Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Pop up ads and redirect [Solved]


  • This topic is locked This topic is locked

#1
Bellah

Bellah

    New Member

  • Member
  • Pip
  • 4 posts
Hello,
Recently I started having issues when browsing the internet. I am having trouble with pop up ads in addition to being redirected. I ran OLT. Here is my log. I appreciate any help you can offer.

Thank you in advance!

OTL logfile created on: 10/4/2012 11:30:48 AM - Run 1
OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\Gayle\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.99 Gb Total Physical Memory | 6.08 Gb Available Physical Memory | 76.10% Memory free
15.98 Gb Paging File | 14.08 Gb Available in Paging File | 88.10% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.08 Gb Total Space | 737.27 Gb Free Space | 80.22% Space Free | Partition Type: NTFS
Drive D: | 12.33 Gb Total Space | 2.23 Gb Free Space | 18.04% Space Free | Partition Type: NTFS

Computer Name: GAYLE-PC | User Name: Gayle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/04 11:29:36 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\Gayle\Downloads\OTL (1).exe
PRC - [2012/08/09 23:43:02 | 000,316,840 | ---- | M] (Razer USA Ltd) -- C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
PRC - [2012/02/23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2011/06/15 23:00:29 | 001,355,968 | ---- | M] (Lavasoft) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011/06/15 23:00:29 | 000,864,664 | ---- | M] (Lavasoft) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/09/20 05:05:06 | 000,755,096 | ---- | M] () -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWWSC.exe
PRC - [2010/03/11 00:22:04 | 000,599,408 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
PRC - [2010/03/11 00:21:16 | 000,300,400 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
PRC - [2010/01/13 17:44:52 | 000,037,888 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe
PRC - [2009/09/04 10:47:19 | 000,117,640 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
PRC - [2009/08/05 15:45:22 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/07/23 22:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009/03/16 02:47:28 | 000,122,880 | ---- | M] () -- C:\Windows\SysWOW64\WinMsgBalloonServer.exe
PRC - [2009/03/16 02:47:24 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\WinMsgBalloonClient.exe
PRC - [2009/03/16 02:47:22 | 000,122,880 | ---- | M] (AMD) -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
PRC - [2009/03/16 02:47:20 | 000,065,536 | ---- | M] () -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
PRC - [2009/01/26 15:31:16 | 002,144,088 | ---- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/09/30 20:59:26 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/25 04:42:58 | 000,460,312 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppgooglenaclpluginchrome.dll
MOD - [2012/09/25 04:42:57 | 012,278,808 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\PepperFlash\pepflashplayer.dll
MOD - [2012/09/25 04:42:55 | 004,005,912 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
MOD - [2012/09/25 04:41:39 | 000,578,072 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\libglesv2.dll
MOD - [2012/09/25 04:41:38 | 000,123,416 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\libegl.dll
MOD - [2012/09/25 04:41:27 | 000,156,712 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\avutil-51.dll
MOD - [2012/09/25 04:41:26 | 000,275,496 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\avformat-54.dll
MOD - [2012/09/25 04:41:24 | 002,168,360 | ---- | M] () -- C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\avcodec-54.dll
MOD - [2012/06/14 03:10:36 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll
MOD - [2012/06/14 03:10:24 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll
MOD - [2012/06/14 03:10:21 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll
MOD - [2012/06/14 03:10:15 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll
MOD - [2012/06/14 03:10:14 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll
MOD - [2012/06/11 03:39:05 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll
MOD - [2012/06/11 03:37:21 | 001,021,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\79ac99fe5274fb82ffcff2c15f71854c\System.Runtime.DurableInstancing.ni.dll
MOD - [2012/06/11 03:37:20 | 002,647,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\8a9fac9cb825b5d2db0bdb867fff940e\System.Runtime.Serialization.ni.dll
MOD - [2012/06/11 03:37:20 | 000,143,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\bb97517e4ca64e02282fca24612ce8ad\SMDiagnostics.ni.dll
MOD - [2012/06/11 03:37:18 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\4837a5c6204d53e7aa4f7dd94b98207c\System.Xml.Linq.ni.dll
MOD - [2012/06/11 03:36:55 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll
MOD - [2012/06/11 03:15:23 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll
MOD - [2012/06/11 03:13:27 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll
MOD - [2012/06/11 03:13:24 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll
MOD - [2012/06/11 03:13:21 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll
MOD - [2012/06/11 03:13:15 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll
MOD - [2012/06/11 03:13:08 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/08/05 15:45:22 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/09/12 21:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 21:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2012/06/11 13:12:16 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2011/06/01 02:58:10 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/10/04 08:55:02 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/10/04 06:52:02 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/06/15 23:00:29 | 001,355,968 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/10/22 14:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\hp\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/04 10:47:19 | 000,117,640 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe -- (Norton Internet Security)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/16 02:47:22 | 000,122,880 | ---- | M] (AMD) [Auto | Running] -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe -- (AMD_RAIDXpert)
SRV - [2008/09/30 20:59:26 | 000,192,512 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe -- (HPBtnSrv)
SRV - [2005/02/09 13:59:00 | 000,014,165 | ---- | M] (Pinnacle Systems GmbH) [Auto | Stopped] -- C:\Windows\SysWOW64\drivers\Pclepci.sys -- (PCLEPCI)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0)
DRV:64bit: - [2012/08/30 22:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/08/17 02:01:22 | 000,110,592 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rzudd.sys -- (rzudd)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV:64bit: - [2012/03/01 01:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/08/02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/06/01 05:12:38 | 009,320,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011/06/01 05:12:38 | 009,320,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/06/01 02:19:14 | 000,306,688 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/29 06:31:18 | 001,579,520 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/09/20 05:05:10 | 000,069,152 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2010/03/31 15:01:30 | 000,583,296 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\cchpx64.sys -- (ccHP)
DRV:64bit: - [2010/03/31 08:20:40 | 000,172,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010/01/20 16:18:24 | 000,334,384 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\BHDrvx64.sys -- (BHDrvx64)
DRV:64bit: - [2009/10/05 10:08:44 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
DRV:64bit: - [2009/09/04 10:47:20 | 000,476,720 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2009/09/04 10:47:20 | 000,402,992 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\SymEFA64.sys -- (SymEFA)
DRV:64bit: - [2009/09/04 10:47:20 | 000,278,576 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symtdi.sys -- (SYMTDI)
DRV:64bit: - [2009/09/04 10:47:20 | 000,120,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symfw.sys -- (SYMFW)
DRV:64bit: - [2009/09/04 10:47:20 | 000,056,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symndisv.sys -- (SYMNDISV)
DRV:64bit: - [2009/09/04 10:47:20 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2009/09/04 10:47:20 | 000,031,280 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SymIMV.sys -- (SymIM)
DRV:64bit: - [2009/07/31 06:10:58 | 000,237,936 | ---- | M] (Advanced Micro Devices, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ahcix64s.sys -- (ahcix64s)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/13 09:31:42 | 000,233,472 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/29 04:00:00 | 000,116,752 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/06/17 09:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2009/06/17 09:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/05 05:00:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2010/05/26 03:00:00 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2009/10/28 17:37:22 | 000,466,992 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100520.001\IDSviA64.sys -- (IDSVia64)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...bestbuy&pf=cndt
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...bestbuy&pf=cndt
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE:64bit: - HKLM\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE:64bit: - HKLM\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE - HKLM\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F4 08 B0 01 13 A0 C6 43 AB D1 84 F6 60 06 7A 3E [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE - HKCU\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKCU\..\SearchScopes\{71EA71D0-C007-4895-9A62-CDFE163EF35A}: "URL" = http://search.avg.co...e}&iy=&ychte=us
IE - HKCU\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://findgala.com/...q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.condui...={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: " "
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons: {ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}:1.0
FF - prefs.js..extensions.enabledAddons: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.15.1.0
FF - prefs.js..extensions.enabledAddons: {e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:4.5
FF - prefs.js..extensions.enabledItems: {ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}:1.0
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}:1.0
FF - prefs.js..keyword.URL: "http://search.condui...d=CT2786678&q="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/30 15:50:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/08/06 13:39:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/04 06:52:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/30 11:05:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/30 15:50:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/04 06:52:03 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/30 11:05:18 | 000,000,000 | ---D | M]

[2009/12/09 16:20:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Extensions
[2012/09/28 08:39:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions
[2011/07/13 05:58:27 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}
[2012/09/28 08:39:23 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/09/08 10:31:41 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}
[2011/11/08 07:53:58 | 000,000,863 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\searchplugins\conduit.xml
[2011/09/08 11:33:08 | 000,001,210 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\searchplugins\search.xml
[2011/11/13 17:01:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/10/04 06:52:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/03/11 00:01:02 | 000,124,272 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2010/03/11 00:02:52 | 000,070,512 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2010/03/11 00:01:48 | 000,091,504 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2010/03/11 00:01:24 | 000,022,384 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2010/03/11 00:40:56 | 000,423,248 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2010/01/13 17:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2010/03/11 00:02:48 | 000,023,920 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
[2012/10/04 06:51:49 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/04 06:51:49 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.160.1 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U16 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: Cloud Reader = C:\Users\Gayle\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjnkloegafmkhgpjglcbldhaokjpandj\1.0.0.0_0\

O1 HOSTS File: ([2011/09/08 11:33:13 | 000,001,275 | RHS- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 74.55.76.230 www.google-analytics.com.
O1 - Hosts: 74.55.76.230 ad-emea.doubleclick.net.
O1 - Hosts: 74.55.76.230 www.statcounter.com.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [Razer Synapse] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer USA Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - Startup: C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F15B4B8-496F-4121-AD1B-5162465E2AEF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93A2B26C-249D-4A2B-8948-F3D70561B6CA}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found
O18:64bit: - Protocol\Filter\ica - No CLSID value found
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\SYSTEM32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/12/24 13:26:11 | 000,000,107 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/04 11:08:21 | 000,208,216 | ---- | C] (Kaspersky Lab, GERT) -- C:\Windows\SysNative\drivers\77383185.sys
[2012/10/04 10:57:30 | 000,000,000 | ---D | C] -- C:\Users\Gayle\Desktop\backups
[2012/10/04 10:17:09 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Gayle\Desktop\HijackThis.exe
[2012/09/24 18:57:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012/09/17 19:25:14 | 002,212,440 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Gayle\Desktop\TDSSKiller.exe

========== Files - Modified Within 30 Days ==========

[2012/10/04 11:24:25 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 11:24:25 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 11:24:13 | 000,001,161 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.new
[2012/10/04 11:17:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/04 11:16:59 | 2141,106,175 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/04 11:08:21 | 000,208,216 | ---- | M] (Kaspersky Lab, GERT) -- C:\Windows\SysNative\drivers\77383185.sys
[2012/10/04 11:06:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2686551917-1041324788-1683791448-1001UA.job
[2012/10/04 10:17:15 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Gayle\Desktop\HijackThis.exe
[2012/10/04 09:44:57 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/04 08:55:39 | 000,001,320 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2012/10/04 08:54:15 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForGayle.job
[2012/10/04 07:06:03 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2686551917-1041324788-1683791448-1001Core.job
[2012/10/02 03:01:07 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/10/02 03:01:05 | 000,660,296 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/10/02 03:01:05 | 000,121,224 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/30 10:00:05 | 000,000,552 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job
[2012/09/28 09:19:59 | 000,090,264 | ---- | M] () -- C:\Users\Gayle\Desktop\bode_logsheet.pdf
[2012/09/27 09:07:38 | 000,002,491 | ---- | M] () -- C:\Users\Gayle\Desktop\Google Chrome.lnk
[2012/09/27 07:17:49 | 000,141,015 | ---- | M] () -- C:\Users\Gayle\Desktop\turkeyhat.pdf
[2012/09/25 11:00:51 | 000,268,499 | ---- | M] () -- C:\Users\Gayle\Desktop\horns.odt
[2012/09/24 20:32:06 | 000,076,765 | ---- | M] () -- C:\Users\Gayle\Desktop\il_570xN.184888908[1].jpg
[2012/09/24 19:21:08 | 000,001,438 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012/09/24 08:49:10 | 000,091,734 | ---- | M] () -- C:\Users\Gayle\Desktop\Hungry_Caterpillar_Hat.pdf
[2012/09/24 08:46:04 | 000,588,077 | ---- | M] () -- C:\Users\Gayle\Desktop\Fuzzy_One-Eyed_Monster_Beanie_KGreen.pdf
[2012/09/24 08:16:43 | 004,406,650 | ---- | M] () -- C:\Users\Gayle\Desktop\Crocheted-Aviator-Baby-Hat.pdf
[2012/09/24 08:13:27 | 000,024,462 | ---- | M] () -- C:\Users\Gayle\Desktop\Kids_Earflap_Hat.pdf
[2012/09/24 07:49:43 | 000,624,262 | ---- | M] () -- C:\Users\Gayle\Desktop\Goteam.pdf
[2012/09/24 07:47:36 | 000,298,176 | ---- | M] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps (1).pdf
[2012/09/24 07:38:14 | 000,657,814 | ---- | M] () -- C:\Users\Gayle\Desktop\bulky_ear-flap_hat.pdf
[2012/09/24 07:27:41 | 000,051,532 | ---- | M] () -- C:\Users\Gayle\Desktop\apple hat.odt
[2012/09/24 07:24:47 | 000,053,057 | ---- | M] () -- C:\Users\Gayle\Desktop\premie earflap.odt
[2012/09/19 12:35:31 | 000,363,356 | ---- | M] () -- C:\Users\Gayle\Desktop\Witch_Hat_for_pets.pdf
[2012/09/19 12:31:44 | 000,576,649 | ---- | M] () -- C:\Users\Gayle\Desktop\P250220_comfy_canine_sweater.pdf
[2012/09/19 12:13:13 | 000,030,264 | ---- | M] () -- C:\Users\Gayle\Desktop\dog coat.jpg
[2012/09/19 07:05:35 | 000,782,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/19 07:04:04 | 000,854,300 | ---- | M] () -- C:\Users\Gayle\Desktop\SCAN0005.JPG
[2012/09/17 19:25:14 | 002,212,440 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Gayle\Desktop\TDSSKiller.exe
[2012/09/17 11:10:19 | 000,001,142 | ---- | M] () -- C:\Users\Gayle\Desktop\shape-oval[1].jpg
[2012/09/17 11:05:37 | 000,032,996 | ---- | M] () -- C:\Users\Gayle\Desktop\Oval[1].jpg
[2012/09/17 09:13:40 | 000,455,868 | ---- | M] () -- C:\Users\Gayle\Desktop\1-1301603337[1].png
[2012/09/12 17:56:39 | 000,298,176 | ---- | M] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps.pdf
[2012/09/12 17:32:29 | 000,187,502 | ---- | M] () -- C:\Users\Gayle\Desktop\Faster_Football_2_medium2[1].jpg
[2012/09/12 17:30:54 | 000,187,349 | ---- | M] () -- C:\Users\Gayle\Desktop\Faster_Football_1_medium2[1].jpg
[2012/09/10 08:46:10 | 000,008,521 | ---- | M] () -- C:\Users\Gayle\Desktop\Fall oders.odt
[2012/09/07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/09/07 08:12:09 | 000,032,181 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog ball.odt
[2012/09/07 07:34:32 | 000,020,937 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog toy.odt
[2012/09/07 07:23:40 | 000,166,498 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog collar.pdf
[2012/09/07 07:22:55 | 000,029,942 | ---- | M] () -- C:\Users\Gayle\Desktop\puppy vest.odt

========== Files Created - No Company Name ==========

[2012/10/04 09:44:57 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/04 08:55:39 | 000,001,320 | ---- | C] () -- C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2012/09/28 09:19:59 | 000,090,264 | ---- | C] () -- C:\Users\Gayle\Desktop\bode_logsheet.pdf
[2012/09/27 07:17:49 | 000,141,015 | ---- | C] () -- C:\Users\Gayle\Desktop\turkeyhat.pdf
[2012/09/24 20:32:16 | 000,076,765 | ---- | C] () -- C:\Users\Gayle\Desktop\il_570xN.184888908[1].jpg
[2012/09/24 18:57:20 | 000,001,438 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012/09/24 08:49:10 | 000,091,734 | ---- | C] () -- C:\Users\Gayle\Desktop\Hungry_Caterpillar_Hat.pdf
[2012/09/24 08:46:04 | 000,588,077 | ---- | C] () -- C:\Users\Gayle\Desktop\Fuzzy_One-Eyed_Monster_Beanie_KGreen.pdf
[2012/09/24 08:31:19 | 000,268,499 | ---- | C] () -- C:\Users\Gayle\Desktop\horns.odt
[2012/09/24 08:16:43 | 004,406,650 | ---- | C] () -- C:\Users\Gayle\Desktop\Crocheted-Aviator-Baby-Hat.pdf
[2012/09/24 08:13:27 | 000,024,462 | ---- | C] () -- C:\Users\Gayle\Desktop\Kids_Earflap_Hat.pdf
[2012/09/24 07:49:43 | 000,624,262 | ---- | C] () -- C:\Users\Gayle\Desktop\Goteam.pdf
[2012/09/24 07:47:36 | 000,298,176 | ---- | C] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps (1).pdf
[2012/09/24 07:38:14 | 000,657,814 | ---- | C] () -- C:\Users\Gayle\Desktop\bulky_ear-flap_hat.pdf
[2012/09/24 07:27:41 | 000,051,532 | ---- | C] () -- C:\Users\Gayle\Desktop\apple hat.odt
[2012/09/24 07:24:46 | 000,053,057 | ---- | C] () -- C:\Users\Gayle\Desktop\premie earflap.odt
[2012/09/19 12:35:31 | 000,363,356 | ---- | C] () -- C:\Users\Gayle\Desktop\Witch_Hat_for_pets.pdf
[2012/09/19 12:31:43 | 000,576,649 | ---- | C] () -- C:\Users\Gayle\Desktop\P250220_comfy_canine_sweater.pdf
[2012/09/19 12:30:15 | 000,030,264 | ---- | C] () -- C:\Users\Gayle\Desktop\dog coat.jpg
[2012/09/19 07:04:07 | 000,854,300 | ---- | C] () -- C:\Users\Gayle\Desktop\SCAN0005.JPG
[2012/09/17 11:10:28 | 000,001,142 | ---- | C] () -- C:\Users\Gayle\Desktop\shape-oval[1].jpg
[2012/09/17 11:05:52 | 000,032,996 | ---- | C] () -- C:\Users\Gayle\Desktop\Oval[1].jpg
[2012/09/17 09:14:04 | 000,455,868 | ---- | C] () -- C:\Users\Gayle\Desktop\1-1301603337[1].png
[2012/09/12 17:56:39 | 000,298,176 | ---- | C] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps.pdf
[2012/09/12 17:32:38 | 000,187,502 | ---- | C] () -- C:\Users\Gayle\Desktop\Faster_Football_2_medium2[1].jpg
[2012/09/12 17:32:19 | 000,187,349 | ---- | C] () -- C:\Users\Gayle\Desktop\Faster_Football_1_medium2[1].jpg
[2012/09/10 08:46:10 | 000,008,521 | ---- | C] () -- C:\Users\Gayle\Desktop\Fall oders.odt
[2012/09/07 08:12:08 | 000,032,181 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog ball.odt
[2012/09/07 07:34:31 | 000,020,937 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog toy.odt
[2012/09/07 07:23:40 | 000,166,498 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog collar.pdf
[2012/09/07 07:22:54 | 000,029,942 | ---- | C] () -- C:\Users\Gayle\Desktop\puppy vest.odt
[2012/09/04 17:06:42 | 000,054,534 | ---- | C] () -- C:\Users\Gayle\Desktop\il_570xN.333190842[1].jpg
[2012/08/31 15:39:06 | 002,087,263 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpDSCN2463.JPG
[2012/05/04 00:55:33 | 000,000,218 | ---- | C] () -- C:\Windows\wininit.ini
[2012/04/05 20:29:34 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012/04/05 20:29:34 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012/03/09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012/02/20 17:29:23 | 001,071,724 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.2
[2012/02/20 17:29:22 | 001,112,758 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.1
[2012/02/20 17:29:20 | 002,846,035 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.0
[2012/02/20 17:29:20 | 001,061,952 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.JPG
[2011/10/25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011/10/16 14:11:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\prvlcl.dat
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\yywo.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\vygx.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\romb.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\osgu.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\ifyi.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\gnlg.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\fwxe.exe
[2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\encl.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\yugk.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xedf.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\vlsj.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\tifl.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\jbvk.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\clhr.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\bxsy.exe
[2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\andc.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\yhry.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xnjk.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\wrkk.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\vqqa.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tddu.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\svbu.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\sfwf.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\pbbf.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\mlkd.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\emtr.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\crqy.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\ckfq.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\cbfv.exe
[2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\cawo.exe
[2011/09/08 11:33:08 | 000,001,252 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\v36mok4an6a6i
[2011/09/08 11:33:08 | 000,001,252 | -HS- | C] () -- C:\ProgramData\v36mok4an6a6i
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\ywmy.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\veps.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\tthy.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\tibj.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\nldb.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\itoq.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\ihyb.exe
[2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\csbr.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\pllx.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\ocjs.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\kugv.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\ProgramData\fffm.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\eoqr.exe
[2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\ProgramData\cann.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xfxt.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\wtve.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\rbji.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\hjot.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\hblw.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\exxx.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\elxw.exe
[2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\btqg.exe
[2011/08/27 12:14:01 | 000,001,168 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\51e61205ggka45ce1y2ci57555m55kwo4hpmet0kha13
[2011/08/27 12:14:01 | 000,001,168 | -HS- | C] () -- C:\ProgramData\51e61205ggka45ce1y2ci57555m55kwo4hpmet0kha13
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\wvfj.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\rgss.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\qpee.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\mqwj.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\jefy.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\gxda.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\eaop.exe
[2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\cgsw.exe
[2011/08/04 23:45:27 | 000,776,466 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/08/04 09:09:25 | 000,012,054 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\30k1s1eym7st251rc7a17a12r4m603p8w70hdk24
[2011/08/04 09:09:25 | 000,012,054 | -HS- | C] () -- C:\ProgramData\30k1s1eym7st251rc7a17a12r4m603p8w70hdk24
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\yftq.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\uple.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\tyot.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\rugr.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\rtti.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\gsgq.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\clii.exe
[2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\bpxt.exe
[2011/03/17 18:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/02/08 18:09:59 | 000,000,210 | ---- | C] () -- C:\Users\Gayle\AppData\Roaming\wklnhst.dat
[2010/12/24 13:26:11 | 000,196,096 | ---- | C] () -- C:\Windows\SysWow64\macd32.dll
[2010/12/24 13:26:11 | 000,138,752 | ---- | C] () -- C:\Windows\SysWow64\mase32.dll
[2010/12/24 13:26:11 | 000,136,192 | ---- | C] () -- C:\Windows\SysWow64\mamc32.dll
[2010/12/24 13:26:11 | 000,057,856 | ---- | C] () -- C:\Windows\SysWow64\masd32.dll
[2010/12/24 13:26:11 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\ma32.dll

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/13 20:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/01/29 15:22:09 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\.minecraft
[2009/12/09 18:45:58 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\acccore
[2011/08/06 22:33:40 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\AVG10
[2010/10/19 12:03:39 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Echo Software
[2012/08/30 11:05:23 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\ICAClient
[2012/05/03 23:45:26 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Leadertech
[2009/12/10 09:52:34 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\OpenOffice.org
[2009/12/09 16:15:19 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\PictureMover
[2011/02/08 18:10:00 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Template
[2011/08/06 13:36:12 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\uTorrent
[2009/12/22 09:07:54 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there lets fix this for you. When you do the new OTL scan after the fix run could you ensure all users is selected as I will need to repair some registry entries there

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Posted Image

    :OTL
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...bestbuy&pf=cndt
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...bestbuy&pf=cndt
    IE - HKCU\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://findgala.com/...q={searchTerms}
    FF - prefs.js..browser.search.defaulturl: "http://search.condui...={searchTerms}"
    FF - prefs.js..extensions.enabledAddons: {ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}:1.0
    FF - prefs.js..extensions.enabledAddons: {e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}:1.0
    FF - prefs.js..extensions.enabledItems: {ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}:1.0
    FF - prefs.js..extensions.enabledItems: {e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}:1.0
    FF - prefs.js..keyword.URL: "http://search.condui...d=CT2786678&q="
    [2011/07/13 05:58:27 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{ac0e33e8-84c0-45cc-b6d8-e3734b0987c8}
    [2011/09/08 10:31:41 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{e2b33b4f-f5ae-4a89-88ae-7fcf6fd4e381}
    [2011/11/08 07:53:58 | 000,000,863 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\searchplugins\conduit.xml
    [2011/09/08 11:33:08 | 000,001,210 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\searchplugins\search.xml
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
    [2011/10/16 14:11:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\prvlcl.dat
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\yywo.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\vygx.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\romb.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\osgu.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\ProgramData\ifyi.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\gnlg.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\fwxe.exe
    [2011/09/08 11:33:14 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\encl.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\yugk.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xedf.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\vlsj.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\tifl.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\jbvk.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\ProgramData\clhr.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\bxsy.exe
    [2011/09/08 11:33:13 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\andc.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\yhry.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xnjk.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\wrkk.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\vqqa.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tddu.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\svbu.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\sfwf.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\pbbf.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\mlkd.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\emtr.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\crqy.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\ckfq.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\ProgramData\cbfv.exe
    [2011/09/08 11:33:12 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\cawo.exe
    [2011/09/08 11:33:08 | 000,001,252 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\v36mok4an6a6i
    [2011/09/08 11:33:08 | 000,001,252 | -HS- | C] () -- C:\ProgramData\v36mok4an6a6i
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\ywmy.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\veps.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\tthy.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\tibj.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\nldb.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\itoq.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\ProgramData\ihyb.exe
    [2011/09/08 11:33:08 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\csbr.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\pllx.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\ocjs.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\kugv.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\ProgramData\fffm.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\eoqr.exe
    [2011/09/08 11:32:59 | 000,000,000 | ---- | C] () -- C:\ProgramData\cann.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\xfxt.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\wtve.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\rbji.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\hjot.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\hblw.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\exxx.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\elxw.exe
    [2011/09/08 11:32:58 | 000,000,000 | ---- | C] () -- C:\ProgramData\btqg.exe
    [2011/08/27 12:14:01 | 000,001,168 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\51e61205ggka45ce1y2ci57555m55kwo4hpmet0kha13
    [2011/08/27 12:14:01 | 000,001,168 | -HS- | C] () -- C:\ProgramData\51e61205ggka45ce1y2ci57555m55kwo4hpmet0kha13
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\wvfj.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\rgss.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\qpee.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\mqwj.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\jefy.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\gxda.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\eaop.exe
    [2011/08/27 12:14:01 | 000,000,000 | ---- | C] () -- C:\ProgramData\cgsw.exe
    [2011/08/04 09:09:25 | 000,012,054 | -HS- | C] () -- C:\Users\Gayle\AppData\Local\30k1s1eym7st251rc7a17a12r4m603p8w70hdk24
    [2011/08/04 09:09:25 | 000,012,054 | -HS- | C] () -- C:\ProgramData\30k1s1eym7st251rc7a17a12r4m603p8w70hdk24
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\yftq.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\uple.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\tyot.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\rugr.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\rtti.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\gsgq.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\Users\Gayle\AppData\Local\clii.exe
    [2011/08/04 09:09:25 | 000,000,000 | ---- | C] () -- C:\ProgramData\bpxt.exe

    :Reg
    [HKCU\SOFTWARE\Microsoft\Internet Explorer\Main]
    XMLHTTP_UUID_Default=-

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

  • 0

#3
Bellah

Bellah

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Thank you for your fast response. Here is the latest log file.

OTL logfile created on: 10/4/2012 12:44:58 PM - Run 2
OTL by OldTimer - Version 3.2.70.2 Folder = C:\Users\Gayle\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.99 Gb Total Physical Memory | 6.02 Gb Available Physical Memory | 75.38% Memory free
15.98 Gb Paging File | 13.99 Gb Available in Paging File | 87.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 919.08 Gb Total Space | 737.34 Gb Free Space | 80.23% Space Free | Partition Type: NTFS
Drive D: | 12.33 Gb Total Space | 2.23 Gb Free Space | 18.04% Space Free | Partition Type: NTFS

Computer Name: GAYLE-PC | User Name: Gayle | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/04 11:29:01 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\Gayle\Downloads\OTL.exe
PRC - [2012/09/18 12:42:54 | 000,690,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_278_ActiveX.exe
PRC - [2012/08/09 23:43:02 | 000,316,840 | ---- | M] (Razer USA Ltd) -- C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
PRC - [2012/02/23 12:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2011/06/15 23:00:29 | 001,355,968 | ---- | M] (Lavasoft) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011/06/15 23:00:29 | 000,864,664 | ---- | M] (Lavasoft) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/09/20 05:05:06 | 000,755,096 | ---- | M] () -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWWSC.exe
PRC - [2010/03/11 00:22:04 | 000,599,408 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
PRC - [2010/03/11 00:21:16 | 000,300,400 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
PRC - [2010/01/13 17:44:52 | 000,037,888 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\Winamp\winampa.exe
PRC - [2009/09/04 10:47:19 | 000,117,640 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
PRC - [2009/08/05 15:45:22 | 000,206,120 | ---- | M] (CyberLink) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2009/07/23 22:45:52 | 000,128,296 | ---- | M] (CyberLink Corp.) -- c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2009/03/16 02:47:28 | 000,122,880 | ---- | M] () -- C:\Windows\SysWOW64\WinMsgBalloonServer.exe
PRC - [2009/03/16 02:47:24 | 000,139,264 | ---- | M] () -- C:\Windows\SysWOW64\WinMsgBalloonClient.exe
PRC - [2009/03/16 02:47:22 | 000,122,880 | ---- | M] (AMD) -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
PRC - [2009/03/16 02:47:20 | 000,065,536 | ---- | M] () -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
PRC - [2009/01/26 15:31:16 | 002,144,088 | ---- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/09/30 20:59:26 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe


========== Modules (No Company Name) ==========

MOD - [2012/06/14 03:10:36 | 018,000,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\199683f6e79076b634ee6cc0a82c0654\PresentationFramework.ni.dll
MOD - [2012/06/14 03:10:24 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e7dc084827f8df2dbdc819db5c633a0d\PresentationCore.ni.dll
MOD - [2012/06/14 03:10:21 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll
MOD - [2012/06/14 03:10:15 | 003,858,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\21f37f9f5162af7efb52169012bd111e\WindowsBase.ni.dll
MOD - [2012/06/14 03:10:14 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll
MOD - [2012/06/11 03:39:05 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\0c2b0d52156447592f33edf4116b7e7d\System.Management.ni.dll
MOD - [2012/06/11 03:37:21 | 001,021,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\79ac99fe5274fb82ffcff2c15f71854c\System.Runtime.DurableInstancing.ni.dll
MOD - [2012/06/11 03:37:20 | 002,647,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\8a9fac9cb825b5d2db0bdb867fff940e\System.Runtime.Serialization.ni.dll
MOD - [2012/06/11 03:37:20 | 000,143,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\bb97517e4ca64e02282fca24612ce8ad\SMDiagnostics.ni.dll
MOD - [2012/06/11 03:37:18 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\4837a5c6204d53e7aa4f7dd94b98207c\System.Xml.Linq.ni.dll
MOD - [2012/06/11 03:36:55 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\d234eceae699d070b5a5712ce776c01f\System.Xaml.ni.dll
MOD - [2012/06/11 03:15:23 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\a5fa2a1cfc6e9fdc39d9a8f2baa57bc9\PresentationFramework.Aero.ni.dll
MOD - [2012/06/11 03:13:27 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll
MOD - [2012/06/11 03:13:24 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll
MOD - [2012/06/11 03:13:21 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\ed91b57205429a23bb91f4499059a459\System.Core.ni.dll
MOD - [2012/06/11 03:13:15 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll
MOD - [2012/06/11 03:13:08 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2011/09/27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009/08/05 15:45:22 | 000,931,112 | ---- | M] () -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll


========== Services (SafeList) ==========

SRV:64bit: - [2012/09/12 21:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 21:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2012/06/11 13:12:16 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV:64bit: - [2011/06/01 02:58:10 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/10/04 08:55:02 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/06/15 23:00:29 | 001,355,968 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/10/22 14:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\hp\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/04 10:47:19 | 000,117,640 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe -- (Norton Internet Security)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/16 02:47:22 | 000,122,880 | ---- | M] (AMD) [Auto | Running] -- C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe -- (AMD_RAIDXpert)
SRV - [2008/09/30 20:59:26 | 000,192,512 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\HP Easy Backup\HPBtnSrv.exe -- (HPBtnSrv)
SRV - [2005/02/09 13:59:00 | 000,014,165 | ---- | M] (Pinnacle Systems GmbH) [Auto | Stopped] -- C:\Windows\SysWOW64\drivers\Pclepci.sys -- (PCLEPCI)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] -- c:\program files\pc-doctor for windows\pcdsrvc_x64.pkms -- (PCDSRVC{F36B3A4C-F95654BD-06000000}_0)
DRV:64bit: - [2012/08/30 22:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/08/17 02:01:22 | 000,110,592 | ---- | M] (Razer USA Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rzudd.sys -- (rzudd)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1)
DRV:64bit: - [2012/03/05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV:64bit: - [2012/03/01 01:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/08/02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/06/01 05:12:38 | 009,320,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011/06/01 05:12:38 | 009,320,448 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/06/01 02:19:14 | 000,306,688 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/11 01:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/29 06:31:18 | 001,579,520 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/09/20 05:05:10 | 000,069,152 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2010/03/31 15:01:30 | 000,583,296 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\cchpx64.sys -- (ccHP)
DRV:64bit: - [2010/03/31 08:20:40 | 000,172,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2010/02/18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010/01/20 16:18:24 | 000,334,384 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\BHDrvx64.sys -- (BHDrvx64)
DRV:64bit: - [2009/10/05 10:08:44 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ctxusbm.sys -- (ctxusbm)
DRV:64bit: - [2009/09/04 10:47:20 | 000,476,720 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2009/09/04 10:47:20 | 000,402,992 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\SymEFA64.sys -- (SymEFA)
DRV:64bit: - [2009/09/04 10:47:20 | 000,278,576 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symtdi.sys -- (SYMTDI)
DRV:64bit: - [2009/09/04 10:47:20 | 000,120,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symfw.sys -- (SYMFW)
DRV:64bit: - [2009/09/04 10:47:20 | 000,056,880 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\symndisv.sys -- (SYMNDISV)
DRV:64bit: - [2009/09/04 10:47:20 | 000,032,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1008000.029\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2009/09/04 10:47:20 | 000,031,280 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SymIMV.sys -- (SymIM)
DRV:64bit: - [2009/07/31 06:10:58 | 000,237,936 | ---- | M] (Advanced Micro Devices, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\ahcix64s.sys -- (ahcix64s)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/13 09:31:42 | 000,233,472 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/29 04:00:00 | 000,116,752 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009/06/17 09:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2009/06/17 09:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/05 05:00:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2010/05/26 03:00:00 | 000,475,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2009/10/28 17:37:22 | 000,466,992 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100520.001\IDSviA64.sys -- (IDSVia64)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE:64bit: - HKLM\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE:64bit: - HKLM\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE - HKLM\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKLM\..\SearchScopes\{751E1E44-2443-40CE-91E5-06921FFAE97A}: "URL" = http://www.bing.com/...rc=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F4 08 B0 01 13 A0 C6 43 AB D1 84 F6 60 06 7A 3E [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = F4 08 B0 01 13 A0 C6 43 AB D1 84 F6 60 06 7A 3E [binary data]

IE - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..\SearchScopes,DefaultScope = {751E1E44-2443-40CE-91E5-06921FFAE97A}
IE - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..\SearchScopes\{070A1E7C-8DAA-4F73-BC1C-D4DCEF374C5B}: "URL" = http://www.ask.com/w...}&l=dis&o=ushpd
IE - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..\SearchScopes\{71EA71D0-C007-4895-9A62-CDFE163EF35A}: "URL" = http://search.avg.co...e}&iy=&ychte=us
IE - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: " "
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.15.1.0
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledItems: [email protected]:4.5
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.5.0.12
FF - prefs.js..extensions.enabledItems:


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/30 15:50:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011/08/06 13:39:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/04 06:52:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/30 11:05:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/30 15:50:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/10/04 06:52:03 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/30 11:05:18 | 000,000,000 | ---D | M]

[2009/12/09 16:20:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Extensions
[2012/10/04 12:40:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions
[2012/09/28 08:39:23 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\Gayle\AppData\Roaming\Mozilla\Firefox\Profiles\gfgbz0nz.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/11/13 17:01:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) -- C:\USERS\GAYLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GFGBZ0NZ.DEFAULT\EXTENSIONS\{AC0E33E8-84C0-45CC-B6D8-E3734B0987C8}
File not found (No name found) -- C:\USERS\GAYLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GFGBZ0NZ.DEFAULT\EXTENSIONS\{E2B33B4F-F5AE-4A89-88AE-7FCF6FD4E381}
[2012/10/04 06:52:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/03/11 00:01:02 | 000,124,272 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll
[2010/03/11 00:02:52 | 000,070,512 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll
[2010/03/11 00:01:48 | 000,091,504 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll
[2010/03/11 00:01:24 | 000,022,384 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll
[2010/03/11 00:40:56 | 000,423,248 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll
[2010/01/13 17:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2010/03/11 00:02:48 | 000,023,920 | ---- | M] (Citrix Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll
[2012/10/04 06:51:49 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/10/04 06:51:49 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gayle\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.160.1 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U16 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Gayle\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: Cloud Reader = C:\Users\Gayle\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjnkloegafmkhgpjglcbldhaokjpandj\1.0.0.0_0\

O1 HOSTS File: ([2012/10/04 12:37:02 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [Razer Synapse] C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe (Razer USA Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3F15B4B8-496F-4121-AD1B-5162465E2AEF}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93A2B26C-249D-4A2B-8948-F3D70561B6CA}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\symres - No CLSID value found
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18:64bit: - Protocol\Filter\application/x-ica - No CLSID value found
O18:64bit: - Protocol\Filter\ica - No CLSID value found
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\SYSTEM32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/12/24 13:26:11 | 000,000,107 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-2686551917-1041324788-1683791448-1001..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/04 12:36:58 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/10/04 11:08:21 | 000,208,216 | ---- | C] (Kaspersky Lab, GERT) -- C:\Windows\SysNative\drivers\77383185.sys
[2012/10/04 10:57:30 | 000,000,000 | ---D | C] -- C:\Users\Gayle\Desktop\backups
[2012/10/04 10:17:09 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Gayle\Desktop\HijackThis.exe
[2012/09/24 18:57:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
[2012/09/17 19:25:14 | 002,212,440 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Gayle\Desktop\TDSSKiller.exe

========== Files - Modified Within 30 Days ==========

[2012/10/04 12:47:07 | 000,015,792 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 12:47:07 | 000,015,792 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/04 12:39:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/04 12:39:16 | 2141,106,175 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/04 12:37:02 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2012/10/04 12:06:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2686551917-1041324788-1683791448-1001UA.job
[2012/10/04 11:24:13 | 000,001,161 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.new
[2012/10/04 11:08:21 | 000,208,216 | ---- | M] (Kaspersky Lab, GERT) -- C:\Windows\SysNative\drivers\77383185.sys
[2012/10/04 10:17:15 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Gayle\Desktop\HijackThis.exe
[2012/10/04 09:44:57 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/04 08:55:39 | 000,001,320 | ---- | M] () -- C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2012/10/04 08:54:15 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForGayle.job
[2012/10/04 07:06:03 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2686551917-1041324788-1683791448-1001Core.job
[2012/10/02 03:01:07 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/10/02 03:01:05 | 000,660,296 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/10/02 03:01:05 | 000,121,224 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/09/30 10:00:05 | 000,000,552 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job
[2012/09/28 09:19:59 | 000,090,264 | ---- | M] () -- C:\Users\Gayle\Desktop\bode_logsheet.pdf
[2012/09/27 09:07:38 | 000,002,491 | ---- | M] () -- C:\Users\Gayle\Desktop\Google Chrome.lnk
[2012/09/27 07:17:49 | 000,141,015 | ---- | M] () -- C:\Users\Gayle\Desktop\turkeyhat.pdf
[2012/09/25 11:00:51 | 000,268,499 | ---- | M] () -- C:\Users\Gayle\Desktop\horns.odt
[2012/09/24 20:32:06 | 000,076,765 | ---- | M] () -- C:\Users\Gayle\Desktop\il_570xN.184888908[1].jpg
[2012/09/24 19:21:08 | 000,001,438 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012/09/24 08:49:10 | 000,091,734 | ---- | M] () -- C:\Users\Gayle\Desktop\Hungry_Caterpillar_Hat.pdf
[2012/09/24 08:46:04 | 000,588,077 | ---- | M] () -- C:\Users\Gayle\Desktop\Fuzzy_One-Eyed_Monster_Beanie_KGreen.pdf
[2012/09/24 08:16:43 | 004,406,650 | ---- | M] () -- C:\Users\Gayle\Desktop\Crocheted-Aviator-Baby-Hat.pdf
[2012/09/24 08:13:27 | 000,024,462 | ---- | M] () -- C:\Users\Gayle\Desktop\Kids_Earflap_Hat.pdf
[2012/09/24 07:49:43 | 000,624,262 | ---- | M] () -- C:\Users\Gayle\Desktop\Goteam.pdf
[2012/09/24 07:47:36 | 000,298,176 | ---- | M] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps (1).pdf
[2012/09/24 07:38:14 | 000,657,814 | ---- | M] () -- C:\Users\Gayle\Desktop\bulky_ear-flap_hat.pdf
[2012/09/24 07:27:41 | 000,051,532 | ---- | M] () -- C:\Users\Gayle\Desktop\apple hat.odt
[2012/09/24 07:24:47 | 000,053,057 | ---- | M] () -- C:\Users\Gayle\Desktop\premie earflap.odt
[2012/09/19 12:35:31 | 000,363,356 | ---- | M] () -- C:\Users\Gayle\Desktop\Witch_Hat_for_pets.pdf
[2012/09/19 12:31:44 | 000,576,649 | ---- | M] () -- C:\Users\Gayle\Desktop\P250220_comfy_canine_sweater.pdf
[2012/09/19 12:13:13 | 000,030,264 | ---- | M] () -- C:\Users\Gayle\Desktop\dog coat.jpg
[2012/09/19 07:05:35 | 000,782,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/09/19 07:04:04 | 000,854,300 | ---- | M] () -- C:\Users\Gayle\Desktop\SCAN0005.JPG
[2012/09/17 19:25:14 | 002,212,440 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Gayle\Desktop\TDSSKiller.exe
[2012/09/17 11:10:19 | 000,001,142 | ---- | M] () -- C:\Users\Gayle\Desktop\shape-oval[1].jpg
[2012/09/17 11:05:37 | 000,032,996 | ---- | M] () -- C:\Users\Gayle\Desktop\Oval[1].jpg
[2012/09/17 09:13:40 | 000,455,868 | ---- | M] () -- C:\Users\Gayle\Desktop\1-1301603337[1].png
[2012/09/12 17:56:39 | 000,298,176 | ---- | M] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps.pdf
[2012/09/12 17:32:29 | 000,187,502 | ---- | M] () -- C:\Users\Gayle\Desktop\Faster_Football_2_medium2[1].jpg
[2012/09/12 17:30:54 | 000,187,349 | ---- | M] () -- C:\Users\Gayle\Desktop\Faster_Football_1_medium2[1].jpg
[2012/09/10 08:46:10 | 000,008,521 | ---- | M] () -- C:\Users\Gayle\Desktop\Fall oders.odt
[2012/09/07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/09/07 08:12:09 | 000,032,181 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog ball.odt
[2012/09/07 07:34:32 | 000,020,937 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog toy.odt
[2012/09/07 07:23:40 | 000,166,498 | ---- | M] () -- C:\Users\Gayle\Desktop\felted dog collar.pdf
[2012/09/07 07:22:55 | 000,029,942 | ---- | M] () -- C:\Users\Gayle\Desktop\puppy vest.odt

========== Files Created - No Company Name ==========

[2012/10/04 09:44:57 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/04 08:55:39 | 000,001,320 | ---- | C] () -- C:\Users\Gayle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
[2012/09/28 09:19:59 | 000,090,264 | ---- | C] () -- C:\Users\Gayle\Desktop\bode_logsheet.pdf
[2012/09/27 07:17:49 | 000,141,015 | ---- | C] () -- C:\Users\Gayle\Desktop\turkeyhat.pdf
[2012/09/24 20:32:16 | 000,076,765 | ---- | C] () -- C:\Users\Gayle\Desktop\il_570xN.184888908[1].jpg
[2012/09/24 18:57:20 | 000,001,438 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012/09/24 08:49:10 | 000,091,734 | ---- | C] () -- C:\Users\Gayle\Desktop\Hungry_Caterpillar_Hat.pdf
[2012/09/24 08:46:04 | 000,588,077 | ---- | C] () -- C:\Users\Gayle\Desktop\Fuzzy_One-Eyed_Monster_Beanie_KGreen.pdf
[2012/09/24 08:31:19 | 000,268,499 | ---- | C] () -- C:\Users\Gayle\Desktop\horns.odt
[2012/09/24 08:16:43 | 004,406,650 | ---- | C] () -- C:\Users\Gayle\Desktop\Crocheted-Aviator-Baby-Hat.pdf
[2012/09/24 08:13:27 | 000,024,462 | ---- | C] () -- C:\Users\Gayle\Desktop\Kids_Earflap_Hat.pdf
[2012/09/24 07:49:43 | 000,624,262 | ---- | C] () -- C:\Users\Gayle\Desktop\Goteam.pdf
[2012/09/24 07:47:36 | 000,298,176 | ---- | C] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps (1).pdf
[2012/09/24 07:38:14 | 000,657,814 | ---- | C] () -- C:\Users\Gayle\Desktop\bulky_ear-flap_hat.pdf
[2012/09/24 07:27:41 | 000,051,532 | ---- | C] () -- C:\Users\Gayle\Desktop\apple hat.odt
[2012/09/24 07:24:46 | 000,053,057 | ---- | C] () -- C:\Users\Gayle\Desktop\premie earflap.odt
[2012/09/19 12:35:31 | 000,363,356 | ---- | C] () -- C:\Users\Gayle\Desktop\Witch_Hat_for_pets.pdf
[2012/09/19 12:31:43 | 000,576,649 | ---- | C] () -- C:\Users\Gayle\Desktop\P250220_comfy_canine_sweater.pdf
[2012/09/19 12:30:15 | 000,030,264 | ---- | C] () -- C:\Users\Gayle\Desktop\dog coat.jpg
[2012/09/19 07:04:07 | 000,854,300 | ---- | C] () -- C:\Users\Gayle\Desktop\SCAN0005.JPG
[2012/09/17 11:10:28 | 000,001,142 | ---- | C] () -- C:\Users\Gayle\Desktop\shape-oval[1].jpg
[2012/09/17 11:05:52 | 000,032,996 | ---- | C] () -- C:\Users\Gayle\Desktop\Oval[1].jpg
[2012/09/17 09:14:04 | 000,455,868 | ---- | C] () -- C:\Users\Gayle\Desktop\1-1301603337[1].png
[2012/09/12 17:56:39 | 000,298,176 | ---- | C] () -- C:\Users\Gayle\Desktop\Oliver_s_Earflaps.pdf
[2012/09/12 17:32:38 | 000,187,502 | ---- | C] () -- C:\Users\Gayle\Desktop\Faster_Football_2_medium2[1].jpg
[2012/09/12 17:32:19 | 000,187,349 | ---- | C] () -- C:\Users\Gayle\Desktop\Faster_Football_1_medium2[1].jpg
[2012/09/10 08:46:10 | 000,008,521 | ---- | C] () -- C:\Users\Gayle\Desktop\Fall oders.odt
[2012/09/07 08:12:08 | 000,032,181 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog ball.odt
[2012/09/07 07:34:31 | 000,020,937 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog toy.odt
[2012/09/07 07:23:40 | 000,166,498 | ---- | C] () -- C:\Users\Gayle\Desktop\felted dog collar.pdf
[2012/09/07 07:22:54 | 000,029,942 | ---- | C] () -- C:\Users\Gayle\Desktop\puppy vest.odt
[2012/09/04 17:06:42 | 000,054,534 | ---- | C] () -- C:\Users\Gayle\Desktop\il_570xN.333190842[1].jpg
[2012/08/31 15:39:06 | 002,087,263 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpDSCN2463.JPG
[2012/05/04 00:55:33 | 000,000,218 | ---- | C] () -- C:\Windows\wininit.ini
[2012/04/05 20:29:34 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012/04/05 20:29:34 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012/03/09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012/02/20 17:29:23 | 001,071,724 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.2
[2012/02/20 17:29:22 | 001,112,758 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.1
[2012/02/20 17:29:20 | 002,846,035 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.0
[2012/02/20 17:29:20 | 001,061,952 | ---- | C] () -- C:\Users\Gayle\AppData\Local\tmpSCAN0002.JPG
[2011/10/25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011/08/04 23:45:27 | 000,776,466 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/03/17 18:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011/02/08 18:09:59 | 000,000,210 | ---- | C] () -- C:\Users\Gayle\AppData\Roaming\wklnhst.dat
[2010/12/24 13:26:11 | 000,196,096 | ---- | C] () -- C:\Windows\SysWow64\macd32.dll
[2010/12/24 13:26:11 | 000,138,752 | ---- | C] () -- C:\Windows\SysWow64\mase32.dll
[2010/12/24 13:26:11 | 000,136,192 | ---- | C] () -- C:\Windows\SysWow64\mamc32.dll
[2010/12/24 13:26:11 | 000,057,856 | ---- | C] () -- C:\Windows\SysWow64\masd32.dll
[2010/12/24 13:26:11 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\ma32.dll

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/09 00:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/13 20:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011/01/29 15:22:09 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\.minecraft
[2009/12/09 18:45:58 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\acccore
[2011/08/06 22:33:40 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\AVG10
[2010/10/19 12:03:39 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Echo Software
[2012/08/30 11:05:23 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\ICAClient
[2012/05/03 23:45:26 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Leadertech
[2009/12/10 09:52:34 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\OpenOffice.org
[2009/12/09 16:15:19 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\PictureMover
[2011/02/08 18:10:00 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\Template
[2011/08/06 13:36:12 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\uTorrent
[2009/12/22 09:07:54 | 000,000,000 | ---D | M] -- C:\Users\Gayle\AppData\Roaming\WinBatch

========== Purity Check ==========



< End of report >
  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK big question.... Have the popups and redirects ceased ?
  • 0

#5
Bellah

Bellah

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Woo Hoo! It appears to have stopped! Thank you SO much. I thought I was doomed. Can I vote for you for president?

Thank you!
  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Can I vote for you for president?

No I feel I would be over qualified for the job :rofl:

Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :Reg
    [HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
    XMLHTTP_UUID_Default=-
    [HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
    XMLHTTP_UUID_Default=-

    :Files
    C:\USERS\GAYLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GFGBZ0NZ.DEFAULT\EXTENSIONS\{AC0E33E8-84C0-45CC-B6D8-E3734B0987C8}
    C:\USERS\GAYLE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GFGBZ0NZ.DEFAULT\EXTENSIONS\{E2B33B4F-F5AE-4A89-88AE-7FCF6FD4E381}

    :Commands
    [resethosts]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done


Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
  • Go to control panel
  • Select folder options (Appearance > Folder options in category view)
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Click Yes to confirm.
  • Click OK.

SPRING CLEAN

To manually create a new Restore Point
  • Go to Control Panel and select System
  • Select System
  • On the left select System Protection and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create

Now we can purge the infected ones
  • GoStart > All programs > Accessories > system tools
  • Right click Disc cleanup and select run as administrator
  • Select Your main drive and accept the warning if you get one
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Posted Image
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe :wave:
  • 0

#7
Bellah

Bellah

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
lol I agree you are most likely too qualified for president.

I have completed all the clean up steps you mentioned and have Malwarebytes updated and ready to roll on a weekly basis.

I can't thank you enough for all your time and help. You are a god send!
  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
My pleasure, keep safe
  • 0

#9
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP