06/15 06:51:59 | 001,472,019 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2012/06/14 06:24:44 | 001,008,141 | ---- | C] () -- C:\Users\Dad\Desktop\rkill.com
[2012/06/13 10:48:27 | 000,001,141 | ---- | C] () -- C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
[2012/06/13 10:03:54 | 000,001,116 | ---- | C] () -- C:\Users\Public\Desktop\XdN Tweaker.lnk
[2012/06/13 09:07:15 | 000,000,308 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize.job
[2012/06/13 07:17:48 | 000,015,602 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_071746.reg
[2012/06/13 07:02:01 | 000,046,870 | ---- | C] () -- C:\Users\Public\Documents\cc_20120613_070152.reg
[2012/05/16 07:43:45 | 000,007,627 | ---- | C] () -- C:\Users\Dad\AppData\Local\Resmon.ResmonCfg
[2011/10/12 07:21:53 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI

========== Custom Scans ==========

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST380021A ATA Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST380815AS ATA Device
Partitions: 3
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 -
Interface type: USB
Media Type:
Model: Generic- Compact Flash USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 -
Interface type: USB
Media Type:
Model: Generic- SM/xD-Picture USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE4 -
Interface type: USB
Media Type:
Model: Generic- SD/MMC USB Device
Partitions: 0
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE5 -
Interface type: USB
Media Type:
Model: Generic- MS/MS-Pro USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 75.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 0.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #1, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 66.00GB
Starting Offset: 105906176
Hidden sectors: 0


DeviceID: Disk #1, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 8.00GB
Starting Offset: 71082869760
Hidden sectors: 0


< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/06/10 17:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2012/06/27 17:56:04 | 1610,113,024 | -HS- | M] () -- C:\hiberfil.sys
[2009/11/23 11:37:28 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/11/23 11:37:28 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012/06/27 17:56:05 | 2146,820,096 | -HS- | M] () -- C:\pagefile.sys
[2012/06/15 13:32:55 | 000,000,388 | ---- | M] () -- C:\rkill.log

< %systemdrive%\drivers\*.exe >

< %systemroot%\system32\drivers\*.* /90 >
[2012/06/15 06:53:56 | 001,472,019 | ---- | M] () -- C:\Windows\system32\drivers\Cat.DB
[2012/06/15 16:21:48 | 000,007,840 | ---- | M] () -- C:\Windows\system32\drivers\kgpcpy.cfg
[2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\system32\drivers\mbam.sys
[2012/05/11 11:14:20 | 000,203,088 | ---- | M] (PC Tools) -- C:\Windows\system32\drivers\PCTSD.sys
[2012/04/27 23:17:07 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\drivers\rdpwd.sys
[2012/03/30 06:23:11 | 001,291,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\drivers\tcpip.sys

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2012/05/17 19:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2012/05/17 19:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation)

< HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/06/19 16:59:20 | 000,867,072 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/06/19 16:59:23 | 000,913,888 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2011/04/06 18:13:23 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2012/05/17 19:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SOFTWARE\CLIENTS\Startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2012/05/17 19:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation)

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:D74B6CF5

< End of report >
OTL Extras logfile created on: 6/27/2012 6:08:04 PM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Dad\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.68% Memory free
4.00 Gb Paging File | 3.12 Gb Available in Paging File | 78.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 66.10 Gb Total Space | 39.17 Gb Free Space | 59.25% Space Free | Partition Type: NTFS
Drive D: | 74.53 Gb Total Space | 48.69 Gb Free Space | 65.34% Space Free | Partition Type: NTFS
Drive E: | 8.33 Gb Total Space | 1.27 Gb Free Space | 15.28% Space Free | Partition Type: NTFS

Computer Name: OURPC | User Name: Dad | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [runas] -- cmd.exe /c takeown /f "%1" /r /d y && icacls "%1" /grant administrators:F /t (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CF850F7-BBE5-43CF-AE7E-06D37C7A6CF0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1921DFC5-DC00-4429-A8D2-5D7E372E7DF4}" = rport=139 | protocol=6 | dir=out | app=system |
"{1BF73C11-FA74-48B4-9CFE-C8E4C8AD92AD}" = rport=137 | protocol=17 | dir=out | app=system |
"{1CB0ECA6-61EF-45FB-8B19-A396440628C4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1DF74B40-330D-48F9-AC80-62D802033041}" = rport=138 | protocol=17 | dir=out | app=system |
"{1E9096D5-9CB4-4929-A0A5-3D9E8CD1933A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{314C2257-B698-4F64-BFC6-EB376A105F86}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4223DC88-C2B1-4DB8-B3A8-3BD16118C6FF}" = lport=138 | protocol=17 | dir=in | app=system |
"{53B1E6A3-8A5C-46EC-9516-3270863D16C9}" = lport=445 | protocol=6 | dir=in | app=system |
"{5A536603-59AE-4E4F-9030-22C9F54BB226}" = rport=445 | protocol=6 | dir=out | app=system |
"{615021D3-C3CB-470D-BC1C-399013FE6E98}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7DE3FA75-4D57-45BF-AD94-8E33CE561FAE}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8658D806-5FBC-45FC-9DDA-605EFCF7E4B6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8C6542CD-3119-4F69-8453-E34DBBEA148E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{94374C9D-33E9-46F6-8FE1-A0604EF9FC78}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{96E48D18-E2D7-4D00-B75D-C431941C8F98}" = lport=139 | protocol=6 | dir=in | app=system |
"{A39FEBE3-1610-4811-9EB8-A8A55AB0DD4C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B071D6FB-C4E8-4CEE-9200-09F4A24871BB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BB7E1135-A739-48A8-8A10-8725ADC4D025}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D8322782-9BDB-4547-85E8-DA4A0161AD04}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{E7929D93-EB84-4579-AFA4-A2EFC2D50360}" = lport=137 | protocol=17 | dir=in | app=system |
"{FD510105-A84A-415D-92C5-6CC246A1ADA5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FEDB232C-3854-4F84-A8E8-04C50F6C0243}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00DEEAE3-ACF6-47A7-9D1F-6D744F55E9F4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{01A35726-5818-41DC-AD1B-2163FAFFB3EE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{419D10B0-59AB-4F8A-819F-66D1A154FD27}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52FB4696-C521-4FDF-A0BD-A7C6DD933608}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{610FD175-0945-4AB8-B416-D61C73B670A2}" = protocol=1 | dir=in | [email protected],-28543 |
"{76460D8F-6638-432E-B18F-538B0881ACB0}" = protocol=6 | dir=out | app=system |
"{83B90A6E-CFE3-45EF-8C23-B08A2EE6A43F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{98BFBE11-EB7C-4A9C-AA0A-DE5F032AD53D}" = protocol=58 | dir=out | [email protected],-28546 |
"{996148A1-5A6C-436A-B1BD-CB081603643C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A3C53F64-3C15-4C20-99D8-AC0E1E2DAEDC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A5A62ED4-E0E5-41B4-B36A-5256BDE00BBF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AC8BE58D-D0D0-449E-8585-10ECA8060969}" = protocol=1 | dir=out | [email protected],-28544 |
"{C065C2B9-F84D-44B4-A538-BF53EFC711B5}" = protocol=58 | dir=in | [email protected],-28545 |
"{D4BBB2A4-C3CB-414A-9780-9825C0DED5F7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E015E596-060E-4428-9744-832B8A7D6CEB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E669642F-C7E9-4884-B925-D1BE2936FCF4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{34F191B7-E9F1-40E2-8CA2-43AA7938AD2B}C:\program files\free download manager\fdmwi.exe" = protocol=6 | dir=in | app=c:\program files\free download manager\fdmwi.exe |
"TCP Query User{A50FE639-B6C8-466A-9B58-001E583B6549}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{D4C10D60-0D3D-4A7A-9B7C-0214CE8E6E4B}C:\program files\satellite direct\satellitedirect.exe" = protocol=6 | dir=in | app=c:\program files\satellite direct\satellitedirect.exe |
"TCP Query User{DB3B9870-90EA-4997-8085-95D85068D021}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{ECFEFFFB-1383-46E0-8ED6-3A586DC96FAC}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{00A58D39-18AB-4CEB-AF69-717BD6D6A6C8}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{0D86AA1D-3AA2-4A07-A897-5EE0B13A1065}C:\program files\free download manager\fdmwi.exe" = protocol=17 | dir=in | app=c:\program files\free download manager\fdmwi.exe |
"UDP Query User{1E2026E7-2521-43BB-A7A7-214636EE1E6E}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{3A89A95A-CD3F-4091-A663-BCC3A576A0B8}C:\program files\satellite direct\satellitedirect.exe" = protocol=17 | dir=in | app=c:\program files\satellite direct\satellitedirect.exe |
"UDP Query User{DCEFCA76-B01C-4184-B536-0BAA21D26575}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java™ 7 Update 5
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{62687EAC-F27D-49AC-A0E2-3899B0459113}" = Hallmark Card Studio 2011 Deluxe
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBFEC34-FBF0-4BBF-8A90-BBDB514531A2}_is1" = Satellite Direct v2.8.1.1
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 267.24
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 267.24
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CEE2613D-3B53-4447-BA2D-E88C08272581}" = LibreOffice 3.3
"{E0570DE2-4B9D-47B6-A034-3B18829C0EAC}" = 2011 Hallmark Registration Bonus Pack
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Anti-phishing Domain Advisor" = Anti-phishing Domain Advisor
"avast" = avast! Free Antivirus
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"File Shredder_is1" = File Shredder 2.0
"FileHippo.com" = FileHippo.com Update Checker
"Foxit Reader_is1" = Foxit Reader
"Free Download Manager_is1" = Free Download Manager 3.7 RC1
"Glary Utilities_is1" = Glary Utilities 2.46.0.1518
"HDMI" = Intel® Graphics Media Accelerator Driver
"i-Fun Viewer_is1" = i-Fun Viewer
"KeyScrambler" = KeyScrambler
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 13.0.1 (x86 en-US)" = Mozilla Firefox 13.0.1 (x86 en-US)
"Mozilla Thunderbird 13.0.1 (x86 en-US)" = Mozilla Thunderbird 13.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"My Lockbox_is1" = My Lockbox 2.8.2
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"OpenDNS Updater" = OpenDNS Updater 2.2.1
"PhotoStitch" = Canon Utilities PhotoStitch
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 15.0" = RealPlayer
"RemoteCaptureDC" = Canon Utilities RemoteCapture DC
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"SpywareBlaster_is1" = SpywareBlaster 4.6
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 7.31
"XdN Tweaker" = XdN Tweaker 0.9.2.6
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-82361716-3830150136-294940581-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/18/2012 6:09:19 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/19/2012 3:04:03 PM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/20/2012 6:24:02 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/21/2012 8:24:31 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/22/2012 7:26:25 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/24/2012 11:28:23 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/25/2012 8:40:30 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/25/2012 12:58:56 PM | Computer Name = OURPC | Source = Application Error | ID = 1000
Description = Faulting application name: Explorer.EXE, version: 6.1.7601.17567,
time stamp: 0x4d6727a7 Faulting module name: fsshell.dll_unloaded, version: 0.0.0.0,
time stamp: 0x2a425e19 Exception code: 0xc0000005 Fault offset: 0x045c33ec Faulting
process id: 0x910 Faulting application start time: 0x01cd52f18abacaac Faulting application
path: C:\Windows\Explorer.EXE Faulting module path: fsshell.dll Report Id: 0c6652a9-bee7-11e1-a0de-001bfcd05fa1

Error - 6/25/2012 2:21:14 PM | Computer Name = OURPC | Source = Application Error | ID = 1000
Description = Faulting application name: services.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bbf1b Faulting module name: ntdll.dll, version: 6.1.7601.17725,
time stamp: 0x4ec49b60 Exception code: 0xc0000005 Fault offset: 0x000303a2 Faulting
process id: 0x234 Faulting application start time: 0x01cd52f929c7754b Faulting application
path: C:\Windows\system32\services.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 8bc5040e-bef2-11e1-be18-001bfcd05fa1

Error - 6/27/2012 6:14:00 AM | Computer Name = OURPC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 6/27/2012 6:06:57 PM | Computer Name = OURPC | Source = Application Hang | ID = 1002
Description = The program AvastUI.exe version 7.0.1426.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 788 Start
Time: 01cd54afc5ed9ab5 Termination Time: 60000 Application Path: C:\Program Files\AVAST
Software\Avast\AvastUI.exe Report Id: 3becc5e3-c0a4-11e1-9066-001bfcd05fa1

[ Media Center Events ]
Error - 4/28/2011 5:43:11 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 5:43:11 AM - Error connecting to the internet. 5:43:11 AM - Unable
to contact server..

Error - 5/3/2011 7:02:48 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 7:02:48 AM - Error connecting to the internet. 7:02:48 AM - Unable
to contact server..

Error - 5/3/2011 8:03:14 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 8:03:13 AM - Error connecting to the internet. 8:03:13 AM - Unable
to contact server..

Error - 5/3/2011 9:03:38 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 9:03:38 AM - Error connecting to the internet. 9:03:38 AM - Unable
to contact server..

Error - 5/13/2011 6:46:23 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 6:46:22 AM - Error connecting to the internet. 6:46:23 AM - Unable
to contact server..

Error - 5/28/2011 7:52:56 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 7:52:56 AM - Error connecting to the internet. 7:52:56 AM - Unable
to contact server..

Error - 5/28/2011 8:53:18 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 8:53:18 AM - Error connecting to the internet. 8:53:18 AM - Unable
to contact server..

Error - 5/28/2011 9:53:36 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 9:53:36 AM - Error connecting to the internet. 9:53:36 AM - Unable
to contact server..

Error - 5/28/2011 11:29:31 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 11:29:31 AM - Error connecting to the internet. 11:29:31 AM - Unable
to contact server..

Error - 6/2/2011 8:09:21 AM | Computer Name = OURPC | Source = MCUpdate | ID = 0
Description = 8:09:21 AM - Error connecting to the internet. 8:09:21 AM - Unable
to contact server..

[ System Events ]
Error - 6/27/2012 1:32:28 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7000
Description = The SBSD Security Center Service service failed to start due to the
following error: %%2

Error - 6/27/2012 1:32:39 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7024
Description = The HomeGroup Listener service terminated with service-specific error
%%-2147023143.

Error - 6/27/2012 2:39:46 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7000
Description = The SBSD Security Center Service service failed to start due to the
following error: %%2

Error - 6/27/2012 5:56:09 PM | Computer Name = OURPC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 5:52:53 PM on ?6/?27/?2012 was unexpected.

Error - 6/27/2012 5:57:58 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7022
Description = The Base Filtering Engine service hung on starting.

Error - 6/27/2012 5:57:58 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7001
Description = The Windows Firewall service depends on the Base Filtering Engine
service which failed to start because of the following error: %%1070

Error - 6/27/2012 5:57:58 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7001
Description = The IKE and AuthIP IPsec Keying Modules service depends on the Base
Filtering Engine service which failed to start because of the following error:
%%1070

Error - 6/27/2012 5:57:59 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7001
Description = The Internet Connection Sharing (ICS) service depends on the Base
Filtering Engine service which failed to start because of the following error: %%1070

Error - 6/27/2012 5:57:59 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7000
Description = The SBSD Security Center Service service failed to start due to the
following error: %%2

Error - 6/27/2012 5:58:10 PM | Computer Name = OURPC | Source = Service Control Manager | ID = 7024
Description = The HomeGroup Listener service terminated with service-specific error
%%-2147023143.


< End of report >
Farbar Service Scanner Version: 25-06-2012 01
Ran by Dad (administrator) on 27-06-2012 at 18:33:37
Running from "C:\Users\Dad\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

[WhiteHat]

Hi Garysam43,

About the computer freeze, this can happen for several reasons:

• Temperature
• HD
• Memory
• OS = Windows

# Step 1 #

Download and run the CrystalDiskInfo. In the main of the software you will see a screen like this:



Tell me the health status.

# Step 2 #

Download Auslogic Disc Defrag

Install the software and run it.

Next, select all your discs and click in the Desfragment option

Wait until Auslogic Disc Defrag finish the defragmentation and reboot your computer.

# Step 3 #

Run Disk Checker.

• On the desktop click the My Computer icon, or click Start then click Computer
• Right click your main drive (I am on C) and select Properties
• Select the Tools tab
• Select error checking
• Place a tick in both boxes in the Check Disk (OS) window
• Press Start
• You will get a warning that it needs to reboot to continue
• Allow it to do so

# Step 4 #

Run System File checker

- Click Start, click All programs and Accessories
- Right click Command Prompt and select Run as Administrator.
- Type SFC.exe /Scannow
- The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.
- Type Exit and press [ENTER] to close the command prompt

[Garysam43]

Hi WhitHat, here are the results
1. CrystalDiskInfo: Health=C: and E: GOOD 31 degrees Celsius; D: CAUTION 28 degrees Celsius
2. Ran Auslogic Disc Defrag (all discs) and rebooted: PC froze after logon.
3. Ran Disk Checker
4. File Checker: "Run As Administrator" is not available with right click on Command Prompt: I tried "Take Ownership": DOS box appeared briefly then disappeared (back to Windows). I then left clicked on Command Prompt, got DOS box, ran SFC.exe /Scannow. It ran, said it fix corrupted files and created a log file. I could not find any "SFC" log file, but did find a CBS text file with today's date and time: I'll post it in a second reply.
5. I then tried logoff then logon to another ID; got black screen and PC froze.