Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

May have Trojan or spyware, help appreciated! [Solved]


  • This topic is locked This topic is locked

#1
Mrscoffeecup

Mrscoffeecup

    Member

  • Member
  • PipPip
  • 20 posts
Hello,

A few days ago, I noticed that every internet page I went on had hyperlinks, and those links, when hovered on, displayed shopping spam.
I ran Spybot and AVG and it picked up tracking cookies and adware, and supposedly got rid of them.

This problem subsided, so I assumed my computer was fine, and I was watching a clip on youtube and suddenly, the screen went blank, and a whole page of numbers appeared for a moment before disappearing and the clip resumed.

Since then, my computer is slow, files have been moved, and my normal homepage, which is facebook on a secure site, doesn't redirect to the secure site, so I won't log in for now.

I have used P2P this past month,to download a few episodes of a tv show and I downloaded a movie for my kids too.

After some advice from a tech savvy friend, I downloaded and ran malwarebites which picked up the trojan and adware. It quarantined them and I deleted them, but the next morning, the were found on the scan again.
The same friend told me to use Combofix to clean it up, so I did that, and it had disastrous results, I couldn't even access the control panel as it was marked for deletion. I quickly did a system restore to earlier that day, and everything went back to normal, but obviously, the trojan is still there.

AVG tells me everytime I am using the internet that I am being tracked with cookies by yieldmanager.

I'm using Windows Vista on a Dell Inspiron 530, I am not sure what else to tell you, if I have forgotten anything, I apologize!

Many kind thanks in advance, I really hope someone can help!!!
Here is the logs from the OTL scan:


OTL logfile created on: 29/10/2012 8:58:54 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Paul\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.25 Gb Total Physical Memory | 1.84 Gb Available Physical Memory | 56.78% Memory free
6.68 Gb Paging File | 5.28 Gb Available in Paging File | 78.95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 89.66 Gb Free Space | 31.13% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.20 Gb Free Space | 41.95% Space Free | Partition Type: NTFS
Drive F: | 20.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SARAH | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/29 08:58:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
PRC - [2012/10/09 11:28:30 | 000,692,152 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/28 13:32:09 | 000,114,688 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe
PRC - [2012/09/18 09:27:39 | 001,193,176 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2012/08/23 11:31:24 | 001,532,280 | ---- | M] (AVG) -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
PRC - [2012/08/23 11:31:24 | 001,222,008 | ---- | M] (AVG) -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
PRC - [2012/08/13 04:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 04:37:02 | 002,596,984 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 04:23:08 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 04:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/03/19 06:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2012/02/14 05:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 05:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/04/01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe
PRC - [2011/02/22 08:17:32 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\System32\nlssrv32.exe
PRC - [2010/09/30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2010/08/26 18:48:00 | 000,285,152 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe
PRC - [2010/08/26 18:47:00 | 004,577,760 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WNA3100.exe
PRC - [2010/08/19 19:52:14 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2010/08/19 19:52:04 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe
PRC - [2009/04/11 17:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/01/17 08:22:20 | 004,907,008 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/12/05 07:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTSrv.exe
PRC - [2006/11/02 21:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/28 13:32:09 | 000,114,688 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe
MOD - [2012/09/18 09:27:39 | 001,193,176 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
MOD - [2010/09/10 11:03:10 | 000,159,744 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\SMSPlugin.dll
MOD - [2010/08/26 18:47:00 | 004,577,760 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WNA3100.exe
MOD - [2010/02/03 12:31:02 | 000,282,624 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WifiSvcLib.dll
MOD - [2009/11/26 11:55:34 | 000,552,960 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\atcomm.dll
MOD - [2009/11/26 11:55:34 | 000,151,552 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DetectDev.dll
MOD - [2009/11/26 11:55:34 | 000,135,168 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\LocaleMgrPlugin.dll
MOD - [2009/11/26 11:55:34 | 000,090,112 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\FileManager.dll
MOD - [2009/11/26 11:55:34 | 000,090,112 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DialUpPlugin.dll
MOD - [2009/11/26 11:55:34 | 000,061,440 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\XCodec.dll
MOD - [2009/11/26 11:55:34 | 000,061,440 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceOperate.dll
MOD - [2009/11/26 11:55:34 | 000,057,344 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\ConfigFilePlugin.dll
MOD - [2009/11/26 11:55:34 | 000,032,768 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NotifyServicePlugin.dll
MOD - [2009/11/26 11:55:34 | 000,014,848 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\isaputrace.dll
MOD - [2009/09/19 12:08:04 | 000,118,784 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NetInfoPlugin.dll
MOD - [2009/08/29 17:18:34 | 000,888,832 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NDISAPI.dll
MOD - [2009/07/31 12:26:22 | 000,172,032 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceMgrUIPlugin.dll
MOD - [2009/07/30 23:01:08 | 000,110,592 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceMgrPlugin.dll
MOD - [2002/07/04 10:38:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ArcSoft\Software Suite\PhotoImpression\Share\PIHook.dll


========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2012/10/09 12:28:25 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/23 11:31:24 | 001,532,280 | ---- | M] (AVG) [Auto | Running] -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012/08/13 04:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/02/14 05:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/04/01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc)
SRV - [2011/02/22 08:17:32 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\System32\nlssrv32.exe -- (nlsX86cc)
SRV - [2010/09/30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010/08/26 18:48:00 | 000,285,152 | ---- | M] () [Auto | Running] -- C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe -- (WSWNA3100)
SRV - [2010/08/19 19:52:04 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2008/01/19 18:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/05 07:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2007/05/31 12:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 12:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006/11/02 21:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\massfilter.sys -- (massfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | Auto | Stopped] -- -- (adfs)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/24 16:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/07/26 04:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/07/04 15:26:12 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2012/04/19 05:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/01/31 05:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/12/23 14:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 14:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 14:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 14:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011/10/01 08:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 08:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 08:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 08:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/08/02 17:38:44 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010/08/27 14:53:46 | 000,116,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010/08/07 18:48:42 | 000,106,880 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010/07/27 16:25:48 | 000,072,832 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV - [2010/07/27 10:52:02 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2010/07/16 11:04:16 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2010/06/21 16:07:20 | 000,078,720 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swiwdmbus.sys -- (swiwdmbus)
DRV - [2010/06/21 15:47:14 | 000,156,544 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swumxa3.sys -- (SWUMXA3)
DRV - [2010/06/21 15:46:50 | 000,201,088 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swnc8ua3.sys -- (SWNC8UA3)
DRV - [2010/02/03 12:21:56 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2009/11/06 09:37:20 | 000,699,896 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcmwlhigh6.sys -- (BCMH43XX)
DRV - [2009/05/25 17:01:00 | 000,069,098 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\jl2005c.sys -- (JL2005C)
DRV - [2007/09/17 09:07:00 | 007,624,192 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/04/29 19:42:24 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2007/03/23 21:29:32 | 000,060,768 | ---- | M] (2Wire, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\2WirePCP.sys -- (2WIREPCP)
DRV - [2007/01/19 19:20:54 | 000,021,728 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SCMNdisP.sys -- (SCMNdisP)
DRV - [2006/11/02 18:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/10/19 05:08:18 | 000,258,048 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/05 11:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/07/24 17:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005/02/23 15:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2003/09/20 09:45:48 | 000,021,248 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pfc.sys -- (pfc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...ie7&rlz=1I7DAAU

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au.yahoo.com/?fr=fp-yie8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: CFBFAE00-17A6-11D0-99CB-00C04FD64497} - No CLSID value found
IE - HKCU\..\URLSearchHook: EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:466...q={searchTerms}
IE - HKCU\..\SearchScopes\{7BF39D85-F6C0-4D55-AA9E-354D98E05232}: "URL" = http://au.search.yah...f-8&fr=chr-yie8
IE - HKCU\..\SearchScopes\{8E02D41C-5924-4816-9490-33CCD28BEB72}: "URL" = http://search.avg.co...}&ychte=au&nt=1
IE - HKCU\..\SearchScopes\{D4395A68-EC0A-4AB4-A6BC-355E67975B7D}: "URL" = http://www.flickr.co...q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@csi.business.gov.au/CsiPlugin: C:\Program Files\Common-Use Signing Interface\bin\npCsiPlugin.dll (Commonwealth Government of Australia)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 09:12:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/03 10:53:19 | 000,000,000 | ---D | M]

[2010/10/03 00:33:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions
[2010/10/03 00:33:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions\IMVUClientXUL@imvu.com
[2009/02/21 12:16:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org

O1 HOSTS File: ([2011/03/06 21:09:59 | 000,269,186 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 9316 more lines...
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Mobile Partner] C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe ()
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: modthesims.info ([www] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{240A7F65-CAC9-408C-9A3F-95FD2AEC47CE}: DhcpNameServer = 10.4.85.135 10.4.176.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36DECCF4-4B5C-481A-93A7-6A5B2DF65257}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38DE3DDE-AE25-46E9-92EA-BA55DDCE6BFA}: DhcpNameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A973CA7-C2C5-4870-B413-727AF81EA57D}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{65EDAF65-0BB3-43CC-AE3C-0CE14CD8B58C}: DhcpNameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92F8F3AC-362C-4FC5-8459-FA7C4D26009A}: NameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E0C30011-0E0B-491A-A1D7-E91CF8B7640C}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBBAE300-C89E-45AB-A9CF-28E61D33B73D}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\PROGRA~1\GOOGLE\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 08:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/08/20 03:49:08 | 000,126,976 | R--- | M] () - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2010/09/14 22:01:18 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{000a467a-bbc4-11e0-8db6-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{000a467a-bbc4-11e0-8db6-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce5725e-0913-11e2-8a31-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce5725e-0913-11e2-8a31-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce5726c-0913-11e2-8a31-001e101f9843}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce5726c-0913-11e2-8a31-001e101f9843}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce57276-0913-11e2-8a31-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce57276-0913-11e2-8a31-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce57281-0913-11e2-8a31-001e101f82a0}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce57281-0913-11e2-8a31-001e101f82a0}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{327b734b-421b-11e0-a32a-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{327b734b-421b-11e0-a32a-001d098ac077}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{37181591-b80f-11e0-aed9-001e101f0c85}\Shell - "" = AutoRun
O33 - MountPoints2\{37181591-b80f-11e0-aed9-001e101f0c85}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{3b9bb92e-55c6-11e1-b225-c43dc7c28a47}\Shell - "" = AutoRun
O33 - MountPoints2\{3b9bb92e-55c6-11e1-b225-c43dc7c28a47}\Shell\AutoRun\command - "" = G:\KaiserBaas.exe
O33 - MountPoints2\{812811eb-0923-11e2-a81c-001e101f3315}\Shell - "" = AutoRun
O33 - MountPoints2\{812811eb-0923-11e2-a81c-001e101f3315}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{b7de6e74-b18c-11e0-91ae-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{b7de6e74-b18c-11e0-91ae-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{b7de6e79-b18c-11e0-91ae-001e101fd417}\Shell - "" = AutoRun
O33 - MountPoints2\{b7de6e79-b18c-11e0-91ae-001e101fd417}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{df8fde42-bb45-11dd-b863-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{df8fde42-bb45-11dd-b863-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{df8fde66-bb45-11dd-b863-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{df8fde66-bb45-11dd-b863-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{e5d48ee9-b963-11e0-b278-001e101fee60}\Shell - "" = AutoRun
O33 - MountPoints2\{e5d48ee9-b963-11e0-b278-001e101fee60}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{f6f891d4-b58d-11e0-b79e-001e101f1f81}\Shell - "" = AutoRun
O33 - MountPoints2\{f6f891d4-b58d-11e0-b79e-001e101f1f81}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{faba72c6-aa0b-11dd-a074-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{faba72c6-aa0b-11dd-a074-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{faba7306-aa0b-11dd-a074-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{faba7306-aa0b-11dd-a074-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/10/29 08:58:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
[2012/10/28 22:00:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/28 22:00:19 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/10/28 21:12:03 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\Temp(72)
[2012/10/28 21:12:03 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/10/28 20:42:01 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\SUPERAntiSpyware.com
[2012/10/28 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/10/28 20:41:29 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012/10/28 18:39:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/10/28 13:15:28 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Malwarebytes
[2012/10/28 13:15:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/10/28 13:15:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/28 11:31:11 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\AVG
[2012/10/28 11:29:56 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG
[2012/10/28 11:29:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2012/10/22 10:21:51 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{1300AB69-50A9-4A64-846D-B3FFAEDC45BE}
[2012/10/20 08:54:49 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{86974068-D347-4947-9155-BC9E9B9CC64B}
[2012/10/19 09:03:44 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Nico Mak Computing
[2012/10/19 09:03:41 | 000,017,224 | ---- | C] (WinZip Computing, S.L.(WinZip Computing)) -- C:\Windows\System32\roboot.exe
[2012/10/19 09:03:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip Registry Optimizer
[2012/10/19 09:03:18 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2012/10/19 09:02:06 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\uTorrent
[2012/10/18 18:58:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\wxDownload Fast
[2012/10/18 18:57:22 | 000,000,000 | ---D | C] -- C:\ProgramData\wxDownload
[2012/10/18 18:55:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012/10/18 18:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2012/10/17 14:10:02 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{D14BAD02-FBF0-49C4-B382-3FD951F784D0}
[2012/10/15 16:00:44 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{DD19C2CF-A542-4DB6-9990-E9944B217548}
[2012/10/13 20:53:04 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{7D433DC4-590E-4487-AE94-1D28CB6538AE}
[2012/10/08 22:32:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/10/08 22:30:35 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/10/08 22:30:34 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/10/08 22:30:34 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/10/04 20:35:31 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{189C5C47-DA35-481E-A761-DB662A8B6A9F}
[2012/10/02 17:32:30 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{C81405DC-5F56-48FC-8D7F-8A00F0AB8088}
[2011/03/10 10:25:56 | 001,228,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Paul\Photoshop_12_LS1.exe
[2008/03/11 14:26:55 | 000,092,064 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmmdm.sys
[2008/03/11 14:26:55 | 000,079,328 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmserd.sys
[2008/03/11 14:26:55 | 000,066,656 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmbus.sys
[2008/03/11 14:26:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Users\Paul\usbsermptxp.sys
[2008/03/11 14:26:55 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Users\Paul\usbsermpt.sys
[2008/03/11 14:26:55 | 000,009,232 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmmdfl.sys
[2008/03/11 14:26:55 | 000,006,208 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmcmnt.sys
[2008/03/11 14:26:55 | 000,005,936 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmwhnt.sys
[2008/03/11 14:26:55 | 000,004,048 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmcr.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/10/29 08:58:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
[2012/10/29 08:53:42 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2012/10/29 08:53:40 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/29 08:53:40 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/29 08:53:40 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/29 08:53:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/29 07:55:12 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/10/29 07:49:41 | 000,000,076 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\mbam.context.scan
[2012/10/29 07:46:54 | 000,001,828 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\wklnhst.dat
[2012/10/29 07:37:28 | 098,826,963 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012/10/29 07:36:35 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/28 23:28:18 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/28 22:00:21 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 08:35:10 | 000,041,472 | ---- | M] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/10/20 18:10:14 | 000,454,298 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/10/20 07:58:07 | 000,646,002 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/10/20 07:58:07 | 000,123,514 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/10/19 09:03:21 | 000,000,714 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/10/11 17:19:54 | 000,001,626 | ---- | M] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/10/09 11:13:36 | 000,001,626 | ---- | M] () -- C:\Users\Paul\Desktop\iTunes (2).lnk
[2012/10/08 22:32:14 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/10/07 19:00:50 | 000,001,846 | ---- | M] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\SpongeBob SquarePants Snapshots.lnk
[2012/10/04 10:00:06 | 000,000,554 | ---- | M] () -- C:\Users\Paul\Desktop\Mozilla Firefox.zip
[2012/09/30 20:02:07 | 000,000,240 | ---- | M] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/10/29 07:49:41 | 000,000,076 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\mbam.context.scan
[2012/10/28 22:00:21 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/19 09:03:21 | 000,000,714 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/10/11 17:19:54 | 000,001,626 | ---- | C] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/10/09 11:13:36 | 000,001,626 | ---- | C] () -- C:\Users\Paul\Desktop\iTunes (2).lnk
[2012/10/08 22:32:14 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/10/07 19:00:50 | 000,001,846 | ---- | C] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\SpongeBob SquarePants Snapshots.lnk
[2012/10/04 10:00:06 | 000,000,554 | ---- | C] () -- C:\Users\Paul\Desktop\Mozilla Firefox.zip
[2012/09/30 20:02:07 | 000,000,240 | ---- | C] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/06/07 21:21:01 | 000,002,554 | ---- | C] () -- C:\Windows\WAVEMIX.INI
[2011/09/10 11:40:50 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2011/08/10 01:02:09 | 000,024,441 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\UserTile.png
[2011/07/26 18:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011/07/26 18:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 18:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 18:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011/07/15 23:38:23 | 000,000,025 | ---- | C] () -- C:\Windows\CDESP1410E.ini
[2011/06/29 20:52:44 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/06/28 19:25:17 | 000,154,004 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/03/30 09:17:10 | 000,316,928 | ---- | C] () -- C:\Windows\System32\HDREfexProFC32.dll
[2011/03/11 11:44:17 | 020,938,448 | -H-- | C] () -- C:\Users\Paul\PhotoshopElements_9_LS15.7z.part
[2011/03/11 11:44:16 | 000,000,044 | ---- | C] () -- C:\Users\Paul\PhotoshopElements_9_LS15.exe
[2011/03/10 10:25:57 | 1026,293,791 | ---- | C] () -- C:\Users\Paul\Photoshop_12_LS1.7z
[2011/02/22 08:17:34 | 000,316,928 | ---- | C] () -- C:\Windows\System32\SilverEfexPro2FC32.dll
[2009/09/01 20:40:39 | 000,003,970 | ---- | C] () -- C:\Users\Paul\.recently-used.xbel
[2008/07/29 18:35:18 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008/07/11 15:17:28 | 000,000,680 | ---- | C] () -- C:\Users\Paul\AppData\Local\d3d9caps.dat
[2008/07/08 18:55:13 | 000,001,828 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\wklnhst.dat
[2008/03/18 17:45:49 | 000,001,260 | ---- | C] () -- C:\ProgramData\dldf
[2008/03/11 14:26:55 | 000,009,913 | ---- | C] () -- C:\Users\Paul\MCCI_MDM.INF
[2008/03/11 14:26:55 | 000,009,232 | ---- | C] () -- C:\Users\Paul\USB_MOT_BRIT.INF
[2008/03/11 14:26:55 | 000,007,201 | ---- | C] () -- C:\Users\Paul\USBMOT2000.INF
[2008/03/11 14:26:55 | 000,006,989 | ---- | C] () -- C:\Users\Paul\MCCI_BUS.INF
[2008/03/11 14:26:55 | 000,006,209 | ---- | C] () -- C:\Users\Paul\USBMOT2000XP.INF
[2008/03/11 14:26:55 | 000,005,880 | ---- | C] () -- C:\Users\Paul\USB_CMCS_2000.INF
[2008/03/11 14:26:55 | 000,005,813 | ---- | C] () -- C:\Users\Paul\USB_MOT_A1000.INF
[2008/03/11 14:26:55 | 000,004,477 | ---- | C] () -- C:\Users\Paul\MCCI_SDM.INF
[2008/01/15 19:26:59 | 000,041,472 | ---- | C] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 23:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 04:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 17:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 17:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2008/07/01 13:40:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\948 Series
[2011/06/29 13:58:45 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Alien Skin
[2012/10/28 11:31:11 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\AVG
[2012/01/21 07:53:05 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\AVG2012
[2011/03/13 11:07:20 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Canon
[2011/04/04 20:58:13 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/06 22:59:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2010/04/20 16:11:52 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/16 00:02:14 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\EPSON
[2009/09/01 20:40:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\gtk-2.0
[2011/07/19 14:58:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\HDREfexPro
[2012/05/08 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\HDRsoft
[2012/10/19 09:10:37 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nico Mak Computing
[2011/07/19 15:23:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nik Software
[2008/04/28 16:10:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nokia
[2012/04/19 09:49:19 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Origin
[2012/01/07 14:14:30 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Panasonic
[2008/04/21 18:36:55 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PC Suite
[2011/08/10 01:02:09 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PeerNetworking
[2011/03/02 13:06:48 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PhotoScape
[2010/04/18 14:59:21 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Publish Providers
[2011/08/10 01:37:37 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Samsung
[2011/02/27 13:49:12 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sierra Wireless
[2011/07/19 15:01:58 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\SilverEfexPro2
[2012/01/07 14:25:02 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\SoftGrid Client
[2010/04/18 16:02:41 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony
[2012/10/16 22:33:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Spotify
[2011/03/23 10:12:05 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2008/07/08 18:55:15 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Template
[2011/05/18 10:31:53 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TP
[2012/10/26 21:19:57 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\uTorrent
[2011/02/28 13:37:54 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Visan
[2010/10/03 00:49:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vivox
[2011/08/10 01:05:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



< End of report >
  • 0

Advertisements


#2
godawgs

godawgs

    Teacher

  • Retired Staff
  • 8,228 posts
Hello Mscoffeecup, :wave: Welcome to the forums!
:welcome:. My name is godawgs and I will be assisting you with your Virus / Malware issues.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic to find out how to do that.

Please do not run any tools unless instructed to do so.
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • If I ask a Question just answer it, don't run anything unless directed to.
Please read every post completely before doing anything.
  • Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
  • Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.
Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.
  • I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes :lol: )
  • Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.


I have used P2P this past month,to download a few episodes of a tv show and I downloaded a movie for my kids too.

Your first mistake. :)

The same friend told me to use Combofix to clean it up, so I did that, and it had disastrous results, I couldn't even access the control panel as it was marked for deletion. I quickly did a system restore to earlier that day, and everything went back to normal, but obviously, the trojan is still there.

This could have been your first catastrophic mistake. Thankfully you restored the system. ComboFix does sometime mark file for deletion on reboot but I've never seen it mark the Control Panel. ComboFix is a very powerful tool and can easily turn your computer into a brick if used improperly. Don't let anyone other than a trained/qualified malware removal helper advise you to use ComboFix. And I don't think what we have here will require ComboFix, unless something that I don't see comes up. :thumbsup:

When OTL runs the first time it creates two files, OTL.txt and Extras.txt. They would have been created on the desktop. Please post the contents of the Extras.txt file in your next reply.


Step-1.

Run aswMBR
  • Download aswMBR.exe to your desktop.
  • (Windows /7 users: Right click the file and click Run as Administrator. If you get a UAC window, allow the file to run.
  • If it asks you if you want to download the latest virus definitions, click Yes
  • Click the "Scan" button to start the scan
    Posted Image
  • On completion of the scan click save log. Save it to your desktop and post in your next reply.
    Posted Image
NOTE: When you run aswMBR, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename executable to iexplore.exe and try it again.


Step-3.

Things For Your Next Post:
1. The Extras.txt
2. The aswMBR.txt log
  • 0

#3
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Hi, thanks so much for getting back to me so fast!!!

Here are the logs as requested, with the extras log being first:


OTL Extras logfile created on: 29/10/2012 8:58:54 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Paul\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.25 Gb Total Physical Memory | 1.84 Gb Available Physical Memory | 56.78% Memory free
6.68 Gb Paging File | 5.28 Gb Available in Paging File | 78.95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 89.66 Gb Free Space | 31.13% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.20 Gb Free Space | 41.95% Space Free | Partition Type: NTFS
Drive F: | 20.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SARAH | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenAsAWebSite] -- C:\Program Files\Microsoft WebMatrix\WebMatrix.exe #ExecuteCommand# SiteFromFolder %L (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3766550063-913140356-267790273-1000]
"EnableNotifications" = 1
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DisableUnicastResponsesToMulticastBroadcast" = 0
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Telstra\Mobile Broadband Manager\SwiApiMuxX.exe" = C:\Program Files\Telstra\Mobile Broadband Manager\SwiApiMuxX.exe:*:Enabled:SwiApiMuxX


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0FD7B796-17A1-4AE1-8A06-02BEAE587E9E}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{16EED2D6-4ADA-4823-B51F-881CF6BC81B5}" = rport=445 | protocol=6 | dir=out | app=system |
"{19720D6A-09CD-484D-BEAB-FC07388DA96F}" = lport=137 | protocol=17 | dir=in | app=system |
"{2003C58E-1056-455A-BD8A-5A5A20614D75}" = rport=138 | protocol=17 | dir=out | app=system |
"{25B89645-445C-411A-8E24-052DEDDAE5EE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{25F605A5-789D-470A-97E5-0399B4920195}" = lport=139 | protocol=6 | dir=in | app=system |
"{5E1467FC-A383-4AAB-A87F-5B2A652BCC80}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{77D9F5B9-5B4F-45C5-9EF6-F64D66F94F32}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{87FA5C77-0520-4BC6-BFA4-ABC49CE0E910}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{931BD371-95BE-4DCF-8451-10066D6A23FA}" = rport=139 | protocol=6 | dir=out | app=system |
"{A76AD96E-9F86-4E8C-9479-829B8B8A3CDF}" = rport=137 | protocol=17 | dir=out | app=system |
"{AB695885-356F-4B49-A28E-8367DD5FC94F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{AD0C5299-1E80-4F82-AD8A-2E86066BDC8A}" = lport=138 | protocol=17 | dir=in | app=system |
"{DD97C567-68F7-43B5-AA3D-3BE95693A53B}" = lport=445 | protocol=6 | dir=in | app=system |
"{F01E07E2-42C6-47C5-84EB-403FBA78CB30}" = lport=49161 | protocol=6 | dir=in | name=akamai netsession interface |
"{F3C53F63-8E5B-444E-BB6E-0AE2C99A63EB}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0578B1B2-9715-4C95-BFE4-EAC7F746BB1C}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{0BC3080A-BF57-4C4F-BDB9-D1EF6835F48C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{1ADBA6AE-BCA0-44EE-A57E-21B0F8EC1D75}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{1B59154B-C44C-4B52-9A76-793C510689B0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{1FBB700E-69B4-44E0-9183-8D2EAA9909C9}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{2141921A-9B33-44B1-9874-AC5D856DBD37}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{220060D2-7EF7-4AB4-A6F3-4E7A61F5C653}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{2248AA6A-5E78-40F2-8D4E-3F68B0AACDB4}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{258C5B36-13F5-4099-A5E6-F68DE4BACAB6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2B4EE311-C66F-45DD-8C87-5225B0CA4A34}" = protocol=6 | dir=in | app=c:\program files\dell aio printer 948\memcard.exe |
"{2B515EA3-517B-42E0-A0AD-9008E98FC800}" = protocol=6 | dir=in | app=c:\program files\dell aio printer 948\dldfaiox.exe |
"{2F8FF00E-39DF-4F68-BABF-B6D2A1B4340C}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{32CE2CA8-48C1-4299-A4FB-4A6D570929C7}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{35F5EE3E-2652-40A7-9BD2-475A3B6231DE}" = protocol=17 | dir=in | app=c:\windows\system32\dldfcoms.exe |
"{397354B6-BB49-4347-9AE4-94C7A10F60FC}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{3D7091DF-997E-4983-9BBB-2C48885C71A5}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"{3DF4BD9E-5649-4D9B-930E-13165379A3AF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{3E69FC61-BE41-4695-BFE6-31E056565114}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 1050 j410 series\bin\usbsetup.exe |
"{3F33F46C-624F-4507-AFD6-28C941A9664B}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{43099DC9-CE0D-4BD1-9CA0-12B7B3392D78}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{460F9996-55C8-47F1-AE4C-95221834141A}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{4AB694AC-EA6E-49F1-BE28-2CF9454862DE}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{4DDCD92E-6CA9-4165-822B-5C44EC449F45}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{52F122DD-3385-4145-9539-347DD81CD913}" = protocol=17 | dir=in | app=c:\program files\dell aio printer 948\dldfaiox.exe |
"{598BED7D-6E02-47D8-BC53-DD9EBCED85D3}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{5AF6D82B-DAB1-4A81-BC6C-4AA83B0D4576}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{5C0AEC83-A458-4036-A861-80173C269591}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{67858C99-8DE5-4416-B04C-3139BD6996E9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{67F97C97-B1C7-4A52-9FA5-B0143AACF31E}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{691889C5-4C55-446E-AC8E-CCE2D524FEFD}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{69E6076F-2A05-46B0-ACBA-2486BD35CB0E}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{6FCDAC11-BAD6-45D6-9343-89609FD46238}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7848D87D-C909-436C-8631-0AD2642AD11B}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{82663D2D-F1E4-4D61-AB3C-4EFD52B4EBB2}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{84B17ED7-AEAA-4F84-A191-1019738C33AA}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{873D8F53-F40B-4B6C-9666-BA795BD58D1C}" = protocol=17 | dir=in | app=c:\program files\dell aio printer 948\memcard.exe |
"{8A458F68-3F68-4763-87EC-5539E7A6EC67}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{8ECF4961-4C87-482B-B293-5EC5334EA517}" = protocol=6 | dir=in | app=c:\program files\dell aio printer 948\dldfmon.exe |
"{8F6EF7F9-A969-4537-93EF-714FF873E776}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{951AE37F-DC6C-4C25-8EC3-8F81D97BA57C}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{978D0531-503C-4E4F-B3E8-554E945D59C9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9C320AC1-6BDD-4C61-A4DD-1CA32D9D953C}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"{A6147BDA-919B-44C4-8F69-08978B47A802}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{AC15A36F-509F-4B62-A1D0-D0EA93BA1AD4}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{AC9EEC60-E400-407E-84B4-A3AF46F6E6EA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BD2C0AF3-5E03-4970-BF81-72259F27DDBA}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{C0D5BA44-AD74-4772-BE83-BC72E298FAE8}" = protocol=17 | dir=in | app=c:\program files\dell aio printer 948\dldfmon.exe |
"{C1C78863-9047-46F4-B326-4B32B4502B74}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{C419F775-A460-4D2E-A27D-86535AD04933}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{C6BC2659-3D8E-41E8-A2BE-BD0226018D98}" = protocol=6 | dir=in | app=c:\windows\system32\dldfcoms.exe |
"{D8339FE5-77E2-4845-92BA-288458BC5975}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{EEF8FB5C-AA6A-4979-8297-508341B2421C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{F1CA04F8-D28F-46B1-A69A-0F36DDCDEA3B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F9245E8E-76E9-4341-844A-2D3F773782AD}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 1050 j410 series\bin\usbsetup.exe |
"TCP Query User{061409DA-0ECB-400C-AD4C-1DD70B26EDEE}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{60EB2875-2DC3-4D6E-B71E-3541C8153FC0}C:\users\paul\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\paul\appdata\roaming\spotify\spotify.exe |
"TCP Query User{63B0BD6B-0629-46D1-BA69-F5B4DE5950AD}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{9981EF14-4C79-4D7F-8A7B-11417B27BC2C}C:\users\paul\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\paul\appdata\roaming\spotify\spotify.exe |
"TCP Query User{A0324B82-7108-42B9-B5D7-E7807CF2580C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{CDAB6DBD-4CB0-4616-89A3-C6F03C9F1509}C:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe" = protocol=6 | dir=in | app=c:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe |
"UDP Query User{13048E4E-C910-4850-9D55-907C029F9E17}C:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe" = protocol=17 | dir=in | app=c:\program files\common files\roxio shared\9.0\sharedcom\roxwatchtray9.exe |
"UDP Query User{507B778A-5475-4818-91DA-303B5FC24332}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{78392D9C-77C8-4B4C-90E6-9558616F237C}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{8E9763F0-8650-45C5-B474-17C672B2D37C}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{AE2AB637-144F-4BF5-B634-39A05A300759}C:\users\paul\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\paul\appdata\roaming\spotify\spotify.exe |
"UDP Query User{EC0BCA17-D48A-496B-94C8-762B0BF93EF6}C:\users\paul\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\paul\appdata\roaming\spotify\spotify.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{007F778D-F15C-4EAB-AE92-071D21FAF632}" = Adobe Photoshop Elements 9
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = The Sims 2 University
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08A25478-C5DD-4EA7-B168-3D687CA987FF}" = The Sims™ 3 Master Suite Stuff
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{117B6BF6-82C3-420C-B284-9247C8568E53}" = The Sims™ 3 Outdoor Living Stuff
"{185292F7-7C0A-4F72-B2CC-CBEBD40B050E}" = Microsoft SQL Server 2008 R2 Native Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22025051-1991-48EB-8BE8-7A3329DAE7ED}" = IIS 7.5 Express
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2EB81825-E9EE-44F4-8F51-1240C3898DC6}" = EPSON File Manager
"{2F141715-E144-48C0-8562-D193B7AB85BC}" = Microsoft SQL Server Compact 4.0 ENU
"{33286280-8617-11E1-8FF6-B8AC6F97B88E}" = Google Earth Plug-in
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{38580E5E-AF78-4536-AD1E-6A62661372C5}" = AVG 2012
"{3BBFD444-5FAB-49F6-98B1-A1954E831399}" = The Sims™ 3 Showtime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40C03514-89C3-41BA-0090-3B440256DB87}" = The Sims 2
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = The Sims™ 3 Late Night
"{4817189D-1785-4627-A33C-39FD90919300}" = The Sims 2 Pets
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5134B35A-B559-4762-94A4-FD4918977953}" = Microsoft Web Deploy 2.0
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5C648FDB-0138-4619-B66E-230EF53E8E2C}" = The Sims™ 2 Teen Style Stuff
"{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}" = HP Deskjet 1050 J410 series Help
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5FD88490-011C-4DF1-B886-F298D955171B}" = MySQL Connector Net 6.3.7
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = The Sims™ 2 Kitchen & Bath Interior Design Stuff
"{66F0E678-69C2-4C46-BA95-117DF28C87E4}" = Microsoft WebMatrix
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = The Sims 2 Family Fun Stuff
"{6BE73D27-5ADC-4AD9-B619-8F5188AFCF9F}" = HP Deskjet 1050 J410 series Product Improvement Study
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6E17F9751-F056-4335-B718-8AF1B1092AFB}" = The Sims™ 2 IKEA® Home Stuff
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Sims™ 3 High-End Loft Stuff
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B11296A-F894-449C-8DF6-6AAAA7D4D118}" = The Sims™ 3 Town Life Stuff
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = The Sims 2 Open For Business
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83F2B8F4-5CF3-4BE9-9772-9543EAE4AC5F}" = Microsoft SQL Server 2008 R2 Management Objects
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = The Sims™ 2 H&M® Fashion Stuff
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = The Sims™ 2 FreeTime
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}" = Camera RAW Plug-In for EPSON Creativity Suite
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims™ 3 Ambitions
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = The Sims 2 Glamour Life Stuff
"{9E397B40-13F7-4CA2-9943-ADB29ACBBFDF}" = ArcSoft Software Suite
"{A0627FA2-861A-4670-AF7D-45F5FC06091A}" = DLDF_AIOC
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A2570BB8-D996-4592-B172-57F6560419EF}" = DLDF_MCM
"{A51500FE-6408-4305-B071-B961F691A4CE}" = Microsoft SQL Server Compact 4.0 Web Tools ENU
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.2
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B0F1B02F-47A6-411D-A38B-E44CC7F53CCC}" = e-tax 2012
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}" = EPSON Easy Photo Print
"{B69C390B-826F-473C-86EB-7AD4950818C3}" = AVG 2012
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = The Sims™ 2 Apartment Life
"{B777C2B9-436C-422D-A4A3-FEB6F62D3B82}" = DLDF_Wireless
"{B83ABA9F-134F-4D81-9727-690B810A0EE4}" = DLDF_Pubs
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = The Sims™ 3 World Adventures
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C12631C6-804D-4B32-B0DD-8A496462F106}" = The Sims™ 3 Pets
"{C2425F91-1F7B-4037-9A05-9F290184798D}" = NETGEAR WNA3100 wireless USB 2.0 adapter
"{C3F6F200-6D7B-4879-B9EE-700C0CE1FCDA}" = Microsoft SQL Server System CLR Types
"{C46640C0-93FE-4CD7-8B5E-EB0E92C4C2C9}" = Adobe Photoshop Lightroom 3.4.1
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CC4878C0-4A6A-49CD-AAA7-DD3FCB06CC84}" = Microsoft Web Platform Installer 3.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}" = AVG PC TuneUp
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DF1EB473-1D28-426C-99DE-26614F56CDC3}" = DLDF_Fax4
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = The Sims™ 2 Seasons
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1845F1C-068C-F8F4-D31D-D3540D47C453}" = Adobe Download Assistant
"{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}" = Elements STI Installer
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = The Sims™ 3 Generations
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{EAA38532-7AD0-4f78-918A-4F4F02096ECE}" = The Sims™ 2 Celebration! Stuff
"{ECB35FFA-B010-45C5-9AB5-665AC7E27EE2}" = HP Deskjet 1050 J410 series Basic Device Software
"{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = The Sims™ 3 Fast Lane Stuff
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = The Sims™ 2 Bon Voyage
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = The Sims 2 Nightlife
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FB03A941-815E-42F2-B604-FCE5636DB90B}" = AVG PC TuneUp Language Pack (en-US)
"{FB3BE405-6BF0-490A-84B3-00611385EA0D}" = Common-Use Signing Interface
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}" = EPSON Print CD
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D" = Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 9" = Adobe Photoshop Elements 9
"AVG" = AVG 2012
"AVG PC TuneUp" = AVG PC TuneUp
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"Color Efex Pro 3.0 Complete" = Color Efex Pro 3.0 Complete
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Common-Use Signing Interface" = Common-Use Signing Interface
"DPP" = Canon Utilities Digital Photo Professional 3.8
"Drug Lord 2" = Drug Lord 2
"EOS Utility" = Canon Utilities EOS Utility
"EPSON Printer and Utilities" = EPSON Printer Software
"ESP1400_1410 User's Guide" = ESP1400_1410 User's Guide
"Google Desktop" = Google Desktop
"HDR Efex Pro" = HDR Efex Pro
"HP Photo Creations" = HP Photo Creations
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Optus Mobile Broadband" = Optus Mobile Broadband
"Origin" = Origin
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotomatixPro42x32_is1" = Photomatix Pro version 4.2
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"Silver Efex Pro 2" = Silver Efex Pro 2
"SpongeBob SquarePants Snapshots" = SpongeBob SquarePants Snapshots
"uTorrent" = µTorrent
"WFTK" = Canon Utilities WFT Utility
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec
"Spotify" = Spotify

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 28/10/2012 4:54:01 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x168c, application
start time 0x01cdb54e5b9d3407.

Error - 28/10/2012 4:54:01 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x1564, application
start time 0x01cdb54e5bebc167.

Error - 28/10/2012 4:54:02 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x1714, application
start time 0x01cdb54e5c3a4ec7.

Error - 28/10/2012 4:54:02 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0xb78, application
start time 0x01cdb54e5c88dc27.

Error - 28/10/2012 4:54:03 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x1524, application
start time 0x01cdb54e5cd76987.

Error - 28/10/2012 4:54:04 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x1208, application
start time 0x01cdb54e5d25f6e7.

Error - 28/10/2012 4:54:04 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0xd04, application
start time 0x01cdb54e5d748447.

Error - 28/10/2012 4:54:05 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x119c, application
start time 0x01cdb54e5dc311a7.

Error - 28/10/2012 4:54:05 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0xb14, application
start time 0x01cdb54e5e0f3da7.

Error - 28/10/2012 4:54:06 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x105c, application
start time 0x01cdb54e5e864267.

Error - 28/10/2012 4:54:07 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application TUMessages.exe, version 12.0.4000.108, time stamp
0x5035f84a, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc0000135, fault offset 0x00009f5d, process id 0x12c4, application
start time 0x01cdb54e5f235d27.

Error - 28/10/2012 6:00:57 PM | Computer Name = Sarah | Source = Application Error | ID = 1000
Description = Faulting application OneClickStarter.exe, version 12.0.4000.108, time
stamp 0x5035f828, faulting module rtl120.bpl, version 6.0.6002.18541, time stamp
0x4ec3e3d5, exception code 0xc0000135, fault offset 0x00009f5d, process id 0x16e4,
application start time 0x01cdb557b3e749d0.

[ System Events ]
Error - 28/10/2012 5:54:06 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description =

Error - 28/10/2012 5:58:28 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7034
Description =

Error - 28/10/2012 5:58:43 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7034
Description =

Error - 28/10/2012 6:01:51 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7030
Description =

Error - 28/10/2012 6:07:49 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7030
Description =

Error - 28/10/2012 6:10:28 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7030
Description =

Error - 28/10/2012 6:36:29 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description =

Error - 28/10/2012 7:36:20 AM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description =

Error - 28/10/2012 4:29:15 PM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description =

Error - 28/10/2012 5:55:17 PM | Computer Name = Sarah | Source = Service Control Manager | ID = 7000
Description =


< End of report >



Next Log:



aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-10-29 12:47:57
-----------------------------
12:47:57.684 OS Version: Windows 6.0.6002 Service Pack 2
12:47:57.684 Number of processors: 4 586 0xF0B
12:47:57.684 ComputerName: SARAH UserName: Paul
12:47:59.088 Initialize success
12:48:16.677 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:48:16.693 Disk 0 Vendor: ST3320620AS 3.ADG Size: 305245MB BusType: 3
12:48:16.709 Disk 0 MBR read successfully
12:48:16.709 Disk 0 MBR scan
12:48:16.709 Disk 0 Windows VISTA default MBR code
12:48:16.724 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 47 MB offset 63
12:48:16.771 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 98304
12:48:16.787 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 294956 MB offset 21069824
12:48:16.802 Disk 0 scanning sectors +625139712
12:48:16.865 Disk 0 scanning C:\Windows\system32\drivers
12:48:23.807 Service scanning
12:48:36.521 Modules scanning
12:48:40.857 Disk 0 trace - called modules:
12:48:40.873 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
12:48:41.372 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85c8fac8]
12:48:41.372 3 CLASSPNP.SYS[8b1a58b3] -> nt!IofCallDriver -> [0x85977918]
12:48:41.372 5 acpi.sys[8068e6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84f59558]
12:48:41.372 Scan finished successfully
12:48:52.979 Disk 0 MBR has been saved successfully to "C:\Users\Paul\Desktop\MBR.dat"
12:48:52.979 The log file has been saved successfully to "C:\Users\Paul\Desktop\aswMBR.txt"


Loooking forward to hearing from you soon, and once again, thank you so much!!!
  • 0

#4
godawgs

godawgs

    Teacher

  • Retired Staff
  • 8,228 posts
Hello,

Loooking forward to hearing from you soon, and once again, thank you so much!!!

you are welcome :)

You have the following Peer-to-Peer program(s) installed:

uTorrent

GeeksToGo does not recommend using such programs, but you should read the description of Peer-to-Peer programs below before deciding for yourself.

Description of Peer-to-Peer (P2P) software.
P2P(Peer-to-Peer) may be a great way to get lots of seemingly freeware, but it is a great way to get infected as well. The program(s) may be safe, but there's no way to tell if the file being shared is infected. P2P programs, more often than not, install adware and/or spyware and worse still, some worms spread via P2P networks, infecting you as well.
Once upon a time, P2P file sharing was fairly safe. This is no longer true. P2P programs form a direct conduit inside your computer, their security measures are easily circumvented, and malware writers are increasingly exploiting them to spread their wares on to your computer. If your P2P program is not configured correctly, your computer may also be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

If you need convincing, please read these short reports on the dangers of peer-2-peer programs and file sharing. We advise removing any P2P programs you have now and avoiding this type of software application. Whether you remove them or not is your decision. But if you decide to keep and use Peer-to-Peer programs I can guarantee that you will be coming back to this forum or another malware forum. If you do choose to keep the program(s), please do not use it / them until the computer is clean and I give the all clear.

All programs, folders and files listed below in this color are optional removals, but if you uninstall the program(s) you must delete the folders and files in the corresponding colors.


Step-1.

Optional Removals

1. Please click the Start Orb, click Control Panel. Under the Programs heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

uTorrent

3. Click on each program to highlight it and click Change/Remove. (Vista/7 users: right click the program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Program Files\uTorrent
C:\Users\Paul\AppData\Roaming\uTorrent


2. Close Windows Explorer.


Step-2.

Disable SpyBot S&D TeaTimer

Before we begin we need to disable the SpyBot Teatimer for the duration of the fixes. We will restart it at cleanup.

TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can re-enable it when we're done if you like.

  • Right click the Spybot Icon in the System Tray (looks like a calendar with a padlock symbol ) and click Exit Spybot S&D Resident
  • Run Spybot S&D
  • Go to the Mode menu, and make sure Advanced Mode is selected.
    Posted Image
  • You may be presented with a warning dialog. If so, press Yes.
  • Click on Posted Image
  • Click on Posted Image
  • Uncheck these boxes:
    Posted Image
  • Close Spybot S&D and Restart your computer.
Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.


Step-3.

Posted Image OTL Fix

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[CREATERESTOREPOINT]

:OTL
IE - HKCU\..\URLSearchHook: CFBFAE00-17A6-11D0-99CB-00C04FD64497} - No CLSID value found
IE - HKCU\..\URLSearchHook: EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:466...q={searchTerms}
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O33 - MountPoints2\{000a467a-bbc4-11e0-8db6-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce5725e-0913-11e2-8a31-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce5725e-0913-11e2-8a31-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce5726c-0913-11e2-8a31-001e101f9843}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce5726c-0913-11e2-8a31-001e101f9843}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce57276-0913-11e2-8a31-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce57276-0913-11e2-8a31-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{0ce57281-0913-11e2-8a31-001e101f82a0}\Shell - "" = AutoRun
O33 - MountPoints2\{0ce57281-0913-11e2-8a31-001e101f82a0}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{327b734b-421b-11e0-a32a-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{327b734b-421b-11e0-a32a-001d098ac077}\Shell\AutoRun\command - "" = F:\WIN\setup.exe
O33 - MountPoints2\{37181591-b80f-11e0-aed9-001e101f0c85}\Shell - "" = AutoRun
O33 - MountPoints2\{37181591-b80f-11e0-aed9-001e101f0c85}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{3b9bb92e-55c6-11e1-b225-c43dc7c28a47}\Shell - "" = AutoRun
O33 - MountPoints2\{3b9bb92e-55c6-11e1-b225-c43dc7c28a47}\Shell\AutoRun\command - "" = G:\KaiserBaas.exe
O33 - MountPoints2\{812811eb-0923-11e2-a81c-001e101f3315}\Shell - "" = AutoRun
O33 - MountPoints2\{812811eb-0923-11e2-a81c-001e101f3315}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{b7de6e74-b18c-11e0-91ae-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{b7de6e74-b18c-11e0-91ae-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{b7de6e79-b18c-11e0-91ae-001e101fd417}\Shell - "" = AutoRun
O33 - MountPoints2\{b7de6e79-b18c-11e0-91ae-001e101fd417}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{df8fde42-bb45-11dd-b863-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{df8fde42-bb45-11dd-b863-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{df8fde66-bb45-11dd-b863-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{df8fde66-bb45-11dd-b863-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{e5d48ee9-b963-11e0-b278-001e101fee60}\Shell - "" = AutoRun
O33 - MountPoints2\{e5d48ee9-b963-11e0-b278-001e101fee60}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{f6f891d4-b58d-11e0-b79e-001e101f1f81}\Shell - "" = AutoRun
O33 - MountPoints2\{f6f891d4-b58d-11e0-b79e-001e101f1f81}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{faba72c6-aa0b-11dd-a074-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{faba72c6-aa0b-11dd-a074-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\{faba7306-aa0b-11dd-a074-001d098ac077}\Shell - "" = AutoRun
O33 - MountPoints2\{faba7306-aa0b-11dd-a074-001d098ac077}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010/08/20 03:49:08 | 000,126,976 | R--- | M] ()

:FILES
ipconfig /flushdns /c

:COMMANDS
[EMPTYTEMP]


Warning: This fix is relevant for this system and no other. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Please re-open Posted Image on your desktop.
3. Place the mouse pointer inside the Posted Image textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the Posted Image button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the Posted Image button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).


Step-4.

There are some files we need to have checked.

Virustotal File Upload:

To use Virustotal go Here
Posted Image
  • Click the Choose File button in the middle of the screen. This will open a File Upload window.
  • On the File Upload window, in the File name box, type, or copy and paste the following and click Open:
    NOTE.. Only one file per scan

    • C:\Windows\System32\pthreadVC.dll
    • C:\ProgramData\dldf
    .
  • This will put the file in the box on the Virustotal page.
  • Click the Scan it! button.
  • Please be patient while the file is scanned. It may take several minutes.
  • Once the scan results appear, please provide them in your next reply, or copy and paste the Virustotal link(s) (URL) in your next reply
  • Repeat 1 thru 6 for each file listed.

Step-5.

Run Security Check

Download Security Check from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step-6.

Things For Your Next Post:
1. The OTL fixes log
2. The VirusTotal results or links
3. The checkup.txt log
4. How is the computer running now?
  • 0

#5
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Hi,

I did everything you said to do, and during the OTL fix, a box with a red cross came up and said something about there not being a disc in the drive.
Then windows said the program wasn't responding and the start menu, etc had already disappeared. The computer shut itself down and so I turned it back on and it wouldn't load windows.
After about ten minutes of a blank screen, windows launched startup repair and it's still doing that now, 20 minutes later.
:(

What is on my pc?!!
  • 0

#6
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Ok update, Startup repair eventually worked and I am going to retry the process.
  • 0

#7
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Ok so I got up to running the OTL fix and the same thing happened again. The warning box says "There is no disc in the drive. Please insert drive\ device \Harddisk1\DR1.
Then OTL stops responding and doesn't recover. The program has closed and I have no access to windows again.
But now I have another box coming up, 32 times in a row, "AVG PC tuneup has stopped working" over and over.

I'm really not sure what to do now so I'll leave it until I hear back from you,

Thanks again for your help so far :)

Sorry it's not going to plan :(
  • 0

#8
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
I'm so sorry for the multiple postings, I turned the pc back on and when I did, it started fairly quickly and informed that malware bytes had stopped working and a notepad was open with this message:

Files/Folders moved on reboot
file move failed F: autorun.exe scheduled to be moved on reboot.
PendingFileRenameOperations files
Registry entries deleted on reboot.
  • 0

#9
godawgs

godawgs

    Teacher

  • Retired Staff
  • 8,228 posts
When you installed MalwareBytes did you activate trial period for the Pro version?
  • 0

#10
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Yes I did.
  • 0

Advertisements


#11
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Also, if I may ask a question, in windows task manager, the top two tasks are csrss.exe and winlogon.exe but there is no user name or description. Is that normal?
  • 0

#12
godawgs

godawgs

    Teacher

  • Retired Staff
  • 8,228 posts
Hello,

When you installed MalwareBytes did you activate trial period for the Pro version?

Yes I did.

OK. Malwarebytes has been known keep running in real time even after the trial period has ended. But looking back through the OTL log I don't think that's what happened.
The TeaTimer module of Spybot S&D has also been known to cause the kind of problem you had when you ran the OTL fix even though it has been disabled. We are gonna uninstall Spybot temporarily prevent that from happening again. When we are done we can reinstall it if you like but we will be using a different program during the cleaning process that we use all the time here and believe it is a better program.

Also, if I may ask a question, in windows task manager, the top two tasks are csrss.exe and winlogon.exe but there is no user name or description. Is that normal?

Yep it's normal.


Step-1

Uninstall SpyBot S&D

  • Run Spybot S&D
  • Go to the Mode menu, and make sure Advanced Mode is selected.
    Posted Image
  • You may be presented with a warning dialog. If so, press Yes.
  • In the Navigation Bar on the left click on SpyBot S&D and click on Immunize
  • On the Immunize page click Undo at the top of the page.
  • Click on Posted Image in the Navigation Bar
  • Click on Posted Image
  • Uncheck these boxes:
    Posted Image
  • Click IE Tweaks in the left Navigation Bar.
  • On the IE Tweaks window you will see a group Recommended miscellaneous locks
  • Click the checkboxes in front of both Lock IE… options to uncheck them
  • Close Spybot S&D and Restart your computer.
    Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
  • Click the Start Orb, click Control Panel. Under the Programs heading click Uninstall a program
  • In the list of programs installed, locate the following program(s):

    SpyBot S&D
  • (Vista/7 users: right click the program and click Uninstall
  • After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
  • Reboot the computer.

Step-2.

Posted Image OTL Custom Scan

1. Please copy the text in the Quote box below, (Do Not copy the word Quote), and paste it in the Posted Image box in OTL. To do that:
  • Highlight everything inside the quote box, (except the word Quote), right click the mouse and click Copy.

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
TUmessages.exe
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
services.*
/md5stop
DRIVES
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
del c:\commands.txt^|y /hide /c
/wait
del c:\diskreport.txt^|y /hide /c


2. Re-open OTL on the desktop. To do that:
  • Double click on the Posted Image OTL icon to run it. (Vista / 7 Users:Right click on the icon and click Run as Administrator)
    Make sure all other windows are closed.
  • You will see a console like the one below:

    Posted Image
  • Check the box beside Scan All Users at the top of the console
  • Make sure the Output box at the top is set to Standard Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Place the mouse pointer inside thePosted Image box, right click and click Paste. This will put the above script inside OTL
  • Click the Posted Image button. Do not change any settings unless otherwise told to do so.
  • Let the scan run uninterrupted. The scan won't take long.
  • When the scan completes, it will open OTL.Txt. This file is also saved in the same location as OTL (it should be on your desktop).
  • Please copy the contents of this file and paste it into your reply. To do that:
  • On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
  • Right click inside the forum post window then click Paste.This will paste the contents of the OTL.txt file in the in the post window.

Step-3.

Things For Your Next Post:
1. The new OTL.txt log
  • 0

#13
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Hello again :)

Ok, so I unistalled Spybot, but after I did this, it said that some elements of Spybot could not be removed and I would have to do it manually.

I ran the scan exactly as you said and here is the log:

OTL logfile created on: 30/10/2012 9:21:42 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Paul\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.25 Gb Total Physical Memory | 1.76 Gb Available Physical Memory | 54.26% Memory free
6.72 Gb Paging File | 5.28 Gb Available in Paging File | 78.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 86.64 Gb Free Space | 30.08% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.19 Gb Free Space | 41.93% Space Free | Partition Type: NTFS
Drive F: | 20.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SARAH | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/10/30 14:03:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/28 13:32:09 | 000,114,688 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe
PRC - [2012/09/18 09:27:39 | 001,193,176 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2012/08/23 11:31:24 | 001,532,280 | ---- | M] (AVG) -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
PRC - [2012/08/23 11:31:24 | 001,222,008 | ---- | M] (AVG) -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
PRC - [2012/08/13 04:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/07/31 04:37:02 | 002,596,984 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/07/26 04:23:08 | 000,758,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/06/13 04:48:24 | 001,255,544 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/03/19 06:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2012/02/14 05:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 05:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/04/01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe
PRC - [2011/02/22 08:17:32 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\System32\nlssrv32.exe
PRC - [2010/09/30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2010/08/26 18:48:00 | 000,285,152 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe
PRC - [2010/08/26 18:47:00 | 004,577,760 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WNA3100.exe
PRC - [2010/08/19 19:52:14 | 000,241,664 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2010/08/19 19:52:04 | 000,229,376 | ---- | M] () -- C:\ProgramData\DatacardService\DCService.exe
PRC - [2009/04/11 17:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/17 08:22:20 | 004,907,008 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/12/05 07:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTSrv.exe
PRC - [2006/11/02 21:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/28 13:32:09 | 000,114,688 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe
MOD - [2012/09/18 09:27:39 | 001,193,176 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
MOD - [2010/09/10 11:03:10 | 000,159,744 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\SMSPlugin.dll
MOD - [2010/08/26 18:47:00 | 004,577,760 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WNA3100.exe
MOD - [2010/03/15 12:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2010/02/03 12:31:02 | 000,282,624 | ---- | M] () -- C:\Program Files\NETGEAR\WNA3100\WifiSvcLib.dll
MOD - [2009/11/26 11:55:34 | 000,552,960 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\atcomm.dll
MOD - [2009/11/26 11:55:34 | 000,151,552 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DetectDev.dll
MOD - [2009/11/26 11:55:34 | 000,135,168 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\LocaleMgrPlugin.dll
MOD - [2009/11/26 11:55:34 | 000,090,112 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\FileManager.dll
MOD - [2009/11/26 11:55:34 | 000,090,112 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DialUpPlugin.dll
MOD - [2009/11/26 11:55:34 | 000,061,440 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\XCodec.dll
MOD - [2009/11/26 11:55:34 | 000,061,440 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceOperate.dll
MOD - [2009/11/26 11:55:34 | 000,057,344 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\ConfigFilePlugin.dll
MOD - [2009/11/26 11:55:34 | 000,032,768 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NotifyServicePlugin.dll
MOD - [2009/11/26 11:55:34 | 000,014,848 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\isaputrace.dll
MOD - [2009/09/19 12:08:04 | 000,118,784 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NetInfoPlugin.dll
MOD - [2009/08/29 17:18:34 | 000,888,832 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\NDISAPI.dll
MOD - [2009/07/31 12:26:22 | 000,172,032 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceMgrUIPlugin.dll
MOD - [2009/07/30 23:01:08 | 000,110,592 | ---- | M] () -- C:\Program Files\Optus Mobile Broadband\DeviceMgrPlugin.dll
MOD - [2009/01/18 15:50:02 | 000,417,792 | ---- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll
MOD - [2007/11/16 16:02:18 | 000,479,232 | R--- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll
MOD - [2007/11/16 16:02:18 | 000,401,408 | R--- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll
MOD - [2002/07/04 10:38:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ArcSoft\Software Suite\PhotoImpression\Share\PIHook.dll


========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2012/10/09 12:28:25 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/23 11:31:24 | 001,532,280 | ---- | M] (AVG) [Auto | Running] -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012/08/13 04:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/02/14 05:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/04/01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc)
SRV - [2011/02/22 08:17:32 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\System32\nlssrv32.exe -- (nlsX86cc)
SRV - [2010/09/30 04:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010/08/26 18:48:00 | 000,285,152 | ---- | M] () [Auto | Running] -- C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe -- (WSWNA3100)
SRV - [2010/08/19 19:52:04 | 000,229,376 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe)
SRV - [2008/01/19 18:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/12/05 07:17:24 | 000,077,824 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2007/05/31 12:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 12:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2006/11/02 21:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\usbser_lowerflt.sys -- (upperdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\massfilter.sys -- (massfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - File not found [Kernel | Auto | Stopped] -- -- (adfs)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/24 16:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/07/26 04:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/07/04 15:26:12 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2012/04/19 05:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/01/31 05:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/12/23 14:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 14:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 14:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 14:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011/10/01 08:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 08:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 08:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 08:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/08/02 17:38:44 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netaapl.sys -- (Netaapl)
DRV - [2010/08/27 14:53:46 | 000,116,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2010/08/07 18:48:42 | 000,106,880 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2010/07/27 16:25:48 | 000,072,832 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV - [2010/07/27 10:52:02 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2010/07/16 11:04:16 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PCASp50.sys -- (PCASp50)
DRV - [2010/06/21 16:07:20 | 000,078,720 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swiwdmbus.sys -- (swiwdmbus)
DRV - [2010/06/21 15:47:14 | 000,156,544 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swumxa3.sys -- (SWUMXA3)
DRV - [2010/06/21 15:46:50 | 000,201,088 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\swnc8ua3.sys -- (SWNC8UA3)
DRV - [2010/02/03 12:21:56 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2009/11/06 09:37:20 | 000,699,896 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcmwlhigh6.sys -- (BCMH43XX)
DRV - [2009/05/25 17:01:00 | 000,069,098 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\jl2005c.sys -- (JL2005C)
DRV - [2007/09/17 09:07:00 | 007,624,192 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/04/29 19:42:24 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2007/03/23 21:29:32 | 000,060,768 | ---- | M] (2Wire, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\2WirePCP.sys -- (2WIREPCP)
DRV - [2007/01/19 19:20:54 | 000,021,728 | ---- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SCMNdisP.sys -- (SCMNdisP)
DRV - [2006/11/02 18:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/10/19 05:08:18 | 000,258,048 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
DRV - [2006/08/05 11:39:10 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/07/24 17:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005/02/23 15:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2003/09/20 09:45:48 | 000,021,248 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pfc.sys -- (pfc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...ie7&rlz=1I7DAAU


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://au.yahoo.com/?fr=fp-yie8
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..\SearchScopes\{7BF39D85-F6C0-4D55-AA9E-354D98E05232}: "URL" = http://au.search.yah...f-8&fr=chr-yie8
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..\SearchScopes\{8E02D41C-5924-4816-9490-33CCD28BEB72}: "URL" = http://search.avg.co...}&ychte=au&nt=1
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..\SearchScopes\{D4395A68-EC0A-4AB4-A6BC-355E67975B7D}: "URL" = http://www.flickr.co...q={searchTerms}
IE - HKU\S-1-5-21-3766550063-913140356-267790273-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@csi.business.gov.au/CsiPlugin: C:\Program Files\Common-Use Signing Interface\bin\npCsiPlugin.dll (Commonwealth Government of Australia)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/11 09:12:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/07/03 10:53:19 | 000,000,000 | ---D | M]

[2010/10/03 00:33:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions
[2010/10/03 00:33:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions\IMVUClientXUL@imvu.com
[2009/02/21 12:16:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Paul\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org

O1 HOSTS File: ([2012/10/30 20:49:11 | 000,000,875 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3766550063-913140356-267790273-1000..\Run: [Mobile Partner] C:\Program Files\Optus Mobile Broadband\Optus Mobile Broadband.exe ()
O4 - HKU\S-1-5-21-3766550063-913140356-267790273-1000..\Run: [Spotify Web Helper] C:\Users\Paul\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Domains: modthesims.info ([www] https in Trusted sites)
O15 - HKU\S-1-5-21-3766550063-913140356-267790273-1000\..Trusted Ranges: Range1 ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{240A7F65-CAC9-408C-9A3F-95FD2AEC47CE}: DhcpNameServer = 10.4.85.135 10.4.176.231
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{36DECCF4-4B5C-481A-93A7-6A5B2DF65257}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38DE3DDE-AE25-46E9-92EA-BA55DDCE6BFA}: DhcpNameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5A973CA7-C2C5-4870-B413-727AF81EA57D}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{65EDAF65-0BB3-43CC-AE3C-0CE14CD8B58C}: DhcpNameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92F8F3AC-362C-4FC5-8459-FA7C4D26009A}: NameServer = 198.142.0.51 61.88.88.88
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E0C30011-0E0B-491A-A1D7-E91CF8B7640C}: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBBAE300-C89E-45AB-A9CF-28E61D33B73D}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\PROGRA~1\GOOGLE\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Paul\AppData\Roaming\Microsoft\Windows Live Photo Gallery\Windows Live Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 08:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/08/20 03:49:08 | 000,126,976 | R--- | M] () - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2010/09/14 22:01:18 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/10/30 14:03:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
[2012/10/29 19:59:12 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{13EBD0E5-DC9A-455D-AA4B-D9B3A5B4D507}
[2012/10/29 16:47:36 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{32898108-06FE-44D9-BB4A-DD92EF5F9171}
[2012/10/28 22:00:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/28 22:00:19 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/10/28 21:12:03 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\Temp(72)
[2012/10/28 21:12:03 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/10/28 20:42:01 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\SUPERAntiSpyware.com
[2012/10/28 20:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/10/28 20:41:29 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012/10/28 13:15:28 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Malwarebytes
[2012/10/28 13:15:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/10/28 13:15:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/28 11:31:11 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\AVG
[2012/10/28 11:29:56 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG
[2012/10/28 11:29:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2012/10/24 07:47:01 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012/10/24 07:46:49 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012/10/24 07:46:49 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012/10/24 07:46:49 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012/10/22 10:21:51 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{1300AB69-50A9-4A64-846D-B3FFAEDC45BE}
[2012/10/20 08:54:49 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{86974068-D347-4947-9155-BC9E9B9CC64B}
[2012/10/19 09:03:44 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Nico Mak Computing
[2012/10/19 09:03:41 | 000,017,224 | ---- | C] (WinZip Computing, S.L.(WinZip Computing)) -- C:\Windows\System32\roboot.exe
[2012/10/19 09:03:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip Registry Optimizer
[2012/10/18 18:58:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\wxDownload Fast
[2012/10/18 18:57:22 | 000,000,000 | ---D | C] -- C:\ProgramData\wxDownload
[2012/10/18 18:55:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012/10/18 18:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2012/10/17 14:10:02 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{D14BAD02-FBF0-49C4-B382-3FD951F784D0}
[2012/10/15 16:00:44 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{DD19C2CF-A542-4DB6-9990-E9944B217548}
[2012/10/13 20:53:04 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{7D433DC4-590E-4487-AE94-1D28CB6538AE}
[2012/10/10 23:19:43 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012/10/10 23:19:39 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/10/10 23:19:39 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/10/08 22:32:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/10/08 22:30:35 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/10/08 22:30:34 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/10/08 22:30:34 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/10/04 20:35:31 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{189C5C47-DA35-481E-A761-DB662A8B6A9F}
[2012/10/02 17:32:30 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{C81405DC-5F56-48FC-8D7F-8A00F0AB8088}
[2011/03/10 10:25:56 | 001,228,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Paul\Photoshop_12_LS1.exe
[2008/03/11 14:26:55 | 000,092,064 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmmdm.sys
[2008/03/11 14:26:55 | 000,079,328 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmserd.sys
[2008/03/11 14:26:55 | 000,066,656 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmbus.sys
[2008/03/11 14:26:55 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Users\Paul\usbsermptxp.sys
[2008/03/11 14:26:55 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Users\Paul\usbsermpt.sys
[2008/03/11 14:26:55 | 000,009,232 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmmdfl.sys
[2008/03/11 14:26:55 | 000,006,208 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmcmnt.sys
[2008/03/11 14:26:55 | 000,005,936 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmwhnt.sys
[2008/03/11 14:26:55 | 000,004,048 | ---- | C] (MCCI) -- C:\Users\Paul\mqdmcr.sys
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/10/30 20:58:07 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2012/10/30 20:58:04 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/30 20:58:04 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/30 20:58:04 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/30 20:58:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/10/30 20:56:46 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/10/30 20:49:11 | 000,000,875 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/10/30 20:46:06 | 098,924,009 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2012/10/30 14:03:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Paul\Desktop\OTL.exe
[2012/10/30 13:56:34 | 003,721,104 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/10/30 13:28:18 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/30 12:37:14 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/29 19:39:08 | 000,881,854 | ---- | M] () -- C:\Users\Paul\Desktop\SecurityCheck.exe
[2012/10/29 12:48:52 | 000,000,512 | ---- | M] () -- C:\Users\Paul\Desktop\MBR.dat
[2012/10/29 07:46:54 | 000,001,828 | ---- | M] () -- C:\Users\Paul\AppData\Roaming\wklnhst.dat
[2012/10/28 22:00:21 | 000,000,868 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 08:35:10 | 000,041,472 | ---- | M] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/10/24 07:46:40 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012/10/24 07:46:40 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012/10/24 07:46:40 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012/10/24 07:46:40 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012/10/24 07:46:39 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012/10/24 07:46:39 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012/10/20 18:10:14 | 000,454,298 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/10/20 07:58:07 | 000,646,002 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/10/20 07:58:07 | 000,123,514 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/10/11 17:19:54 | 000,001,626 | ---- | M] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/10/09 12:28:24 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/10/09 12:28:24 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/10/09 11:13:36 | 000,001,626 | ---- | M] () -- C:\Users\Paul\Desktop\iTunes (2).lnk
[2012/10/08 22:32:14 | 000,001,626 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/10/07 19:00:50 | 000,001,846 | ---- | M] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\SpongeBob SquarePants Snapshots.lnk
[2012/10/04 10:00:06 | 000,000,554 | ---- | M] () -- C:\Users\Paul\Desktop\Mozilla Firefox.zip
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/10/29 19:39:08 | 000,881,854 | ---- | C] () -- C:\Users\Paul\Desktop\SecurityCheck.exe
[2012/10/29 12:48:52 | 000,000,512 | ---- | C] () -- C:\Users\Paul\Desktop\MBR.dat
[2012/10/28 22:00:21 | 000,000,868 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/11 17:19:54 | 000,001,626 | ---- | C] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2012/10/09 11:13:36 | 000,001,626 | ---- | C] () -- C:\Users\Paul\Desktop\iTunes (2).lnk
[2012/10/08 22:32:14 | 000,001,626 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/10/07 19:00:50 | 000,001,846 | ---- | C] () -- C:\Users\Paul\Application Data\Microsoft\Internet Explorer\Quick Launch\SpongeBob SquarePants Snapshots.lnk
[2012/10/04 10:00:06 | 000,000,554 | ---- | C] () -- C:\Users\Paul\Desktop\Mozilla Firefox.zip
[2012/06/07 21:21:01 | 000,002,554 | ---- | C] () -- C:\Windows\WAVEMIX.INI
[2011/09/10 11:40:50 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2011/08/10 01:02:09 | 000,024,441 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\UserTile.png
[2011/07/26 18:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011/07/26 18:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011/07/26 18:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011/07/26 18:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011/07/15 23:38:23 | 000,000,025 | ---- | C] () -- C:\Windows\CDESP1410E.ini
[2011/06/29 20:52:44 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/06/28 19:25:17 | 000,154,004 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/03/30 09:17:10 | 000,316,928 | ---- | C] () -- C:\Windows\System32\HDREfexProFC32.dll
[2011/03/11 11:44:17 | 020,938,448 | -H-- | C] () -- C:\Users\Paul\PhotoshopElements_9_LS15.7z.part
[2011/03/11 11:44:16 | 000,000,044 | ---- | C] () -- C:\Users\Paul\PhotoshopElements_9_LS15.exe
[2011/03/10 10:25:57 | 1026,293,791 | ---- | C] () -- C:\Users\Paul\Photoshop_12_LS1.7z
[2011/02/22 08:17:34 | 000,316,928 | ---- | C] () -- C:\Windows\System32\SilverEfexPro2FC32.dll
[2009/09/01 20:40:39 | 000,003,970 | ---- | C] () -- C:\Users\Paul\.recently-used.xbel
[2008/07/29 18:35:18 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008/07/11 15:17:28 | 000,000,680 | ---- | C] () -- C:\Users\Paul\AppData\Local\d3d9caps.dat
[2008/07/08 18:55:13 | 000,001,828 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\wklnhst.dat
[2008/03/18 17:45:49 | 000,001,260 | ---- | C] () -- C:\ProgramData\dldf
[2008/03/11 14:26:55 | 000,009,913 | ---- | C] () -- C:\Users\Paul\MCCI_MDM.INF
[2008/03/11 14:26:55 | 000,009,232 | ---- | C] () -- C:\Users\Paul\USB_MOT_BRIT.INF
[2008/03/11 14:26:55 | 000,007,201 | ---- | C] () -- C:\Users\Paul\USBMOT2000.INF
[2008/03/11 14:26:55 | 000,006,989 | ---- | C] () -- C:\Users\Paul\MCCI_BUS.INF
[2008/03/11 14:26:55 | 000,006,209 | ---- | C] () -- C:\Users\Paul\USBMOT2000XP.INF
[2008/03/11 14:26:55 | 000,005,880 | ---- | C] () -- C:\Users\Paul\USB_CMCS_2000.INF
[2008/03/11 14:26:55 | 000,005,813 | ---- | C] () -- C:\Users\Paul\USB_MOT_A1000.INF
[2008/03/11 14:26:55 | 000,004,477 | ---- | C] () -- C:\Users\Paul\MCCI_SDM.INF
[2008/01/15 19:26:59 | 000,041,472 | ---- | C] () -- C:\Users\Paul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 23:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 04:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 17:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 17:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/10/30 13:51:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\948 Series
[2011/06/29 13:58:45 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Alien Skin
[2012/10/28 11:31:11 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\AVG
[2012/01/21 07:53:05 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\AVG2012
[2011/03/13 11:07:20 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Canon
[2011/04/04 20:58:13 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/12/06 22:59:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2010/04/20 16:11:52 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/07/16 00:02:14 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\EPSON
[2012/10/30 13:51:52 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\gtk-2.0
[2011/07/19 14:58:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\HDREfexPro
[2012/05/08 20:29:54 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\HDRsoft
[2012/10/19 09:10:37 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nico Mak Computing
[2011/07/19 15:23:39 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nik Software
[2008/04/28 16:10:51 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Nokia
[2012/04/19 09:49:19 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Origin
[2012/01/07 14:14:30 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Panasonic
[2008/04/21 18:36:55 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PC Suite
[2011/08/10 01:02:09 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PeerNetworking
[2012/10/30 13:51:52 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PhotoScape
[2010/04/18 14:59:21 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Publish Providers
[2011/08/10 01:37:37 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Samsung
[2011/02/27 13:49:12 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sierra Wireless
[2011/07/19 15:01:58 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\SilverEfexPro2
[2012/01/07 14:25:02 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\SoftGrid Client
[2010/04/18 16:02:41 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Sony
[2012/10/31 06:04:34 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Spotify
[2011/03/23 10:12:05 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2008/07/08 18:55:15 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Template
[2011/05/18 10:31:53 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\TP
[2011/02/28 13:37:54 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Visan
[2010/10/03 00:49:23 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Vivox
[2011/08/10 01:05:00 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2007/11/07 09:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe

< MD5 for: EXPLORER.EXE >
[2008/10/29 17:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 17:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/30 14:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008/01/15 19:41:12 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008/01/15 19:41:12 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009/04/11 17:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/11 17:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/28 13:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006/11/02 20:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008/01/19 18:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: QMGR.DLL >
[2008/01/19 18:36:13 | 000,758,272 | ---- | M] (Microsoft Corporation) MD5=02ED7B4DBC2A3232A389106DA7515C3D -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6001.18000_none_2390c4ecf9720b8c\qmgr.dll
[2006/11/02 20:46:12 | 000,749,568 | ---- | M] (Microsoft Corporation) MD5=733FB484A06B9D6A44DD9CA1D3BE937B -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6000.16386_none_215a02f0fc86fab8\qmgr.dll
[2009/04/11 17:28:23 | 000,758,784 | ---- | M] (Microsoft Corporation) MD5=93952506C6D67330367F7E7934B6A02F -- C:\Windows\System32\qmgr.dll
[2009/04/11 17:28:23 | 000,758,784 | ---- | M] (Microsoft Corporation) MD5=93952506C6D67330367F7E7934B6A02F -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6002.18005_none_257c3df8f693d6d8\qmgr.dll
[2008/01/11 10:26:56 | 000,750,080 | ---- | M] (Microsoft Corporation) MD5=DA551697E34D2B9943C8B1C8EAFFE89A -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6000.16531_none_218b14e6fc62ea9e\qmgr.dll
[2008/01/11 10:26:56 | 000,750,080 | ---- | M] (Microsoft Corporation) MD5=F1148566FA5173A4FD48AF8E8BC09401 -- C:\Windows\winsxs\x86_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6000.20647_none_220fe38215833e63\qmgr.dll

< MD5 for: SERVICES >
[2006/09/19 08:41:30 | 000,017,244 | ---- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 -- C:\Windows\System32\drivers\etc\services
[2006/09/19 08:41:30 | 000,017,244 | ---- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6000.16386_none_024e4071fa6fea95\services

< MD5 for: SERVICES.EXE >
[2008/01/19 18:33:28 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2006/11/02 20:45:40 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=329CF3C97CE4C19375C8ABCABAE258B0 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.exe
[2009/04/11 17:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
[2009/04/11 17:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 23:40:53 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\System32\en-US\services.exe.mui
[2006/11/02 23:40:53 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui

< MD5 for: SERVICES.LNK >
[2008/06/28 15:10:18 | 000,001,688 | ---- | M] () MD5=7965A3E4F5EC93A8470159AAD41989E6 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/06/28 15:10:18 | 000,001,688 | ---- | M] () MD5=7965A3E4F5EC93A8470159AAD41989E6 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOF >
[2006/09/19 08:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\System32\wbem\services.mof
[2006/09/19 08:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6000.16386_none_cd28fe6bd05df036\services.mof
[2006/09/19 08:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof
[2006/09/19 08:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 23:41:29 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\en-US\services.msc
[2006/09/19 08:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\System32\services.msc
[2006/11/02 23:41:29 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/19 08:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6000.16386_none_cd2d20a848cfd40f\services.msc
[2006/09/19 08:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: SVCHOST.EXE >
[2006/11/02 20:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008/01/19 18:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/19 18:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2012/09/29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: TUMESSAGES.EXE >
[2012/08/23 11:30:54 | 000,120,184 | ---- | M] (AVG) MD5=2CE35974A5E6A1D5420B48EEF70F73CB -- C:\Program Files\AVG\AVG PC TuneUp\TUMessages.exe

< MD5 for: USERINIT.EXE >
[2008/01/19 18:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/19 18:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006/11/02 20:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012/09/29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/04/11 17:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/11 17:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006/11/02 20:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008/01/19 18:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST3320620AS ATA Device
Partitions: 3
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 -
Interface type: USB
Media Type:
Model: HUAWEI SD Storage USB Device
Partitions: 0
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 47.00MB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 10.00GB
Starting Offset: 50331648
Hidden sectors: 0


DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 288.00GB
Starting Offset: 10787749888
Hidden sectors: 0


< type c:\diskreport.txt /c >
Microsoft DiskPart version 6.0.6002
Copyright © 1999-2007 Microsoft Corporation.
On computer: SARAH
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 E DVD-ROM 0 B No Media
Volume 1 F Optus Mobil CDFS CD-ROM 97 MB Healthy
Volume 2 D RECOVERY NTFS Partition 10 GB Healthy
Volume 3 C OS NTFS Partition 288 GB Healthy System
Volume 4 G Removable 0 B No Media

< End of report >



Once again, thank you for your tremendous help so far :D

*edit: When I did the scan I forgot to run as admin so I redid it, as admin.

Edited by Mrscoffeecup, 30 October 2012 - 04:41 AM.

  • 0

#14
godawgs

godawgs

    Teacher

  • Retired Staff
  • 8,228 posts
Hi, :)

Ok, so I unistalled Spybot, but after I did this, it said that some elements of Spybot could not be removed and I would have to do it manually.

This is normal. SpyBot leaves the folders that contain the logs, quarantined items and backups. In case you reinstall the program they will be there.

Once again, thank you for your tremendous help so far :D

You are welcome.

*edit: When I did the scan I forgot to run as admin so I redid it, as admin.

Noted.

The OTL fix did what it was supposed to do. :yeah: I don't see much of anything else in the last scan. So let's continue withe the scans I asked for and check for stragglers.

The Event Log Errors in the Extras.txt log shows that AVG PCTuneUp is not happy and you will probably need to uninstall and reinstall the program. You can do that after we have finished looking for nasties. I would caution you that if the AVG PCTuneUp program has a Registry cleanup function that you not use it. G2G doesn't recommend the use of any registry cleaning or optimization tools.

Let me know what issues / problems remain after this run.


Step-1.

There are some files we need to have checked.

Virustotal File Upload:

To use Virustotal go Here
Posted Image
  • Click the Choose File button in the middle of the screen. This will open a File Upload window.
  • On the File Upload window, in the File name box, type, or copy and paste the following and click Open:
    NOTE.. Only one file per scan

    • C:\Windows\System32\pthreadVC.dll
    • C:\ProgramData\dldf
    .
  • This will put the file in the box on the Virustotal page.
  • Click the Scan it! button.
  • Please be patient while the file is scanned. It may take several minutes.
  • Once the scan results appear, please provide them in your next reply, or copy and paste the Virustotal link(s) (URL) in your next reply
  • Repeat 1 thru 6 for each file listed.

Step-2.

Run Security Check

  • Double click SecurityCheck.exe on the desktop and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step-3.

Posted ImageMalwarebytes' Anti-Malware

Close all programs and browsers on your computer.

  • Right click the MalwareBytes icon on the desktop and click Run as Administrator to run the program. You will now be at the main program as shown below.

    Posted Image
  • Click the Update tab and allow the program to update if required.
  • Click the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer.
  • MBAM will now start scanning your computer for malware. NOTE: This process can take quite a while, so I suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.

    Posted Image
  • When the scan is finished a message box will appear as shown in the image below.

    Posted Image
    You should click on the OK button to close the message box and continue with the removal process.
  • You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
  • A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.

    Posted Image
  • Make sure that everything is checked, and click Remove Selected.<---Very Important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


Step-4.

Run ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
  • Please go here then click on: Posted Image

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow the Add-On/Active X to install.
  • Uncheck the box beside Remove Found Threats
  • Make sure that the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically. NOTE: The scan may take several hours.
  • Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
When The Scan is Complete:

  • If No Threats Were Found:
    • Put a checkmark in "Uninstall application on close"
    • Close the program
    • Report to me that nothing was found
  • If Threats Were Found:
    • Click on "list of threats found"
    • Click on "export to text file" and save it to the desktop as ESET SCAN.txt
    • Click on Back
    • Put a checkmark in "Uninstall application on close" (Be sure you have saved the file first)
    • Click on Finish
    • Close the program
    • Copy and paste the report here
Note: Do not forget to re-enable your Anti-Virus application after running the above scan!


Step-5.

Things For Your Next Post:
1. The VirusTotal results or links
2. The Checkup.txt log
3. The MalwareBytes log
4. The ESET log. Or if it didn't find any threats just tell me.
  • 0

#15
Mrscoffeecup

Mrscoffeecup

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Hello!!!

Ok,so!! Scans are all done, but first I just wanted to mention that during all the scans today, a dialogue box regarding AVG PC Tuneup not working came up 32 times in a row, over and over, maybe 20 or 30 times during the whole process.

I actually tried to remove this a ferw days ago, but it says it's unable to be uninstalled, and maybe reinstalling will help. Also when I right click on the icon in the tray, it's in German. Hmmm.

The very last scan I did (the ESET scan) found the trojan but did not remove it.

Ok so here we go!:

https://www.virustot...sis/1351630566/




https://www.virustot...sis/1351630659/




Results of screen317's Security Check version 0.99.54
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Anti-Virus Free Edition 2012
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
AVG PC TuneUp
AVG PC TuneUp Language Pack (en-US)
JavaFX 2.1.1
Java 7 Update 9
Adobe Flash Player 11.4.402.287
Adobe Reader 9 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0 %
````````````````````End of Log``````````````````````





Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.10.30.08

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Paul :: SARAH [administrator]

Protection: Enabled

31/10/2012 8:07:58 AM
mbam-log-2012-10-31 (08-07-58).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 480275
Time elapsed: 1 hour(s), 42 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)



(ESETSCAN)

C:\Users\Paul\Downloads\sharpfolio.zip PHP/Kryptik.AB trojan



Okies so I think I've done everything correctly, (I hope!) looking forward to hearing from you!!!

Thank you thank you thank you!!! :D


Edit: Just wanted to mention that when I open up IE to go any page, AVG (which I have now re enabled) keeps alerting me of tracking cookies, yieldmanager. So something is hiding somewhere.

Edited by Mrscoffeecup, 30 October 2012 - 09:20 PM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP