Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved

Started by Robsthrobbinghead , Nov 01 2012 11:01 PM

This topic is locked

#1 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #1$
Robsthrobbinghead

Posted 01 November 2012 - 11:01 PM

New Member

Member
5 posts

Started on or about 10/23 or 10/24 downloaded a pic and tried to view it quicktime would not run it then tried windows viewer it ran. I ran it in notepad because i had a bad feeling it had pulled some of my cc transactions. I deleted the picture ran advadnced uninstaller to try to get rid of the rest of remnants could not delete file C:\Users\Gangsterfist\AppData\Local\Temp\FXSAPIDebugLogFile.txt tried malwarebytes and it did not detect it so googled it and found you guys i'm not very experienced but would like to try this myself. i deleted the pic but just looked in my dowloads file and it was back deleted it again. i may be in over my head here.

OTL logfile created on: 11/1/2012 9:27:38 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gangsterfist\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 56.33% Memory free
6.99 Gb Paging File | 5.39 Gb Available in Paging File | 77.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.46 Gb Total Space | 66.72 Gb Free Space | 48.90% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 9.92 Gb Free Space | 99.16% Space Free | Partition Type: NTFS
Drive F: | 7.54 Gb Total Space | 1.02 Gb Free Space | 13.58% Space Free | Partition Type: FAT32

Computer Name: TANK | User Name: Gangsterfist | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/01 20:33:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
PRC - [2012/10/11 21:48:54 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/10/08 17:05:14 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/08/29 12:17:48 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\ccSvcHst.exe
PRC - [2012/07/27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/09 18:49:22 | 000,195,400 | ---- | M] (NETGEAR) -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe
PRC - [2012/06/14 20:42:42 | 001,040,712 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe
PRC - [2012/06/14 20:42:42 | 000,122,696 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\genie2_tray.exe
PRC - [2011/03/31 19:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
PRC - [2011/02/24 22:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 05:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/11/19 12:26:54 | 000,455,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2008/07/24 15:22:50 | 000,102,400 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
PRC - [2008/02/12 13:19:52 | 001,624,616 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008/02/12 13:19:52 | 000,723,496 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007/09/20 14:31:10 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe
PRC - [2007/09/13 14:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/09/13 14:44:48 | 000,405,504 | ---- | M] (IDT, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe

========== Modules (No Company Name) ==========

MOD - [2012/10/11 21:48:53 | 002,294,240 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/10/08 17:05:14 | 009,814,968 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll
MOD - [2012/07/26 02:44:38 | 000,915,968 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Ui.dll
MOD - [2012/07/26 02:29:22 | 008,299,520 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Resource.dll
MOD - [2012/07/25 03:42:54 | 001,084,416 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
MOD - [2012/07/25 03:42:54 | 000,088,064 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QRCode.dll
MOD - [2012/07/25 01:00:54 | 001,132,032 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
MOD - [2012/07/24 22:48:48 | 001,550,848 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\SvtNetworkTool.dll
MOD - [2012/07/24 22:48:48 | 000,412,160 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\Genie.dll
MOD - [2012/07/24 20:45:52 | 000,433,152 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
MOD - [2012/07/23 00:36:52 | 000,499,200 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
MOD - [2012/07/23 00:36:52 | 000,186,368 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DragonNetTool.dll
MOD - [2012/07/23 00:25:50 | 000,641,536 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
MOD - [2012/07/23 00:21:28 | 000,701,440 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\InnerPlugin_Update.dll
MOD - [2012/07/23 00:08:36 | 001,567,744 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Map.dll
MOD - [2012/07/23 00:08:36 | 000,083,968 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NetcardApi.dll
MOD - [2012/07/23 00:08:36 | 000,082,432 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\SVTUtils.dll
MOD - [2012/07/12 00:24:18 | 001,061,376 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Internet.dll
MOD - [2012/07/12 00:24:18 | 000,150,528 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DiagnoseDll.dll
MOD - [2012/07/12 00:24:18 | 000,136,704 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DiagnosePlugin.dll
MOD - [2012/07/11 23:51:54 | 000,504,832 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
MOD - [2012/07/11 23:51:54 | 000,116,224 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\WSetupApiPlugin.dll
MOD - [2012/07/11 23:51:54 | 000,076,288 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\WSetupDll.dll
MOD - [2012/07/11 22:23:24 | 000,231,424 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
MOD - [2012/07/11 22:23:24 | 000,138,752 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\airprintdll.dll
MOD - [2012/06/14 20:42:42 | 001,040,712 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe
MOD - [2012/06/14 20:42:42 | 000,122,696 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\genie2_tray.exe
MOD - [2012/05/30 07:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\wincfi39.dll
MOD - [2012/05/10 23:24:16 | 009,814,016 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtGui4.dll
MOD - [2012/05/10 23:24:16 | 002,537,472 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtCore4.dll
MOD - [2012/05/10 23:24:16 | 001,140,224 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtNetwork4.dll
MOD - [2012/05/10 23:24:16 | 000,399,360 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtXml4.dll
MOD - [2012/05/10 23:24:16 | 000,287,232 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qjpeg4.dll
MOD - [2012/05/10 23:24:16 | 000,083,456 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qico4.dll
MOD - [2012/05/10 23:24:16 | 000,083,456 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qgif4.dll
MOD - [2012/05/09 19:34:06 | 000,043,008 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
MOD - [2012/05/09 19:34:06 | 000,011,362 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\mingwm10.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 15:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2009/08/16 17:06:02 | 000,141,312 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Electronic Arts\Medal of Honor -- (PnkBstrA)
SRV - [2012/10/11 21:48:54 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/10/08 17:05:15 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/29 12:17:48 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\ccSvcHst.exe -- (N360)
SRV - [2012/07/27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/09 18:49:22 | 000,195,400 | ---- | M] (NETGEAR) [Auto | Running] -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe -- (NETGEARGenieDaemon)
SRV - [2011/12/22 12:14:13 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/06/12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/03/31 19:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2010/02/25 01:13:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/11/19 12:26:54 | 000,455,944 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/07/24 15:22:50 | 000,102,400 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- (WDBtnMgrSvc.exe)
SRV - [2007/09/20 14:31:10 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/09/13 14:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\sxuptp.sys -- (sxuptp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motusbdevice.sys -- (motusbdevice)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Motousbnet.sys -- (Motousbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motswch.sys -- (MotoSwitchService)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motmodem.sys -- (motmodem)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgpfl.sys -- (motccgpfl)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgp.sys -- (motccgp)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\motoandroid.sys -- (motandroidusb)
DRV - File not found [Kernel | On_Demand | Running] -- C:\Users\GANGST~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys -- (cpuz134)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motfilt.sys -- (BTCFilterService)
DRV - [2012/11/01 19:38:30 | 001,601,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\VirusDefs\20121101.017\navex15.sys -- (NAVEX15)
DRV - [2012/11/01 19:38:30 | 000,092,704 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\VirusDefs\20121101.017\naveng.sys -- (NAVENG)
DRV - [2012/10/27 02:37:32 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\IPSDefs\20121101.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/10/25 03:21:05 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/10/05 11:23:26 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\BASHDefs\20121005.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/21 15:58:38 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2012/08/10 18:26:42 | 000,585,888 | R--- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\N360\1401010.002\srtsp.sys -- (SRTSP)
DRV - [2012/08/09 13:54:50 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/08/09 13:54:50 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/08/07 22:18:19 | 000,926,880 | R--- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\1401010.002\SymEFA.sys -- (SymEFA)
DRV - [2012/08/07 11:42:43 | 000,134,304 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1401010.002\ccSetx86.sys -- (ccSet_N360)
DRV - [2012/07/27 20:25:32 | 000,368,288 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\1401010.002\SymDS.sys -- (SymDS)
DRV - [2012/07/27 20:05:21 | 000,175,264 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1401010.002\Ironx86.sys -- (SymIRON)
DRV - [2012/07/22 18:34:24 | 000,338,592 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1401010.002\symnets.sys -- (SymNetS)
DRV - [2012/05/24 22:36:55 | 000,032,888 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1401010.002\srtspx.sys -- (SRTSPX)
DRV - [2011/04/07 23:13:34 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2010/11/20 03:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 02:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/04/16 21:24:34 | 000,022,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2010/04/14 01:01:48 | 000,045,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2009/11/20 19:34:54 | 011,515,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/10/16 20:12:02 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2009/07/13 15:02:49 | 000,046,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2009/05/28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2009/04/30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2008/07/26 15:26:22 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 15:25:48 | 000,627,864 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008/07/26 15:22:22 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2007/10/17 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/09/26 08:12:00 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32)
DRV - [2007/09/13 14:46:06 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/01/11 19:15:16 | 000,032,528 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/01/11 19:15:06 | 000,032,272 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2006/11/14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 67 F2 A1 27 92 94 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [email protected]:3.0.2
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\coFFPlgn\ [2012/11/01 19:06:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\IPSFFPlgn\ [2012/10/25 03:30:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/11 21:48:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/11 21:48:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/11 21:48:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/11 21:48:50 | 000,000,000 | ---D | M]

[2011/07/06 11:52:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Extensions
[2012/10/22 23:12:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions
[2010/04/28 05:21:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/08/23 15:33:33 | 000,070,902 | ---- | M] () (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions\[email protected]
[2012/10/11 21:48:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/10/11 21:48:54 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/09/14 03:18:22 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/11 21:48:53 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/18 14:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\IPS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\20.1.1.2\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [NETGEARGenie] C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2DDEBFCA-067B-40D2-80AA-C2639A7E322F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32C3E899-DA6A-4BD9-8BB6-9B40508352E3}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\Shell\AutoRun\command - "" = G:\setup.exe -a
O33 - MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a
O33 - MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/01 20:32:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
[2012/10/29 15:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/29 15:27:13 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/10/29 15:27:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/29 14:23:39 | 000,000,000 | ---D | C] -- C:\Users\Gangsterfist\AppData\Roaming\Malwarebytes
[2012/10/29 14:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/10/11 21:48:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/11/01 21:05:40 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/01 20:33:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
[2012/11/01 20:13:23 | 000,000,286 | ---- | M] () -- C:\Windows\reimage.ini
[2012/11/01 19:10:15 | 000,009,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/01 19:10:15 | 000,009,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/01 19:02:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/11/01 19:02:36 | 2817,032,192 | -HS- | M] () -- C:\hiberfil.sys
[2012/10/29 18:00:02 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2012/10/29 15:29:43 | 000,624,206 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/10/29 15:29:43 | 000,106,550 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/10/29 15:27:19 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 03:28:37 | 000,001,295 | ---- | M] () -- C:\Users\Gangsterfist\Desktop\Norton Installation Files.lnk
[2012/10/25 03:27:45 | 001,627,694 | ---- | M] () -- C:\Windows\System32\drivers\N360\1401010.002\Cat.DB
[2012/10/25 03:26:37 | 000,010,074 | ---- | M] () -- C:\Windows\System32\drivers\N360\1401010.002\VT20121008.022
[2012/10/25 03:21:05 | 000,142,496 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/25 03:21:05 | 000,007,446 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/25 03:21:05 | 000,000,806 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/10/23 19:27:26 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\Pareto UNS.job
[2012/10/18 02:40:04 | 000,001,990 | ---- | M] () -- C:\Users\Gangsterfist\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/10/08 15:22:16 | 000,409,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/11/01 20:13:06 | 000,000,286 | ---- | C] () -- C:\Windows\reimage.ini
[2012/10/29 15:27:19 | 000,001,027 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 03:16:22 | 000,001,295 | ---- | C] () -- C:\Users\Gangsterfist\Desktop\Norton Installation Files.lnk
[2012/02/16 00:48:45 | 000,007,619 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\Resmon.ResmonCfg
[2011/08/12 12:18:29 | 000,000,000 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\{1E0D2CAA-2B75-42D0-9D47-E3721985BA95}
[2011/07/28 09:27:12 | 000,000,000 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\{7DF22189-F37D-426A-8E63-FE200B71DA5F}
[2011/06/18 10:37:37 | 000,000,398 | ---- | C] () -- C:\Windows\System32\CNCMP60.INI
[2010/02/05 04:50:57 | 000,028,026 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Roaming\OFMissionEditorConfig.xml
[2010/01/04 14:34:33 | 000,009,728 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/19 21:17:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/10/06 22:38:31 | 000,029,239 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 21:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 21:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 05:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 18:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2010/07/31 10:29:19 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\AMS
[2009/10/24 15:57:10 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\DriverCure
[2009/10/24 15:57:10 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Leadertech
[2012/08/09 16:32:46 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Motorola
[2012/07/26 12:25:05 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Motorola Mobility
[2009/10/24 15:57:18 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\ParetoLogic
[2010/08/12 17:50:02 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Smith Micro
[2012/08/22 13:55:06 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Spotify
[2011/07/07 01:39:59 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Stardock
[2010/06/05 14:21:16 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\Tific
[2010/03/18 00:14:09 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\TS3Client
[2011/07/31 11:24:38 | 000,000,000 | ---D | M] -- C:\Users\Gangsterfist\AppData\Roaming\VirtualStore

========== Purity Check ==========

< End of report >

Attached Files

OTL.Txt 74.85KB 222 downloads

#2 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #2$
godawgs

Posted 02 November 2012 - 09:29 AM

Teacher

Retired Staff
8,228 posts

Hello Rob, :wave:

Welcome to the forums!
:welcome:

. My name is godawgs and I will be assisting you with your Virus / Malware issues.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic to find out how to do that.

Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
If I ask a Question just answer it, don't run anything unless directed to.

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.

I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.

When OTL runs the first time it creates a file named Extras.txt. It should be in the same directory you ran OTL from, the desktop. Please post the contents of that file.

Step-1.

Run aswMBR

Download aswMBR.exe to your desktop.
Double click the aswMBR.exe file to run it. (Windows /7 users: Right click the file and click Run as Administrator. If you get a UAC window, allow the file to run.
If it asks you if you want to download the latest virus definitions, click "No"
Click the "Scan" button to start the scan
On completion of the scan click save log. Save it to your desktop and post in your next reply.

NOTE: When you run aswMBR, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename executable to iexplore.exe and try it again.

Step-2.

Run Security Check

Download Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Step-3.

Things For Your Next Post:
1. The Extras.txt log
2. The aswMBR log
3. The Checkup.txt log

#3 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #3$
Robsthrobbinghead

Posted 02 November 2012 - 09:56 AM

New Member

Topic Starter
Member
5 posts

here are the logs.

Attached Files

aswMBR.txt 1.9KB 244 downloads
checkup.txt 1.03KB 222 downloads
Extras.Txt 48.14KB 216 downloads

Edited by Robsthrobbinghead, 02 November 2012 - 10:28 AM.

#4 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #4$
godawgs

Posted 02 November 2012 - 10:50 AM

Teacher

Retired Staff
8,228 posts

Hi Rob,

This is from my original post:

Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

I have pasted the log files below. It is easier for researching when they are copied and pasted into the post.
Please don't attach logs unless directed to do so. :thumbsup:

I will be back once I've had a chance to analyze the logs.

Thanks

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-11-02 09:00:35
-----------------------------
09:00:35.959 OS Version: Windows 6.1.7601 Service Pack 1
09:00:35.959 Number of processors: 2 586 0x1706
09:00:35.962 ComputerName: TANK UserName:
09:00:37.420 Initialize success
09:02:24.586 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
09:02:24.588 Disk 0 Vendor: WDC_WD16 11.0 Size: 152627MB BusType: 3
09:02:24.627 Disk 1 \Device\Harddisk1\SR0 -> \Device\SdBus-0
09:02:24.630 Disk 1 Vendor: ( Size: 7724MB BusType: 12
09:02:24.645 Disk 0 MBR read successfully
09:02:24.648 Disk 0 MBR scan
09:02:24.652 Disk 0 Windows 7 default MBR code
09:02:24.656 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 86 MB offset 63
09:02:24.673 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 178176
09:02:24.692 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 139739 MB offset 21149696
09:02:24.697 Disk 0 Partition - 00 0F Extended LBA 2560 MB offset 307335168
09:02:24.732 Disk 0 Partition 4 00 DD MSDOS5.0 2559 MB offset 307337216
09:02:24.739 Disk 0 scanning sectors +312578048
09:02:24.781 Disk 0 scanning C:\Windows\system32\drivers
09:02:33.100 Service scanning
09:02:54.937 Modules scanning
09:03:08.457 Disk 0 trace - called modules:
09:03:08.494 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
09:03:08.501 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8701d030]
09:03:08.508 3 CLASSPNP.SYS[8c9d359e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x862b7030]
09:03:08.516 Scan finished successfully
09:05:04.390 Disk 0 MBR has been saved successfully to "C:\Users\Gangsterfist\Desktop\MBR.dat"
09:05:04.398 The log file has been saved successfully to "C:\Users\Gangsterfist\Desktop\aswMBR.txt"

Results of screen317's Security Check version 0.99.54
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton 360 Premier Edition
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
JavaFX 2.1.1
Java 7 Update 9
Adobe Flash Player 11.4.402.287
Adobe Reader X (10.1.4)
Mozilla Firefox 15.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

OTL Extras logfile created on: 11/1/2012 8:49:00 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gangsterfist\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.02 Gb Available Physical Memory | 57.83% Memory free
6.99 Gb Paging File | 5.41 Gb Available in Paging File | 77.41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.46 Gb Total Space | 66.72 Gb Free Space | 48.89% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 9.92 Gb Free Space | 99.16% Space Free | Partition Type: NTFS
Drive F: | 7.54 Gb Total Space | 1.02 Gb Free Space | 13.58% Space Free | Partition Type: FAT32

Computer Name: TANK | User Name: Gangsterfist | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04389885-7ACA-4E5F-B939-8942F2618309}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{07CF3411-4E6C-4F43-B543-571C6D67A9B5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2EFFA18C-DE19-42A0-B034-C0EB54A1EA06}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{49148D20-BAA4-4CA8-B38E-81C331D4831F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{54F45864-3068-4FC7-AD79-238DC56C0545}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{58D11B3F-5DC4-41A6-BB85-BC1FC2991143}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6CF9001F-3370-4082-8296-E3E592D21318}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{751F4E9E-E819-4DDF-A094-BCC321E45160}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7C50CFDD-891A-4679-B9E2-19521F18F6FA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9052561E-6893-4E71-A492-2564CF742982}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0D6C733-7F90-44A3-B364-581B786693F4}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{E4E87DB5-0B9A-4BBF-B701-E47F31B681D4}" = rport=10243 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03DA7586-0D6F-4E1D-8241-58CD45C0955C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{07089761-42EA-4A25-89BC-F840E48FA4B4}" = protocol=6 | dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe |
"{07D2CF25-EF9D-427F-B411-0C61E703F82C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{121D5A4B-E20C-4027-A284-E16BCF697752}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{123C7203-8937-4B99-AF05-2B9A9EDBD7BD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{12909C91-518D-4A5A-8BA6-C94D04132E1E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{2FDA2EB3-6FD2-453C-B983-6E69B0CDED42}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4921A00D-220B-4C8B-8BF4-E96219C212ED}" = protocol=6 | dir=out | app=system |
"{513F10BC-E3B7-414D-B891-790171448B8C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{5B16ADCF-F7CE-443D-BC04-5AFC939A5AE2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{630049BD-FD5C-4F28-B0CE-40D259C3E4B1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{686A88BE-8823-46E8-9E8B-E4BF65B2AB1C}" = protocol=6 | dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe |
"{7470AA5C-B7B5-4BEC-9EB9-536B03B1A931}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{8205D329-DD25-4011-BB42-EFBA06CB3EE3}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{821E32C0-7E2F-4421-8D71-B2F2E7186BFF}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{86C9DC78-44D2-4B5F-B1E2-BC01658D661C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{991174BC-BFBA-4B52-AAB8-D6899C656A0C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A14BC324-E429-468B-89FE-44045CCFD814}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B6C8D9A5-993B-45D3-B57F-AB05823E5ECA}" = protocol=6 | dir=in | app=c:\users\gangsterfist\appdata\local\temp\7zsbf1a.tmp\symnrt.exe |
"{BC088E31-41EB-44D2-9340-8553761E4A58}" = protocol=17 | dir=in | app=c:\users\gangsterfist\appdata\local\temp\7zsbf1a.tmp\symnrt.exe |
"{C0616E1A-C949-49BE-BCBD-424077EE4748}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C115A253-F069-43D2-B9AA-76806EBA3ADA}" = protocol=17 | dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe |
"{C24024B4-E427-44D3-B137-2656BD3774C3}" = protocol=17 | dir=in | app=c:\program files\belkin\belkin usb print and storage center\connect.exe |
"{C5373270-D71E-4DDA-B36F-C5DDB8D3765A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{D79E5C14-5136-44B4-879B-83AE19897415}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{E8512BD5-BDBE-48A5-A081-9B7846103035}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EF39B850-5D0C-4198-AD1E-3332C1B509B4}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{EFCBCCDD-CB0D-4550-9E5C-E82CB6AD815B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F61FE30D-A013-4DE8-8F83-D3325E6D91F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"TCP Query User{1EB31D7D-2035-4F4A-AAE7-710B8B73F8AB}C:\users\gangsterfist\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\gangsterfist\appdata\roaming\spotify\spotify.exe |
"TCP Query User{7838956E-7C35-4078-B5BE-C4BA918A3AC9}C:\program files\netgear genie\bin\netgeargenie.exe" = protocol=6 | dir=in | app=c:\program files\netgear genie\bin\netgeargenie.exe |
"TCP Query User{B6D7257B-5A41-4B3F-B8B9-83F2AED5F857}C:\program files\netgear genie\bin\netgeargenie.exe" = protocol=6 | dir=in | app=c:\program files\netgear genie\bin\netgeargenie.exe |
"UDP Query User{6B0297D8-937E-4385-9233-C2BA348BF255}C:\users\gangsterfist\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\gangsterfist\appdata\roaming\spotify\spotify.exe |
"UDP Query User{9ADA2BD7-85D1-421B-A633-757A75E82BF9}C:\program files\netgear genie\bin\netgeargenie.exe" = protocol=17 | dir=in | app=c:\program files\netgear genie\bin\netgeargenie.exe |
"UDP Query User{F9484D14-D267-4553-9917-5148ECC349F1}C:\program files\netgear genie\bin\netgeargenie.exe" = protocol=17 | dir=in | app=c:\program files\netgear genie\bin\netgeargenie.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4010ADCB-1347-D570-FCF1-3002CABEBD2F}" = Rosetta Stone TOTALe
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612B9183-67A9-4B44-9877-2F059E35B86A}" = Broadcom 440x 10/100 Integrated Controller
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BB2EF8A-5376-4BAE-96D0-38BE49501F40}" = Rosetta Stone Ltd Services
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A1FEA5E-8DB8-AD80-5C14-AEF33D16EF5A}" = Rosetta Stone TOTALe
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AA18EE51-24A5-4748-A5E2-4B035C9A4AB2}" = Canon MP780
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CCD04643-5246-48AC-9D8C-F43A37BB8F36}" = WD Drive Manager (x86)
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{E40CE517-0D42-4198-96B4-C8232B257EB5}" = Data Lifeguard Diagnostic for Windows
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AU11_is1" = Advanced Uninstaller PRO - Version 11
"CANONIJINBOXADDON100" = Canon Inkjet Printer Driver Add-On Module
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"com.rosettastone.rosettastonetotale" = Rosetta Stone TOTALe
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360" = Norton 360 Premier Edition
"NETGEAR Genie" = NETGEAR Genie
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Reimage Repair" = Reimage Repair
"Spotify" = Spotify
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 16.0.1 (x86 en-US)" = Mozilla Firefox 16.0.1 (x86 en-US)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 3/26/2011 9:09:16 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9849996

Error - 3/26/2011 9:09:16 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9849996

Error - 3/26/2011 9:09:17 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 3/26/2011 9:09:17 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9851182

Error - 3/26/2011 9:09:17 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9851182

Error - 3/26/2011 9:09:18 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 3/26/2011 9:09:18 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9852368

Error - 3/26/2011 9:09:18 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9852368

Error - 3/26/2011 9:09:19 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 3/26/2011 9:09:19 AM | Computer Name = Tank | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9853569

[ Media Center Events ]
Error - 6/23/2010 12:04:28 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 9:04:27 AM - Failed to retrieve SportsSchedule.enc (Error: BITS 0x80080005)

Error - 6/25/2010 4:01:51 AM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 1:01:50 AM - Failed to retrieve SportsV2 (Error: Unable to connect
to the remote server)

Error - 6/26/2010 1:55:15 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 10:55:14 AM - Failed to retrieve SportsSchedule.enc (Error: BITS 0x80080005)

Error - 6/26/2010 1:57:23 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 10:57:19 AM - Failed to retrieve Broadband.enc (Error: BITS 0x80080005)

Error - 6/26/2010 2:59:39 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 11:59:38 AM - Failed to retrieve SportsSchedule.enc (Error: BITS 0x80080005)

Error - 6/26/2010 3:01:41 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 12:01:40 PM - Failed to retrieve Broadband.enc (Error: BITS 0x80080005)

Error - 6/27/2010 12:58:54 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 9:58:54 AM - Failed to retrieve MCEClientUX (Error: Unable to connect
to the remote server)

Error - 6/30/2010 5:28:46 AM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 2:28:46 AM - Failed to retrieve SportsSchedule (Error: Unable to connect
to the remote server)

Error - 7/1/2010 12:32:15 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 9:32:15 AM - Failed to retrieve SportsV2 (Error: Unable to connect
to the remote server)

Error - 7/4/2010 1:51:26 PM | Computer Name = Tank | Source = MCUpdate | ID = 0
Description = 10:51:26 AM - Failed to retrieve MCEClientUX (Error: Unable to connect
to the remote server)

[ System Events ]
Error - 10/23/2012 1:16:12 AM | Computer Name = Tank | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the N360 service.

Error - 10/23/2012 10:27:20 PM | Computer Name = Tank | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 10/25/2012 4:10:26 AM | Computer Name = Tank | Source = Service Control Manager | ID = 7024
Description = The Windows Firewall service terminated with service-specific error
%%5.

Error - 10/25/2012 4:11:04 AM | Computer Name = Tank | Source = Service Control Manager | ID = 7024
Description = The HomeGroup Listener service terminated with service-specific error
%%-2147023143.

Error - 10/25/2012 5:32:14 AM | Computer Name = Tank | Source = BTHUSB | ID = 327697
Description = The local Bluetooth adapter has failed in an undetermined manner and
will not be used. The driver has been unloaded.

Error - 10/29/2012 4:40:05 PM | Computer Name = Tank | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 10/29/2012 9:15:48 PM | Computer Name = Tank | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Error Reporting Service service to connect.

Error - 10/29/2012 9:19:34 PM | Computer Name = Tank | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Error Reporting Service service to connect.

Error - 10/29/2012 9:20:04 PM | Computer Name = Tank | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Error Reporting Service service to connect.

Error - 11/1/2012 10:02:59 PM | Computer Name = Tank | Source = Service Control Manager | ID = 7000
Description = The PunkBuster service failed to start due to the following error:
%%2

< End of report >

#5 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #5$
godawgs

Posted 02 November 2012 - 09:21 PM

Teacher

Retired Staff
8,228 posts

Hi Rob,

Let's see if this will help.

Step-1.

Posted Image

OTL Fix

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[CREATERESTOREPOINT]

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.*
O33 - MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\Shell\AutoRun\command - "" = G:\setup.exe -a
O33 - MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a
O33 - MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\Shell - "" = AutoRun
O33 - MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a

:Files
ipconfig /flushdns /c

:COMMANDS
[EMPTYTEMP]

Warning: This fix is relevant for this system and no other. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Please re-open Posted Image

on your desktop.
3. Place the mouse pointer inside the Posted Image

textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the Posted Image

button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the Posted Image

button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).

Step-2.

I want a different scan. Please read the instructions carefully as I have changed the settings.

Posted Image

OTL Scan

Please re-open OTL

Double click the on your desktop. Vista /7 users right click and click Run as Administrator. Make sure all other windows are closed .
You will see a console like the one below:
At the top of the console, click the box beside Scan All Users<---Important
Do Not click the box beside Include 64bit Scans
Make sure the Output box at the top is set to Standard Output.
Click the button. Do not change any settings unless otherwise told to do so.
Let the scan run uninterrupted.
When the scan completes, it will open OTL.Txt. This file is saved in the same location as OTL.
Please copy the contents of this file and paste it into your reply. To do that:
On the .txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
Right-click inside the forum post window then click Paste.This will paste the contents of the .txt file in the in the post window.

Step-3.

Run RogueKiller

Download RogueKiller and save it on your desktop.

NOTE: If using IE8 or better Smartscreen Filter will need to be disabled
Quit all programs
Start RogueKiller.exe.
Wait until Prescan has finished ...
Click on Scan

Wait for the end of the scan.
The report has been created on the desktop.

Please post:

All RKreport.txt text files located on your desktop.
NOTE: If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com)
and try again

Step-4.

Things For Your Next Post:
1. The OTL fixes log
2. The new OTL.txt log
3. The RKreport.txt log
4. Do you still have PunkBuster installed on the computer?

#6 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #6$
Robsthrobbinghead

Posted 03 November 2012 - 02:05 AM

New Member

Topic Starter
Member
5 posts

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a73e332-0aab-11e1-9539-001fe1f00394}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2a73e332-0aab-11e1-9539-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2a73e332-0aab-11e1-9539-001fe1f00394}\ not found.
File G:\setup.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{308927da-6c81-11df-a932-001fe1f00394}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{308927da-6c81-11df-a932-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{308927da-6c81-11df-a932-001fe1f00394}\ not found.
File F:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6ee21e7-d689-11e1-93c2-001fe1f00394}\ not found.
File G:\MotoCastSetup.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb5925b5-916f-11e1-ba2e-001fe1f00394}\ not found.
File G:\MotoCastSetup.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\MotoCastSetup.exe -a not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Gangsterfist\Desktop\cmd.bat deleted successfully.
C:\Users\Gangsterfist\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Gangsterfist
->Temp folder emptied: 1877372 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 38202575 bytes
->Flash cache emptied: 506 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 38.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 11032012_020750

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

OTL logfile created on: 11/3/2012 2:23:45 AM - Run 4
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gangsterfist\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.50 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 63.72% Memory free
6.99 Gb Paging File | 5.66 Gb Available in Paging File | 80.98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.46 Gb Total Space | 65.21 Gb Free Space | 47.79% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 9.92 Gb Free Space | 99.16% Space Free | Partition Type: NTFS
Drive F: | 7.54 Gb Total Space | 1.02 Gb Free Space | 13.58% Space Free | Partition Type: FAT32

Computer Name: TANK | User Name: Gangsterfist | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/11/01 20:33:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
PRC - [2012/10/10 19:29:13 | 000,143,928 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\ccsvchst.exe
PRC - [2012/09/29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/07/27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/07/09 18:49:22 | 000,195,400 | ---- | M] (NETGEAR) -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe
PRC - [2012/06/14 20:42:42 | 001,040,712 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe
PRC - [2012/06/14 20:42:42 | 000,122,696 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\genie2_tray.exe
PRC - [2011/03/31 19:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe
PRC - [2011/02/24 22:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 05:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/11/19 12:26:54 | 000,455,944 | ---- | M] () -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
PRC - [2008/07/24 15:22:50 | 000,102,400 | ---- | M] (WDC) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
PRC - [2008/02/12 13:19:52 | 001,624,616 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008/02/12 13:19:52 | 000,723,496 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2007/09/20 14:31:10 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEstSrv.exe
PRC - [2007/09/13 14:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/09/13 14:44:48 | 000,405,504 | ---- | M] (IDT, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe

========== Modules (No Company Name) ==========

MOD - [2012/07/26 02:44:38 | 000,915,968 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Ui.dll
MOD - [2012/07/26 02:29:22 | 008,299,520 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Resource.dll
MOD - [2012/07/25 03:42:54 | 001,084,416 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_RouterConfiguration.dll
MOD - [2012/07/25 03:42:54 | 000,088,064 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QRCode.dll
MOD - [2012/07/25 01:00:54 | 001,132,032 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_ParentalControl.dll
MOD - [2012/07/24 22:48:48 | 001,550,848 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\SvtNetworkTool.dll
MOD - [2012/07/24 22:48:48 | 000,412,160 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\Genie.dll
MOD - [2012/07/24 20:45:52 | 000,433,152 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Wireless.dll
MOD - [2012/07/23 00:36:52 | 000,499,200 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_NetworkProblem.dll
MOD - [2012/07/23 00:36:52 | 000,186,368 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DragonNetTool.dll
MOD - [2012/07/23 00:25:50 | 000,641,536 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Statistics.dll
MOD - [2012/07/23 00:21:28 | 000,701,440 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\InnerPlugin_Update.dll
MOD - [2012/07/23 00:08:36 | 001,567,744 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Map.dll
MOD - [2012/07/23 00:08:36 | 000,083,968 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NetcardApi.dll
MOD - [2012/07/23 00:08:36 | 000,082,432 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\SVTUtils.dll
MOD - [2012/07/12 00:24:18 | 001,061,376 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Internet.dll
MOD - [2012/07/12 00:24:18 | 000,150,528 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DiagnoseDll.dll
MOD - [2012/07/12 00:24:18 | 000,136,704 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\DiagnosePlugin.dll
MOD - [2012/07/11 23:51:54 | 000,504,832 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\InnerPlugin_WirelessExport.dll
MOD - [2012/07/11 23:51:54 | 000,116,224 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\WSetupApiPlugin.dll
MOD - [2012/07/11 23:51:54 | 000,076,288 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\WSetupDll.dll
MOD - [2012/07/11 22:23:24 | 000,231,424 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\GeniePlugin_Airprint.dll
MOD - [2012/07/11 22:23:24 | 000,138,752 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\airprintdll.dll
MOD - [2012/06/14 20:42:42 | 001,040,712 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe
MOD - [2012/06/14 20:42:42 | 000,122,696 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\genie2_tray.exe
MOD - [2012/05/30 07:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\wincfi39.dll
MOD - [2012/05/10 23:24:16 | 009,814,016 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtGui4.dll
MOD - [2012/05/10 23:24:16 | 002,537,472 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtCore4.dll
MOD - [2012/05/10 23:24:16 | 001,140,224 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtNetwork4.dll
MOD - [2012/05/10 23:24:16 | 000,399,360 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\QtXml4.dll
MOD - [2012/05/10 23:24:16 | 000,287,232 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qjpeg4.dll
MOD - [2012/05/10 23:24:16 | 000,083,456 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qico4.dll
MOD - [2012/05/10 23:24:16 | 000,083,456 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\imageformats\qgif4.dll
MOD - [2012/05/09 19:34:06 | 000,043,008 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\libgcc_s_dw2-1.dll
MOD - [2012/05/09 19:34:06 | 000,011,362 | ---- | M] () -- C:\Program Files\NETGEAR Genie\bin\mingwm10.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2010/10/20 15:45:26 | 008,801,120 | ---- | M] () -- C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2009/08/16 17:06:02 | 000,141,312 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

========== Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Electronic Arts\Medal of Honor -- (PnkBstrA)
SRV - [2012/11/03 02:06:15 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/10/10 19:29:13 | 000,143,928 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\ccSvcHst.exe -- (N360)
SRV - [2012/10/08 17:05:15 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/09/29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/07/27 13:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/09 18:49:22 | 000,195,400 | ---- | M] (NETGEAR) [Auto | Running] -- C:\Program Files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe -- (NETGEARGenieDaemon)
SRV - [2011/12/22 12:14:13 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/06/12 11:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/03/31 19:19:44 | 001,646,056 | ---- | M] (Rosetta Stone Ltd.) [Auto | Running] -- C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe -- (RosettaStoneDaemon)
SRV - [2010/02/25 01:13:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/11/19 12:26:54 | 000,455,944 | ---- | M] () [Auto | Running] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2009/07/13 18:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 18:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/07/24 15:22:50 | 000,102,400 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe -- (WDBtnMgrSvc.exe)
SRV - [2007/09/20 14:31:10 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/09/13 14:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\sxuptp.sys -- (sxuptp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motusbdevice.sys -- (motusbdevice)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Motousbnet.sys -- (Motousbnet)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motswch.sys -- (MotoSwitchService)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motmodem.sys -- (motmodem)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgpfl.sys -- (motccgpfl)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motccgp.sys -- (motccgp)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\motoandroid.sys -- (motandroidusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\GANGST~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys -- (cpuz134)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\motfilt.sys -- (BTCFilterService)
DRV - [2012/11/01 19:38:30 | 001,601,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\VirusDefs\20121102.021\NAVEX15.SYS -- (NAVEX15)
DRV - [2012/11/01 19:38:30 | 000,092,704 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\VirusDefs\20121102.021\NAVENG.SYS -- (NAVENG)
DRV - [2012/10/27 02:37:32 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\IPSDefs\20121102.001\IDSvix86.sys -- (IDSVix86)
DRV - [2012/10/25 03:21:05 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012/10/08 18:00:02 | 000,586,400 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\N360\1402000.013\srtsp.sys -- (SRTSP)
DRV - [2012/10/05 11:23:26 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\Definitions\BASHDefs\20121005.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012/10/03 18:40:35 | 000,927,904 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\N360\1402000.013\symefa.sys -- (SymEFA)
DRV - [2012/10/03 18:40:20 | 000,368,288 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\N360\1402000.013\symds.sys -- (SymDS)
DRV - [2012/10/03 18:19:14 | 000,134,304 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1402000.013\ccsetx86.sys -- (ccSet_N360)
DRV - [2012/09/29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/09/06 19:05:14 | 000,338,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1402000.013\symnets.sys -- (SymNetS)
DRV - [2012/09/06 18:48:08 | 000,175,264 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1402000.013\ironx86.sys -- (SymIRON)
DRV - [2012/08/21 15:58:38 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2012/08/09 13:54:50 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012/08/09 13:54:50 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012/05/24 22:36:55 | 000,032,888 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\N360\1402000.013\srtspx.sys -- (SRTSPX)
DRV - [2011/04/07 23:13:34 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2010/11/20 03:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 02:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/04/16 21:24:34 | 000,022,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2010/04/14 01:01:48 | 000,045,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2009/11/20 19:34:54 | 011,515,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/10/16 20:12:02 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2009/07/13 15:02:49 | 000,046,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2009/05/28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2009/04/30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI)
DRV - [2008/07/26 15:26:22 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008/07/26 15:25:48 | 000,627,864 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008/07/26 15:22:22 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2007/10/17 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/09/26 08:12:00 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32)
DRV - [2007/09/13 14:46:06 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/01/11 19:15:16 | 000,032,528 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2007/01/11 19:15:06 | 000,032,272 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2006/11/14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/12/22 17:02:22 | 000,051,840 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/11/16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 67 F2 A1 27 92 94 CA 01 [binary data]
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-265609418-1587851376-3897255400-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: [email protected]:3.0.2
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\coFFPlgn\ [2012/11/03 02:11:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.1.2\IPSFFPlgn\ [2012/10/25 03:30:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/11/03 02:06:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/11/03 02:06:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/11/03 02:06:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/11/03 02:06:13 | 000,000,000 | ---D | M]

[2011/07/06 11:52:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Extensions
[2012/10/22 23:12:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions
[2010/04/28 05:21:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/08/23 15:33:33 | 000,070,902 | ---- | M] () (No name found) -- C:\Users\Gangsterfist\AppData\Roaming\Mozilla\Firefox\Profiles\lmeczjb8.default\extensions\[email protected]
[2012/11/03 02:06:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/11/03 02:06:15 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/09/14 03:18:22 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/10/11 21:48:53 | 000,002,058 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/09/18 14:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\20.2.0.19\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\S-1-5-21-265609418-1587851376-3897255400-1000..\Run: [NETGEARGenie] C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2DDEBFCA-067B-40D2-80AA-C2639A7E322F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32C3E899-DA6A-4BD9-8BB6-9B40508352E3}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/11/03 02:06:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/11/03 01:48:46 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/11/03 00:15:42 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/11/02 09:00:11 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Gangsterfist\Desktop\aswMBR.exe
[2012/11/01 20:32:51 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
[2012/10/29 15:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/29 15:27:13 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/10/29 15:27:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/10/29 14:23:39 | 000,000,000 | ---D | C] -- C:\Users\Gangsterfist\AppData\Roaming\Malwarebytes
[2012/10/29 14:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/10/21 23:09:47 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012/10/21 23:09:47 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012/10/21 23:09:47 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012/10/11 16:14:37 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012/10/11 16:13:44 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2012/10/11 16:13:44 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012/10/11 16:13:44 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/10/11 16:13:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/11 16:13:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/11 16:13:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/10/11 16:13:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/10/11 16:13:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/10/11 16:13:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/11 16:13:43 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/10/11 16:13:43 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/11 16:13:43 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/10/11 16:13:43 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/11 16:13:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/10/11 16:13:43 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/10/11 16:13:18 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/10/11 16:13:18 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

========== Files - Modified Within 30 Days ==========

[2012/11/03 02:19:43 | 000,001,990 | ---- | M] () -- C:\Users\Gangsterfist\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/11/03 02:17:14 | 000,009,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/11/03 02:17:14 | 000,009,728 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/11/03 02:16:43 | 000,624,206 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/11/03 02:16:43 | 000,106,550 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/11/03 02:09:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/11/03 02:09:16 | 2817,032,192 | -HS- | M] () -- C:\hiberfil.sys
[2012/11/03 02:05:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/03 00:44:35 | 001,584,640 | ---- | M] () -- C:\Users\Gangsterfist\Desktop\RogueKiller.exe
[2012/11/03 00:18:06 | 001,627,694 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\Cat.DB
[2012/11/02 23:56:59 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2012/11/02 09:05:57 | 000,881,833 | ---- | M] () -- C:\Users\Gangsterfist\Desktop\SecurityCheck.exe
[2012/11/02 09:00:23 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Gangsterfist\Desktop\aswMBR.exe
[2012/11/01 20:33:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gangsterfist\Desktop\OTL.exe
[2012/11/01 20:13:23 | 000,000,286 | ---- | M] () -- C:\Windows\reimage.ini
[2012/10/29 15:27:19 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 03:28:37 | 000,001,295 | ---- | M] () -- C:\Users\Gangsterfist\Desktop\Norton Installation Files.lnk
[2012/10/25 03:21:05 | 000,142,496 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT.SYS
[2012/10/25 03:21:05 | 000,007,446 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.CAT
[2012/10/25 03:21:05 | 000,000,806 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT.INF
[2012/10/23 19:27:26 | 000,000,420 | ---- | M] () -- C:\Windows\tasks\Pareto UNS.job
[2012/10/19 05:25:45 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\isolate.ini
[2012/10/10 19:25:22 | 000,007,597 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\srtspx.cat
[2012/10/10 19:25:22 | 000,007,593 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\srtsp.cat
[2012/10/10 19:25:22 | 000,001,387 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\srtspx.inf
[2012/10/08 18:52:50 | 000,007,593 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\symds.cat
[2012/10/08 18:52:47 | 000,007,599 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\symefa.cat
[2012/10/08 18:00:02 | 000,586,400 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\N360\1402000.013\srtsp.sys
[2012/10/08 18:00:02 | 000,001,388 | ---- | M] () -- C:\Windows\System32\drivers\N360\1402000.013\srtsp.inf
[2012/10/08 17:05:14 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/10/08 17:05:14 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/10/08 15:22:16 | 000,409,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/11/03 00:44:34 | 001,584,640 | ---- | C] () -- C:\Users\Gangsterfist\Desktop\RogueKiller.exe
[2012/11/02 09:05:56 | 000,881,833 | ---- | C] () -- C:\Users\Gangsterfist\Desktop\SecurityCheck.exe
[2012/11/01 20:13:06 | 000,000,286 | ---- | C] () -- C:\Windows\reimage.ini
[2012/10/29 15:27:19 | 000,001,027 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/10/25 03:16:22 | 000,001,295 | ---- | C] () -- C:\Users\Gangsterfist\Desktop\Norton Installation Files.lnk
[2012/02/16 00:48:45 | 000,007,619 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\Resmon.ResmonCfg
[2011/08/12 12:18:29 | 000,000,000 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\{1E0D2CAA-2B75-42D0-9D47-E3721985BA95}
[2011/07/28 09:27:12 | 000,000,000 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\{7DF22189-F37D-426A-8E63-FE200B71DA5F}
[2011/06/18 10:37:37 | 000,000,398 | ---- | C] () -- C:\Windows\System32\CNCMP60.INI
[2010/02/05 04:50:57 | 000,028,026 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Roaming\OFMissionEditorConfig.xml
[2010/01/04 14:34:33 | 000,009,728 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/19 21:17:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/10/06 22:38:31 | 000,029,239 | ---- | C] () -- C:\Users\Gangsterfist\AppData\Roaming\UserTile.png

========== ZeroAccess Check ==========

[2009/07/13 21:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 21:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 05:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/13 18:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >

RogueKiller V8.2.1 [10/29/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Website: http://tigzy.geeksto...roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Gangsterfist [Admin rights]
Mode : Scan -- Date : 11/03/2012 02:32:14

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
SSDT[13] : NtAlertResumeThread @ 0x83120C99 -> HOOKED (Unknown @ 0x8737D6F0)
SSDT[14] : NtAlertThread @ 0x83073BE0 -> HOOKED (Unknown @ 0x8737D7D0)
SSDT[19] : NtAllocateVirtualMemory @ 0x8306CBEC -> HOOKED (Unknown @ 0x8622C488)
SSDT[22] : NtAlpcConnectPort @ 0x830B844E -> HOOKED (Unknown @ 0x872FB6C0)
SSDT[43] : NtAssignProcessToJobObject @ 0x83041FEE -> HOOKED (Unknown @ 0x87381AA8)
SSDT[74] : NtCreateMutant @ 0x830532B2 -> HOOKED (Unknown @ 0x8737D440)
SSDT[86] : NtCreateSymbolicLinkObject @ 0x83044911 -> HOOKED (Unknown @ 0x873817C8)
SSDT[87] : NtCreateThread @ 0x8311EECA -> HOOKED (Unknown @ 0x8622C8D0)
SSDT[88] : NtCreateThreadEx @ 0x830B336B -> HOOKED (Unknown @ 0x873818B8)
SSDT[96] : NtDebugActiveProcess @ 0x830F0D9A -> HOOKED (Unknown @ 0x87381B88)
SSDT[111] : NtDuplicateObject @ 0x8307467A -> HOOKED (Unknown @ 0x8622C618)
SSDT[131] : NtFreeVirtualMemory @ 0x82EFAAEC -> HOOKED (Unknown @ 0x862CF9B0)
SSDT[145] : NtImpersonateAnonymousToken @ 0x830388E0 -> HOOKED (Unknown @ 0x8737D530)
SSDT[147] : NtImpersonateThread @ 0x830BC84C -> HOOKED (Unknown @ 0x8737D610)
SSDT[155] : NtLoadDriver @ 0x83008C20 -> HOOKED (Unknown @ 0x872DCF20)
SSDT[168] : NtMapViewOfSection @ 0x83089532 -> HOOKED (Unknown @ 0x862CF8B0)
SSDT[177] : NtOpenEvent @ 0x83052CAE -> HOOKED (Unknown @ 0x87381F70)
SSDT[190] : NtOpenProcess @ 0x83054AF8 -> HOOKED (Unknown @ 0x8622C7B8)
SSDT[191] : NtOpenProcessToken @ 0x830A723F -> HOOKED (Unknown @ 0x8622C558)
SSDT[194] : NtOpenSection @ 0x830AC8BB -> HOOKED (Unknown @ 0x87381DB0)
SSDT[198] : NtOpenThread @ 0x830A0FC3 -> HOOKED (Unknown @ 0x8622C6E8)
SSDT[215] : NtProtectVirtualMemory @ 0x830855A1 -> HOOKED (Unknown @ 0x873819B8)
SSDT[304] : NtResumeThread @ 0x830B3592 -> HOOKED (Unknown @ 0x8737D8B0)
SSDT[316] : NtSetContextThread @ 0x83120745 -> HOOKED (Unknown @ 0x8737DB50)
SSDT[333] : NtSetInformationProcess @ 0x8307B78D -> HOOKED (Unknown @ 0x862CF6E0)
SSDT[350] : NtSetSystemInformation @ 0x8309129A -> HOOKED (Unknown @ 0x87381C68)
SSDT[366] : NtSuspendProcess @ 0x83120BD3 -> HOOKED (Unknown @ 0x87381E90)
SSDT[367] : NtSuspendThread @ 0x830D8085 -> HOOKED (Unknown @ 0x8737D990)
SSDT[370] : NtTerminateProcess @ 0x8309DBFB -> HOOKED (Unknown @ 0x8736AC80)
SSDT[371] : unknown @ 0x830BB584 -> HOOKED (Unknown @ 0x8737DA70)
SSDT[385] : NtUnmapViewOfSection @ 0x830A787A -> HOOKED (Unknown @ 0x862CF7D0)
SSDT[399] : NtWriteVirtualMemory @ 0x830A2958 -> HOOKED (Unknown @ 0x862CFAA0)
S_SSDT[318] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x893E2780)
S_SSDT[402] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x893E2530)
S_SSDT[434] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x893E2470)
S_SSDT[436] : NtUserGetKeyState -> HOOKED (Unknown @ 0x893E25F0)
S_SSDT[448] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x893E26B0)
S_SSDT[490] : NtUserMessageCall -> HOOKED (Unknown @ 0x893E2200)
S_SSDT[508] : NtUserPostMessage -> HOOKED (Unknown @ 0x893E23A0)
S_SSDT[509] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x893E22D0)
S_SSDT[585] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x893E2840)
S_SSDT[588] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x893E2910)

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1600BEVT-75ZCT0 +++++
--- User ---
[MBR] 80040a1e01ebef2e5503bcf4c13b5b4b
[BSP] 87e0a6daa1b8373506d23575f609403c : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 86 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 178176 | Size: 10240 Mo
2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21149696 | Size: 139739 Mo
3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 307335168 | Size: 2560 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: SD Memory Card +++++
--- User ---
[MBR] 07e7fb4c79af0e00f14bbad71773474b
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 8192 | Size: 7720 Mo
Error reading LL1 MBR!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt

Cant seem to find punkbuster

Edited by Robsthrobbinghead, 03 November 2012 - 03:39 AM.

#7 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #7$
godawgs

Posted 03 November 2012 - 08:29 AM

Teacher

Retired Staff
8,228 posts

Hello,

The OTL log is clean. We will clean up the punkbuster service the next time we run OTL.

Step-1.

Posted Image

Malwarebytes' Anti-Malware

Please run MalwareBytes (Right click the icon on the desktop and click Run as Administrator).
You will now be at the main program as shown below.
Click the Update tab and update the program if required.
On the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer.
MBAM will now start scanning your computer for malware. This process can take quite a while, so I suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
When the scan is finished a message box will appear as shown in the image below.

You should click on the OK button to close the message box and continue with the removal process.
You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
Make sure that everything is checked, and click Remove Selected.<---Very Important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step-2.

Run ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista / 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Uncheck the box beside Remove Found Threats
Make sure that the option Scan archives is checked.
Now click on Advanced Settings and select the following:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically. The scan may take several hours.
Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.

When The Scan is Complete:

If No Threats Were Found:
- Put a checkmark in "Uninstall application on close"
- Close the program
- Report to me that nothing was found
If Threats Were Found:
- Click on "list of threats found"
- Click on "export to text file" and save it to the desktop as ESET SCAN.txt
- Click on Back
- Put a checkmark in "Uninstall application on close" (Be sure you have saved the file first)
- Click on Finish
- Close the program
- Copy and paste the report here

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Step-3

Things For Your Next Post:
1. The MalwareBytes log
2. The ESET log if it found anything.
3.Tell me what issues, if any, remain on the computer.

#8 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #8$
Robsthrobbinghead

Posted 04 November 2012 - 03:00 AM

New Member

Topic Starter
Member
5 posts

Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.11.03.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Gangsterfist :: TANK [administrator]

Protection: Enabled

11/3/2012 12:01:43 PM
mbam-log-2012-11-03 (12-01-43).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 386195
Time elapsed: 1 hour(s), 45 minute(s), 58 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
eset didn't find anything.

ran advanced uninstaller and it still finds C:\Users\Gangsterfist\AppData\Local\Temp\FXSAPIDebugLogFile.txt in my temp file cleaner section and will not let me delete it. should i not worry about it or is this thing just super tough to find?

#9 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #9$
godawgs

Posted 04 November 2012 - 11:32 AM

Teacher

Retired Staff
8,228 posts

Hi,

The C:\Users\Gangsterfist\AppData\Local\Temp\FXSAPIDebugLogFile.txt file is most likely related to the Windows Fax/Print service and is in use by the system and that's why you can't delete it. Certain files are created each time the system runs or are used by the system and thus can't be deleted. It looks like it is the debug log for the fxsapi.dll file which is part of the Windows print/fax capablity.

Your log(s) appear to be clean! If you have no further issues with your computer, please proceed with the housekeeping procedures outlined below.
The first thing we need to do is to remove all the tools that we have used. This is so that should you ever be re-infected, you will download updated versions.

Step-1.

Update Fifefox

Your Firefox is out of date.

At the top of the Firefox window click the Firefox button.
Go over to the Help menu and select About Firefox.
The About Firefox window will open and Firefox will begin checking for updates. If updates are available, they will begin downloading automatically.
When the updates are downloaded and ready to be installed, click Apply Update. Firefox will be restarted and the updates will be installed.

Step-2.

If you didn't uninstall ESET when you ran it we will do so now.

1. Please click the Start Orb, click Control Panel. Under the Programs heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

ESET

3. Click on each program to highlight it and click Change/Remove. (Vista/7 users: right click the program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Progam Files\ESET

2. Close Windows Explorer.

Step-3.

OTL Cleanup
1. Please copy all of the text in the Quote box below (Do Not copy the word Quote). To do this, highlight everything inside the Quote box (except the word Quote), right click and click Copy.

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Electronic Arts\Medal of Honor -- (PnkBstrA)

:COMMANDS
[EMPTYTEMP]
Please re-open on your desktop.
Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
Click the button.
Let the program run unhindered. When finished click the OK button and close the log that appears.
NOTE: I do not need to review the log produced.
OTL may ask to reboot the machine. Please do so if asked.

2. Please re-open Posted Image

on your desktop.

Be sure all other programs are closed as this step will require a reboot.
Click the button.
You will be prompted to reboot your system. Please do so.

The above process will remove most/all of the tools used and logs created during the cleanup process. After it is finished, OTL will remove itself. This is so that if you are ever infected again you will download the most current copy of the tool.

Step-4.

Delete the following Files / Folders

SecurityCheck.exe
Checkup.txt
MBR.dat

Delete any other .bat, .log, .reg, .txt, and any other files created during this process, and left on the desktop and empty the Recycle Bin.

Step-5.

Make a Fresh Restore Point, Clear the Old Restore Points, and Re-enable System Restore

The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected, but that's good news).

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

For Vista and Windows 7:

Click the Start Orb. Click Control Panel. Click System and Maintenance
Click System
In the left column under Tasks, click Advance System Settings and accept the warning if you get one
Click the System Protection Tab
In the Available Disks box put a ckeck mark in the box next to OS (?:) (System). Your drive letter will be shown in place of the ?

Note: It may take some time for the system to populate the Available Disks box, so be patient.
Click the Create button at the bottom
Type in a name fo the restore point, i.e: Clean
Click Create
A small System Protection window will come up telling you a Restore Point is being created.
Another System Protection window will come up telling you the Restore Point has been created, click OK
Click OK again.
Close the Control Panel

Now we can purge the old Restore Points

Click Start(Windows 7 Orb), click Run (or press the Windows key and R together) to bring up the Run box.
Copy and Paste the following in the Run box:
```
cleanmgr
```
Click OK
A Disk Cleanup Options popup will open
Click Files from all users on this computer

A Drive Selection popup will open
NOTE: You will not see this window unless you have more than one drive or partition on your computer.

If you chose Files from all users on this computer above, then click on Continue for UAC prompt.
Select the system drive, C:\ and click OK.
For a few moments the system will make some calculations
The Disk Cleanup Window will open:
Click the More Options tab.
Click the Clean up button under the System Restore and Shadow Copies section. (See screenshot below)
In the Disk Cleanup dialog box, click Delete (See screenshot below).
You will get a Disk Cleanup confirmation (See screenshot below)
Click Delete Files, and then click OK.

Step-6.

Reset Hidden Files and Folders

For Vista and Windows 7
1. Click Start,click Control Panel.
2. Click Folder Options.... NOTE: If you are in the Category view, click Appearance, then Folder Options
3. On the Folder Options window click the View tab.
4. In the Advanced settings: box, Under Hidden files and folders, click the Do not show hidden files and folders button.
5. Click the Hide protected operating system files (Recommended) box.
6. Click Apply and then OK

Preventing Re-Infection

Below, I have included a number of recommendations for how to protect your computer against future malware infections.

:Keep Windows Updated:-Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.

Vista and Windows 7 Users:
1. Click Start> All Programs, from the list find Windows Update and click it.

:Turn On Automatic Updates:

Vista and Windows 7
1. Click Start> Control Panel. Click Security. Under Windows Update, Click Turn automatic on or off.
2. On the next page, under Important Updates, Click the Drop down arrow on the right side of the box and Click Install Updates Automatically(recommended).
If you click this setting, click to select the day and time for scheduled updates to occur. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. After you set this option, Windows recognizes when you are online and uses your Internet connection to find updates on the Windows Update Web site or on the Microsoft Update Web site that apply to your computer. Updates are downloaded automatically in the background, and you are not notified or interrupted during this process. An icon appears in the notification area of your task bar when the updates are being downloaded. You can point to the icon to view the download status. To pause or to resume the download, right-click the icon, and then click Pause or Resume. When the download is completed, another message appears in the notification area so that you can review the updates that are scheduled for installation. If you choose not to install at that time, Windows starts the installation on your set schedule.

: Keep Java Updated :

Click the Start button
Click Control Panel
Double Click Java - Looks like a coffee cup. You may have to switch to Classical View on the upper left of the Control Panel to see it.
Click the Update tab
Click Update Now
Allow any updates to be downloaded and installed

: Keep Adobe Reader Updated :

Open Adobe Reader
Click Help on the menu at the top
Click Check for Updates
Allow any updates to be downloaded and installed

NOTE: Whether you use Adobe Reader, Acrobat or Foxit Reader to read pdf files you need to disable Javascript in the program. There is an exploit out there now that can use it to get on your PC. For Adobe Reader: Click Start, All Programs, Adobe Reader, Edit, Preferences, Click on Javascript in the left column and uncheck Enable Acrobat Javascript. Click OK Close program. It's the same for Foxit Reader except Preferences is under the Tools menu, and you uncheck Enable Javascript Actions.

:Web Browsers:

:Make your Internet Explorer more secure:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to "Prompt"
6. Change the Download unsigned ActiveX controls to "Disable"
7. Change the Initialise and script ActiveX controls not marked as safe to "Disable"
8. Change the Installation of desktop items to "Prompt"
9. Change the Launching programs and files in an IFRAME to "Prompt"
10. When all these settings have been made, click on the OK button.
11. If it prompts you as to whether or not you want to save the settings, click the Yes button.
12. Next press the Apply button and then the OK to exit the Internet Properties page.

:Alternate Browsers:

If you use Firefox, I highly recommend these add-ons to keep your PC even more secure.

NoScript - for blocking ads and other potential website attacks
WebOfTrust - a safe surfing tool for your browser. Traffic-light rating symbols show which websites you can trust when you search, shop and surf on the Web.
McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling

:Install the MVPs Hosts File: (Only needed for Firefox)

MVPS Hosts file-replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

Preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running a full scan at least once a month. Run Quick Scans at least once a week. Download the Free versions. And update the definitions before running scans.

========Anti Spyware========

Malwarebytes-Free Version- a powerful tool to search for and eliminate malware found on your computer.
SUPERAntiSpyware Free Edition-another scanning tool to find and eliminate malware.
SpywareBlaster-to help prevent spyware from installing in the first place. A tutorial can be found here.
SpywareGuard-to catch and block spyware before it can execute. A tutorial can be found here.
WinPatrol - will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. Help file and tutorial can be found here.

It's a good idea to clear out all your temp files every now and again. This will help your computer from bogging down and slowing. It also can assist in getting rid of files that may contain malicious code that could re-infect your computer.

========TEMP File Cleaners========

TFC by OldTimer-A very powerful cleaning program for 32 and 64 bit OS. Note: You may have this already as part of the fixes you have run.
CleanUP-Click the Download CleanUP! link. There is also a Learn how to use CleanUP! link on this page.

:BACKUPS:

Keep a backup of your important files.-Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT-(Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

:Keep Installed Programs Up to Date:

It is also possible for other programs on your computer to have security vulnerability that can allow malware to infect you. Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
Download and install the program and run it monthly:
Filehippo Update Checker

Finally, please read How did I Get Infected in the First Place(by Mr. Tony Klein and dvk01)

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

I Will Keep This Open For 24 hours or so. If Anything Comes Up - Just Come Back And Let Me Know

Stay Safe :wave:

godawgs

#10 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #10$
Robsthrobbinghead

Posted 05 November 2012 - 02:28 PM

New Member

Topic Starter
Member
5 posts

Thanks again for the help. Been doing some reading and will install the software you suggested. You have Serious patience.thanks again.

#11 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #11$
godawgs

Posted 05 November 2012 - 03:32 PM

Teacher

Retired Staff
8,228 posts

You're welcome.

If you need us again just give us a shout.

#12 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #12$
godawgs

Posted 05 November 2012 - 06:23 PM

Teacher

Retired Staff
8,228 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

As Featured On:

Geeks to Go Forum 343,327 topics
Quick Links FAQ Malware Cleaning Guide How it Works
Downloads 2+ million

View New Content

\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved

#1 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #1$
Robsthrobbinghead

Posted 01 November 2012 - 11:01 PM

Attached Files

Advertisements

#2 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #2$
godawgs

Posted 02 November 2012 - 09:29 AM

#3 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #3$
Robsthrobbinghead

Posted 02 November 2012 - 09:56 AM

Attached Files

#4 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #4$
godawgs

Posted 02 November 2012 - 10:50 AM

#5 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #5$
godawgs

Posted 02 November 2012 - 09:21 PM

#6 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #6$
Robsthrobbinghead

Posted 03 November 2012 - 02:05 AM

#7 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #7$
godawgs

Posted 03 November 2012 - 08:29 AM

#8 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #8$
Robsthrobbinghead

Posted 04 November 2012 - 03:00 AM

#9 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #9$
godawgs

Posted 04 November 2012 - 11:32 AM

#10 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #10$
Robsthrobbinghead

Posted 05 November 2012 - 02:28 PM

#11 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #11$
godawgs

Posted 05 November 2012 - 03:32 PM

#12 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #12$
godawgs

Posted 05 November 2012 - 06:23 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved

#1 Robsthrobbinghead Posted 01 November 2012 - 11:01 PM

Attached Files

Advertisements

#2 godawgs Posted 02 November 2012 - 09:29 AM

#3 Robsthrobbinghead Posted 02 November 2012 - 09:56 AM

Attached Files

#4 godawgs Posted 02 November 2012 - 10:50 AM

#5 godawgs Posted 02 November 2012 - 09:21 PM

#6 Robsthrobbinghead Posted 03 November 2012 - 02:05 AM

#7 godawgs Posted 03 November 2012 - 08:29 AM

#8 Robsthrobbinghead Posted 04 November 2012 - 03:00 AM

#9 godawgs Posted 04 November 2012 - 11:32 AM

#10 Robsthrobbinghead Posted 05 November 2012 - 02:28 PM

#11 godawgs Posted 05 November 2012 - 03:32 PM

#12 godawgs Posted 05 November 2012 - 06:23 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#1 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #1$
Robsthrobbinghead

Posted 01 November 2012 - 11:01 PM

#2 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #2$
godawgs

Posted 02 November 2012 - 09:29 AM

#3 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #3$
Robsthrobbinghead

Posted 02 November 2012 - 09:56 AM

#4 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #4$
godawgs

Posted 02 November 2012 - 10:50 AM

#5 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #5$
godawgs

Posted 02 November 2012 - 09:21 PM

#6 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #6$
Robsthrobbinghead

Posted 03 November 2012 - 02:05 AM

#7 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #7$
godawgs

Posted 03 November 2012 - 08:29 AM

#8 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #8$
Robsthrobbinghead

Posted 04 November 2012 - 03:00 AM

#9 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #9$
godawgs

Posted 04 November 2012 - 11:32 AM

#10 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #10$
Robsthrobbinghead

Posted 05 November 2012 - 02:28 PM

#11 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #11$
godawgs

Posted 05 November 2012 - 03:32 PM

#12 $\AppData\Local\Temp\FXSAPIDebugLogFile.txt [Solved: post #12$
godawgs

Posted 05 November 2012 - 06:23 PM