[Jesse596994]

Over the past while I've noticed that programs as well as games on my computer don't run as quickly/smoothly as they used to. In the case of games I've noticed the proformance that the computer runs the game is droping. In the case of programs I've noticed that they tend to start up slower. I am unsure how it is that I got the infection but I have downloaded Avast 2013 and AVG Pc Tuneup and have run scans and they seemed to have helped a little.

OTL Extras logfile created on: 28/01/2013 8:10:15 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jesse\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

5.68 Gb Total Physical Memory | 4.20 Gb Available Physical Memory | 73.97% Memory free
11.36 Gb Paging File | 9.60 Gb Available in Paging File | 84.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 386.27 Gb Free Space | 82.95% Space Free | Partition Type: NTFS

Computer Name: JESSE-PC | User Name: Jesse | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08C3B8F1-EBD5-4F44-816F-8B1F366AC3A0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0A204E87-251C-41D6-9A38-503BF153D1C8}" = rport=139 | protocol=6 | dir=out | app=system |
"{0F33CE09-71EA-4832-8541-808C0F40C540}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1531EF5C-DAFF-468F-BA88-92BDC72E474F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2B97F43D-1C89-4623-A0A9-0036CE0469F9}" = lport=9100 | protocol=6 | dir=in | name=advanced tcp/ip printer port |
"{3322E4B9-0FE4-4812-871C-06430343563D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3CC5670C-72EA-4ED1-95CE-38D9BA3F5424}" = lport=139 | protocol=6 | dir=in | app=system |
"{4B064DC7-6066-4347-9A58-E6A606846328}" = rport=445 | protocol=6 | dir=out | app=system |
"{4B21324B-3D83-4560-B9AA-5915D6B848FD}" = lport=137 | protocol=17 | dir=in | app=system |
"{5E9BBD10-E893-4E61-BB34-09EA943A03D0}" = lport=427 | protocol=6 | dir=in | name=advanced tcp/ip slp port |
"{6A81AFB4-5836-4AFD-97B5-477595BA6C74}" = rport=137 | protocol=17 | dir=out | app=system |
"{74E7778C-DC9B-4B78-9A62-EA95ADB7D9D1}" = rport=138 | protocol=17 | dir=out | app=system |
"{7EB15E33-9BCB-4DFE-B156-F99E897206CC}" = lport=445 | protocol=6 | dir=in | app=system |
"{8200255A-67E1-4243-91DB-AFB29C4CDD4F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{86E95B95-5D8C-4966-8A3B-5693A244BBFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{89B93459-4A20-48C5-93B4-CF811E3995D3}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9F3E9F17-E333-45A1-94D1-9FB3BA3422FB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A8A36AFC-49DA-407E-AC26-EF85CE31C500}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B3415B1C-6647-4F8D-9C03-5DECCAADCF79}" = lport=161 | protocol=6 | dir=in | name=advanced tcp/ip snmp port |
"{BC1C283D-08B1-4C74-BEA8-1193953DF0AF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C6BD8DD5-2E7E-4AE8-ACD8-F4A13FDDAAF4}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D1BEBC0F-47BE-48AE-B3E3-0E56DE5A74DB}" = lport=138 | protocol=17 | dir=in | app=system |
"{E8197D3E-FD83-47B8-94EE-FDF73236FA1B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F9C3AAA9-E369-4770-8607-8CD30CD381FC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C120A4A-99E4-4984-8FA3-3ED53331FF3F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0EB64060-CEC9-488D-8C38-E55BC0744100}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{107B09EE-101D-47FE-B526-1485AF9C65F7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1B5AC0F8-B768-445E-8142-65A2A292514B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{31FFCD99-1D58-420A-A223-71EE0BA944C9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{424983EA-6A6F-4DAC-B9CF-CD5AE7753FAC}" = protocol=6 | dir=out | app=system |
"{4C271CFA-0104-4B9D-A311-54E4FD8B4CC2}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\starcraft ii beta.exe |
"{539B2523-CB94-444E-A7FF-A37011B4FA47}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{5495517E-47D7-4855-9FDF-852038157126}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{625ACFF6-B1DB-4CC3-B5BD-7FB6F46454BD}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{6360A3F3-5128-4BE6-BF3E-5D2CE91F2CD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{684A1336-FF3D-4810-BBE7-DFE8C6A741F5}" = protocol=6 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"{6EFBCECE-2DCA-42BA-8A57-B02605AE8FA1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{75C2EDFA-F439-4765-8553-3ACAC2322EC1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{76547537-B5CC-4422-BA8A-BBFA3A3E19AD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{777F55FA-B272-4EE5-93CC-618A3B1C6DDC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7B07AA6C-AFA1-4736-8CE3-074838C57210}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8A3B7F59-A38C-483F-9D23-19A8D2825D58}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8A6A1B4A-F7B8-40DF-8575-3042A539C1F3}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{8EE8443E-9FB3-4F83-95DD-227A1B1483EA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{8FC21996-25C7-434F-9A38-094BEF391002}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{936605B0-DA7F-4FA4-BC5B-12909643E2D0}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{97A61334-32F7-45B8-A292-5AE76F3326D1}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{97DB635F-DFA0-4BB1-B3E6-615D910E6484}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{99512500-CD47-4183-9F98-169B5346CD5D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{9A9642C9-1DB9-4B5E-BAEA-731B60EAD7A0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9CAB8EFF-875B-4D3D-AECF-E8EE9230CFCB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{A232D332-7C91-4879-9F36-886CAA6D1480}" = protocol=1 | dir=in | [email protected],-28543 |
"{A9907A56-F09D-44DB-BE02-F58D7DB25A43}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{ADC0CD78-415F-40F0-A442-87892884B916}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{B03F568B-FAA6-4ECD-876A-B92E6755D6CC}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{B19F929C-535C-4A9A-B8D9-FEF37B59C726}" = protocol=58 | dir=in | [email protected],-28545 |
"{B9D502A8-FEC5-4121-BB32-6DD3D92AB157}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{BE6980DD-2098-428C-ADED-3BA6041E8B52}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C386F336-699B-4787-8859-96D113D8963D}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{CEA01947-F356-4962-951C-52B97791CB11}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{CEBB8AB4-E749-4998-B274-852F622E03CA}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{CECB6695-FA0C-4F6E-9EDB-F8C52A13665F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D8EA46AF-FFFE-44BC-A2C1-DFB4EE94E2FA}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\starcraft ii beta.exe |
"{DB83394B-2C20-419D-8397-AD5821D90F51}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{DC0A5C0E-F6C7-451A-A178-804D9819C3AF}" = protocol=1 | dir=out | [email protected],-28544 |
"{DDDE0B7F-9FD6-4827-9512-EB01407EBADE}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E32CECCA-CF84-4870-9689-29DDB182B399}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{E6BA4859-F46F-4713-8720-416871124983}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{EF7189DE-D782-4B01-B505-406EAE303B14}" = protocol=58 | dir=out | [email protected],-28546 |
"{F10D622A-B2E0-4090-B8FE-B70E10348B22}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F375685A-50C9-4D19-9E75-A368682BE701}" = protocol=17 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"{F39D1814-ADF7-435B-A60A-C1D1A08878A6}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{FC26FA57-D31F-43F4-9143-2238C16DA943}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"TCP Query User{3256EA3A-BC25-4737-9779-38A0E6672A84}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"TCP Query User{49133C27-4788-41BF-95EF-99C8E9A15B6A}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"TCP Query User{68AAB9B4-3D53-4E34-A98B-8B58C0B540A2}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"TCP Query User{91956681-3867-444D-82DD-267CCCFDAF12}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{9FDF8DD7-A3DC-48AE-BC2C-600B639A73F9}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{AA5B1B7F-09C6-49E5-948C-36767A963C2F}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{B9AA0B52-2867-499F-B995-19450B90456F}C:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{C2F896F0-392E-4A13-8604-EE47266E184B}C:\program files (x86)\starcraft ii\versions\base22612\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"TCP Query User{D08D96B3-E9B4-4E1A-89FA-AC8684E62020}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{264F5A10-EBC0-48CA-883D-F6C8E79293FE}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"UDP Query User{60026B8F-53BE-4639-8DA0-5C8FB438327B}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{649F4E4F-204B-4CEF-9A14-BE5E92BD1EB8}C:\program files (x86)\starcraft ii\versions\base22612\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"UDP Query User{8A853426-8E0D-412C-8C32-EEEB2D162298}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{8B0B3758-2DA4-42D0-A810-01BF7ACC0A03}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{944882E9-1F2B-4C2E-87AD-474C45B628FD}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{C8BE1000-2528-4B81-8FE0-4D610671F461}C:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{E5EE62A4-455E-40AF-9256-BAD3373C738A}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"UDP Query User{ED5DFF36-19C4-4DFC-85FA-615F1D8821F0}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{502275B0-3DA3-44D8-8702-066525CAAE98}" = AVG 2013
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{BFAB7835-55A2-41CD-AE66-F673BCA4E49F}" = AVG 2013
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AVG" = AVG 2013
"CCleaner" = CCleaner
"HP LaserJet Professional P1100-P1560-P1600 Series" = HP LaserJet Professional P1100-P1560-P1600 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 37
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.01)
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}" = AVG PC TuneUp
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FB03A941-815E-42F2-B604-FCE5636DB90B}" = AVG PC TuneUp Language Pack (en-US)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AVG PC TuneUp" = AVG PC TuneUp
"Diablo III" = Diablo III
"Guild Wars 2" = Guild Wars 2
"KLiteCodecPack_is1" = K-Lite Codec Pack 9.0.2 (Full)
"StarCraft II" = StarCraft II
"StarCraft II Beta" = StarCraft II Beta

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 26/01/2013 3:27:50 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 26/01/2013 9:05:59 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 683643

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 683643

Error - 28/01/2013 2:47:13 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 2:56:42 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 3:34:50 AM | Computer Name = Jesse-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16457 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 129c Start
Time: 01cdfd28d2a39e86 Termination Time: 20 Application Path: C:\Program Files (x86)\Internet
Explorer\iexplore.exe Report Id:

Error - 28/01/2013 7:20:31 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 9:29:08 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 28/01/2013 5:07:55 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 5:07:55 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 5:10:39 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 7:02:10 AM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 7:20:38 AM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 4:33:25 PM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 8:57:51 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 9:28:01 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 9:28:10 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 11:35:25 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7034
Description = The Adobe Acrobat Update Service service terminated unexpectedly.
It has done this 1 time(s).


< End of report >

[Advertisements]

Hello Jesse596994 and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Run OTL again.

• Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator"). Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan/Fixes box paste this in
  
  

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them here for me.

Step 2

Download GMER from Here. Note the file\'s name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• OTL log
• OTL Extras log
• GMER log

It would be helpful if you could post each log in separate post using "Add Reply" button

[maliprog]

Hello Jesse596994 and welcome to my office here at G2G!

My nick is maliprog and I'll be your technical support on this issue. Before we start please read my notes carefully:

NOTES:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted. Order is crucial in cleaning process.
• Please DO NOT run any scans or fix on your own without my direction.
• Please read all of my response through at least once before attempting to follow the procedures described.
• If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste it to include the log in your reply.
• You must reply within 3 days or your topic will be closed

Step 1

Run OTL again.

• Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator"). Make sure all other windows are closed and to let it run uninterrupted.
  
• Under the Custom Scan/Fixes box paste this in
  
  

  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them here for me.

Step 2

Download GMER from Here. Note the file\'s name and save it to your root folder, such as C:.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

Step 3

Please don't forget to include these items in your reply:

• OTL log
• OTL Extras log
• GMER log

It would be helpful if you could post each log in separate post using "Add Reply" button

[Jesse596994]

OTL Log

OTL logfile created on: 29/01/2013 12:34:10 AM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jesse\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

5.68 Gb Total Physical Memory | 4.20 Gb Available Physical Memory | 73.97% Memory free
11.36 Gb Paging File | 9.63 Gb Available in Paging File | 84.85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 386.14 Gb Free Space | 82.92% Space Free | Partition Type: NTFS

Computer Name: JESSE-PC | User Name: Jesse | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/01/28 20:09:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jesse\Desktop\OTL.exe
PRC - [2013/01/20 11:29:18 | 028,539,272 | ---- | M] (Dropbox, Inc.) -- C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013/01/08 22:43:16 | 000,699,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe
PRC - [2012/12/11 03:52:44 | 003,147,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2012/11/15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2012/10/22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe


========== Modules (No Company Name) ==========


========== Services (SafeList) ==========

SRV:64bit: - [2010/04/07 05:04:24 | 000,127,800 | ---- | M] (HP) [Auto | Running] -- C:\Windows\SysNative\HPSIsvc.exe -- (HPSIService)
SRV:64bit: - [2009/07/13 17:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/08 23:42:20 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/18 11:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/11/15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/10/22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012/08/23 11:31:24 | 002,148,216 | ---- | M] (AVG) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 13:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/11/15 23:33:24 | 000,111,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2012/10/22 13:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2012/10/15 03:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2012/10/02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2012/09/28 10:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/09/21 03:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012/09/21 03:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2012/09/14 03:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2012/08/21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/04/09 16:27:34 | 000,352,144 | ---- | M] (EldoS Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cbfs3.sys -- (cbfs3)
DRV:64bit: - [2012/03/26 13:50:12 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2012/02/29 22:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/01/10 21:28:18 | 012,311,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/07/01 06:08:04 | 004,745,280 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2011/03/10 22:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/10 22:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 19:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 19:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 19:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/02/04 22:20:26 | 000,015,360 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HP8207_8307.sys -- (HP8207_8307)
DRV:64bit: - [2009/09/17 18:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009/08/13 22:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/07/13 17:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 17:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 17:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 12:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 12:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 12:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 12:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2012/07/04 15:26:12 | 000,011,880 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
DRV - [2009/07/13 17:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?l...en-ca&OCID=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-CA
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9F DE 60 09 AE 66 CD 01 [binary data]
IE - HKCU\..\URLSearchHook: {3bbd3c14-4c16-4989-8366-95bc9179779d} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{46FBE829-7336-4A17-9D7C-10CC52A64E80}: "URL" = http://websearch.ask...BB-C6B3118A3A97
IE - HKCU\..\SearchScopes\{CACA2EC9-0D7E-4E33-857E-ADFC43134A56}: "URL" = http://search.condui...&ctid=CT3244149
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jesse\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jesse\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)



========== Chrome ==========

CHR - homepage: http://www.google.ca/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: http://www.google.ca/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Jesse\AppData\Local\Google\Chrome\Application\24.0.1312.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Jesse\AppData\Local\Google\Chrome\Application\24.0.1312.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jesse\AppData\Local\Google\Chrome\Application\24.0.1312.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Jesse\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.1.0.10441_0\npSkypeChromePlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 6 U33 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.3 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1165635.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: Browse2save = C:\Users\Jesse\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpncbdjhkmhegjcapjgccmpmeedoebkg\3.8_0\

O1 HOSTS File: ([2009/06/10 13:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3BBD3C14-4C16-4989-8366-95BC9179779D} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - Startup: C:\Users\Jesse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} http://content.syste...yri_4.5.1.0.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0ACDB3C2-DCF4-454D-9B91-8CFE5D21E752}: DhcpNameServer = 10.253.175.25 10.253.176.25 10.253.176.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6D01FB54-9971-41A0-8337-D773709E957F}: DhcpNameServer = 209.91.107.11 209.121.225.11
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0CC53DC-956C-42C1-AF3B-88F1FA9D3D04}: DhcpNameServer = 192.168.1.254 75.153.176.9
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f1714951-d526-11e1-b807-dc611baae979}\Shell - "" = AutoRun
O33 - MountPoints2\{f1714951-d526-11e1-b807-dc611baae979}\Shell\AutoRun\command - "" = F:\SISetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/01/28 20:09:43 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jesse\Desktop\OTL.exe
[2013/01/28 03:00:36 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/01/27 23:18:24 | 000,035,192 | ---- | C] (AVG) -- C:\Windows\SysNative\TURegOpt.exe
[2013/01/27 23:18:24 | 000,026,488 | ---- | C] (AVG) -- C:\Windows\SysNative\authuitu.dll
[2013/01/27 23:18:23 | 000,021,880 | ---- | C] (AVG) -- C:\Windows\SysWow64\authuitu.dll
[2013/01/27 23:18:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp
[2013/01/27 23:17:38 | 000,000,000 | ---D | C] -- C:\Users\Jesse\AppData\Roaming\AVG
[2013/01/27 23:17:06 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG
[2013/01/27 23:17:02 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2013/01/27 23:04:49 | 000,000,000 | ---D | C] -- C:\Users\Jesse\AppData\Roaming\AVG2013
[2013/01/27 23:03:33 | 000,000,000 | ---D | C] -- C:\Users\Jesse\AppData\Roaming\TuneUp Software
[2013/01/27 23:03:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/01/27 23:03:01 | 000,000,000 | -H-D | C] -- C:\$AVG
[2013/01/27 23:03:00 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2013/01/27 23:02:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2013/01/27 22:58:03 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013/01/27 22:58:03 | 000,000,000 | ---D | C] -- C:\Users\Jesse\AppData\Local\MFAData
[2013/01/27 22:58:03 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2013/01/27 22:58:03 | 000,000,000 | ---D | C] -- C:\Users\Jesse\AppData\Local\Avg2013
[2013/01/27 22:57:52 | 004,427,928 | ---- | C] (AVG Technologies) -- C:\Users\Jesse\Desktop\avg_avct_stb_all_2013_2890_ppc2.exe
[2013/01/25 00:16:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/01/29 00:15:00 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/28 23:41:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/28 23:38:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-751553567-4272825986-115282455-1000UA.job
[2013/01/28 22:38:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-751553567-4272825986-115282455-1000Core.job
[2013/01/28 20:09:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jesse\Desktop\OTL.exe
[2013/01/28 17:35:21 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 17:35:21 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/28 17:32:33 | 000,778,834 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/01/28 17:32:33 | 000,664,780 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/01/28 17:32:33 | 000,125,484 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/01/28 17:32:12 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/28 17:27:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/01/28 17:27:36 | 277,905,407 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/27 23:18:15 | 000,002,225 | ---- | M] () -- C:\Users\Public\Desktop\AVG 1-Click Maintenance.lnk
[2013/01/27 23:18:15 | 000,002,177 | ---- | M] () -- C:\Users\Public\Desktop\AVG PC TuneUp.lnk
[2013/01/27 23:03:33 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/01/27 22:57:59 | 004,427,928 | ---- | M] (AVG Technologies) -- C:\Users\Jesse\Desktop\avg_avct_stb_all_2013_2890_ppc2.exe
[2013/01/27 22:54:15 | 000,026,400 | ---- | M] () -- C:\ProgramData\1359356038.3416.bin
[2013/01/27 22:54:15 | 000,002,051 | ---- | M] () -- C:\ProgramData\1359356038.220.bin
[2013/01/27 22:54:15 | 000,000,420 | ---- | M] () -- C:\ProgramData\1359356038.3908.bin
[2013/01/27 22:53:04 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/01/27 22:52:22 | 000,028,879 | ---- | M] () -- C:\ProgramData\1359355921.bdinstall.bin
[2013/01/26 11:28:59 | 000,001,049 | ---- | M] () -- C:\Users\Jesse\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/01/26 11:28:38 | 000,001,017 | ---- | M] () -- C:\Users\Jesse\Desktop\Dropbox.lnk
[2013/01/25 00:17:13 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/18 01:31:30 | 000,664,434 | ---- | M] () -- C:\Users\Jesse\Desktop\starcraft-2-logo1[1].jpg
[2013/01/13 15:20:24 | 000,058,622 | ---- | M] () -- C:\Users\Jesse\Desktop\Diablo_Glowei009c[1].jpg
[2013/01/13 15:09:40 | 000,494,010 | ---- | M] () -- C:\Users\Jesse\Desktop\Diablo-III-Box-Art[1].jpg
[2013/01/09 19:29:43 | 000,275,712 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/01/09 11:16:48 | 000,764,746 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/01/27 23:18:15 | 000,002,225 | ---- | C] () -- C:\Users\Public\Desktop\AVG 1-Click Maintenance.lnk
[2013/01/27 23:18:15 | 000,002,177 | ---- | C] () -- C:\Users\Public\Desktop\AVG PC TuneUp.lnk
[2013/01/27 23:18:14 | 000,002,189 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp.lnk
[2013/01/27 23:03:33 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/01/27 22:54:15 | 000,000,420 | ---- | C] () -- C:\ProgramData\1359356038.3908.bin
[2013/01/27 22:54:00 | 000,002,051 | ---- | C] () -- C:\ProgramData\1359356038.220.bin
[2013/01/27 22:53:58 | 000,026,400 | ---- | C] () -- C:\ProgramData\1359356038.3416.bin
[2013/01/27 22:52:22 | 000,028,879 | ---- | C] () -- C:\ProgramData\1359355921.bdinstall.bin
[2013/01/25 00:17:13 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/01/25 00:17:13 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/01/18 01:31:43 | 000,664,434 | ---- | C] () -- C:\Users\Jesse\Desktop\starcraft-2-logo1[1].jpg
[2013/01/13 15:09:57 | 000,494,010 | ---- | C] () -- C:\Users\Jesse\Desktop\Diablo-III-Box-Art[1].jpg
[2013/01/13 15:05:18 | 000,058,622 | ---- | C] () -- C:\Users\Jesse\Desktop\Diablo_Glowei009c[1].jpg
[2012/10/12 23:13:30 | 000,000,046 | ---- | C] () -- C:\Users\Jesse\jagex_cl_loginapplet_LIVE.dat
[2012/10/12 23:13:30 | 000,000,001 | ---- | C] () -- C:\Users\Jesse\random.dat
[2012/07/20 11:36:00 | 000,764,746 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/07/20 11:35:45 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2012/01/10 21:27:26 | 000,867,020 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2012/01/10 21:27:26 | 000,128,204 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2012/01/10 21:27:26 | 000,105,608 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2012/01/10 20:29:54 | 013,904,384 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll

========== ZeroAccess Check ==========

[2009/07/13 20:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 21:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 20:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 17:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 19:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 17:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/12/26 18:30:47 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\.Epubor
[2013/01/27 23:17:38 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\AVG
[2013/01/27 23:04:49 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\AVG2013
[2012/12/03 12:47:32 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\calibre
[2012/11/11 11:04:31 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\Downloaded Installations
[2013/01/29 00:24:37 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\Dropbox
[2013/01/29 00:28:38 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\TS3Client
[2013/01/27 23:03:33 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\TuneUp Software
[2012/09/17 16:30:33 | 000,000,000 | ---D | M] -- C:\Users\Jesse\AppData\Roaming\Utherverse

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/02/25 21:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/24 22:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/24 22:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/25 22:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 19:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/24 21:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/24 21:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 19:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/13 17:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\SysNative\services.exe
[2009/07/13 17:39:37 | 000,328,704 | ---- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/13 17:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009/07/13 17:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/13 17:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009/07/13 17:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 19:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 19:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 19:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/20 19:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 19:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/20 19:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe

< %systemroot%\*. /mp /s >

< End of report >

[Jesse596994]

OTL Extras Log

OTL Extras logfile created on: 28/01/2013 8:10:15 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jesse\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

5.68 Gb Total Physical Memory | 4.20 Gb Available Physical Memory | 73.97% Memory free
11.36 Gb Paging File | 9.60 Gb Available in Paging File | 84.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.66 Gb Total Space | 386.27 Gb Free Space | 82.95% Space Free | Partition Type: NTFS

Computer Name: JESSE-PC | User Name: Jesse | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08C3B8F1-EBD5-4F44-816F-8B1F366AC3A0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0A204E87-251C-41D6-9A38-503BF153D1C8}" = rport=139 | protocol=6 | dir=out | app=system |
"{0F33CE09-71EA-4832-8541-808C0F40C540}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1531EF5C-DAFF-468F-BA88-92BDC72E474F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2B97F43D-1C89-4623-A0A9-0036CE0469F9}" = lport=9100 | protocol=6 | dir=in | name=advanced tcp/ip printer port |
"{3322E4B9-0FE4-4812-871C-06430343563D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3CC5670C-72EA-4ED1-95CE-38D9BA3F5424}" = lport=139 | protocol=6 | dir=in | app=system |
"{4B064DC7-6066-4347-9A58-E6A606846328}" = rport=445 | protocol=6 | dir=out | app=system |
"{4B21324B-3D83-4560-B9AA-5915D6B848FD}" = lport=137 | protocol=17 | dir=in | app=system |
"{5E9BBD10-E893-4E61-BB34-09EA943A03D0}" = lport=427 | protocol=6 | dir=in | name=advanced tcp/ip slp port |
"{6A81AFB4-5836-4AFD-97B5-477595BA6C74}" = rport=137 | protocol=17 | dir=out | app=system |
"{74E7778C-DC9B-4B78-9A62-EA95ADB7D9D1}" = rport=138 | protocol=17 | dir=out | app=system |
"{7EB15E33-9BCB-4DFE-B156-F99E897206CC}" = lport=445 | protocol=6 | dir=in | app=system |
"{8200255A-67E1-4243-91DB-AFB29C4CDD4F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{86E95B95-5D8C-4966-8A3B-5693A244BBFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{89B93459-4A20-48C5-93B4-CF811E3995D3}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9F3E9F17-E333-45A1-94D1-9FB3BA3422FB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A8A36AFC-49DA-407E-AC26-EF85CE31C500}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B3415B1C-6647-4F8D-9C03-5DECCAADCF79}" = lport=161 | protocol=6 | dir=in | name=advanced tcp/ip snmp port |
"{BC1C283D-08B1-4C74-BEA8-1193953DF0AF}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C6BD8DD5-2E7E-4AE8-ACD8-F4A13FDDAAF4}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D1BEBC0F-47BE-48AE-B3E3-0E56DE5A74DB}" = lport=138 | protocol=17 | dir=in | app=system |
"{E8197D3E-FD83-47B8-94EE-FDF73236FA1B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F9C3AAA9-E369-4770-8607-8CD30CD381FC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C120A4A-99E4-4984-8FA3-3ED53331FF3F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0EB64060-CEC9-488D-8C38-E55BC0744100}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{107B09EE-101D-47FE-B526-1485AF9C65F7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1B5AC0F8-B768-445E-8142-65A2A292514B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{31FFCD99-1D58-420A-A223-71EE0BA944C9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{424983EA-6A6F-4DAC-B9CF-CD5AE7753FAC}" = protocol=6 | dir=out | app=system |
"{4C271CFA-0104-4B9D-A311-54E4FD8B4CC2}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\starcraft ii beta.exe |
"{539B2523-CB94-444E-A7FF-A37011B4FA47}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{5495517E-47D7-4855-9FDF-852038157126}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{625ACFF6-B1DB-4CC3-B5BD-7FB6F46454BD}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{6360A3F3-5128-4BE6-BF3E-5D2CE91F2CD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{684A1336-FF3D-4810-BBE7-DFE8C6A741F5}" = protocol=6 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"{6EFBCECE-2DCA-42BA-8A57-B02605AE8FA1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{75C2EDFA-F439-4765-8553-3ACAC2322EC1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{76547537-B5CC-4422-BA8A-BBFA3A3E19AD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{777F55FA-B272-4EE5-93CC-618A3B1C6DDC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7B07AA6C-AFA1-4736-8CE3-074838C57210}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8A3B7F59-A38C-483F-9D23-19A8D2825D58}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8A6A1B4A-F7B8-40DF-8575-3042A539C1F3}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{8EE8443E-9FB3-4F83-95DD-227A1B1483EA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{8FC21996-25C7-434F-9A38-094BEF391002}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{936605B0-DA7F-4FA4-BC5B-12909643E2D0}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{97A61334-32F7-45B8-A292-5AE76F3326D1}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{97DB635F-DFA0-4BB1-B3E6-615D910E6484}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{99512500-CD47-4183-9F98-169B5346CD5D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{9A9642C9-1DB9-4B5E-BAEA-731B60EAD7A0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9CAB8EFF-875B-4D3D-AECF-E8EE9230CFCB}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{A232D332-7C91-4879-9F36-886CAA6D1480}" = protocol=1 | dir=in | [email protected],-28543 |
"{A9907A56-F09D-44DB-BE02-F58D7DB25A43}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{ADC0CD78-415F-40F0-A442-87892884B916}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{B03F568B-FAA6-4ECD-876A-B92E6755D6CC}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{B19F929C-535C-4A9A-B8D9-FEF37B59C726}" = protocol=58 | dir=in | [email protected],-28545 |
"{B9D502A8-FEC5-4121-BB32-6DD3D92AB157}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{BE6980DD-2098-428C-ADED-3BA6041E8B52}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C386F336-699B-4787-8859-96D113D8963D}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{CEA01947-F356-4962-951C-52B97791CB11}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{CEBB8AB4-E749-4998-B274-852F622E03CA}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{CECB6695-FA0C-4F6E-9EDB-F8C52A13665F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D8EA46AF-FFFE-44BC-A2C1-DFB4EE94E2FA}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\starcraft ii beta.exe |
"{DB83394B-2C20-419D-8397-AD5821D90F51}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{DC0A5C0E-F6C7-451A-A178-804D9819C3AF}" = protocol=1 | dir=out | [email protected],-28544 |
"{DDDE0B7F-9FD6-4827-9512-EB01407EBADE}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E32CECCA-CF84-4870-9689-29DDB182B399}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{E6BA4859-F46F-4713-8720-416871124983}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{EF7189DE-D782-4B01-B505-406EAE303B14}" = protocol=58 | dir=out | [email protected],-28546 |
"{F10D622A-B2E0-4090-B8FE-B70E10348B22}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F375685A-50C9-4D19-9E75-A368682BE701}" = protocol=17 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"{F39D1814-ADF7-435B-A60A-C1D1A08878A6}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{FC26FA57-D31F-43F4-9143-2238C16DA943}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"TCP Query User{3256EA3A-BC25-4737-9779-38A0E6672A84}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"TCP Query User{49133C27-4788-41BF-95EF-99C8E9A15B6A}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"TCP Query User{68AAB9B4-3D53-4E34-A98B-8B58C0B540A2}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"TCP Query User{91956681-3867-444D-82DD-267CCCFDAF12}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{9FDF8DD7-A3DC-48AE-BC2C-600B639A73F9}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{AA5B1B7F-09C6-49E5-948C-36767A963C2F}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{B9AA0B52-2867-499F-B995-19450B90456F}C:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{C2F896F0-392E-4A13-8604-EE47266E184B}C:\program files (x86)\starcraft ii\versions\base22612\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"TCP Query User{D08D96B3-E9B4-4E1A-89FA-AC8684E62020}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{264F5A10-EBC0-48CA-883D-F6C8E79293FE}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"UDP Query User{60026B8F-53BE-4639-8DA0-5C8FB438327B}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{649F4E4F-204B-4CEF-9A14-BE5E92BD1EB8}C:\program files (x86)\starcraft ii\versions\base22612\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base22612\sc2.exe |
"UDP Query User{8A853426-8E0D-412C-8C32-EEEB2D162298}C:\program files (x86)\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{8B0B3758-2DA4-42D0-A810-01BF7ACC0A03}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{944882E9-1F2B-4C2E-87AD-474C45B628FD}C:\program files (x86)\guild wars 2\gw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\guild wars 2\gw2.exe |
"UDP Query User{C8BE1000-2528-4B81-8FE0-4D610671F461}C:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\jesse\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{E5EE62A4-455E-40AF-9256-BAD3373C738A}C:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii 2012 beta\versions\base24764\sc2.exe |
"UDP Query User{ED5DFF36-19C4-4DFC-85FA-615F1D8821F0}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{502275B0-3DA3-44D8-8702-066525CAAE98}" = AVG 2013
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{BFAB7835-55A2-41CD-AE66-F673BCA4E49F}" = AVG 2013
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AVG" = AVG 2013
"CCleaner" = CCleaner
"HP LaserJet Professional P1100-P1560-P1600 Series" = HP LaserJet Professional P1100-P1560-P1600 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.20 (64-bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java™ 6 Update 37
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.01)
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}" = AVG PC TuneUp
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FB03A941-815E-42F2-B604-FCE5636DB90B}" = AVG PC TuneUp Language Pack (en-US)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AVG PC TuneUp" = AVG PC TuneUp
"Diablo III" = Diablo III
"Guild Wars 2" = Guild Wars 2
"KLiteCodecPack_is1" = K-Lite Codec Pack 9.0.2 (Full)
"StarCraft II" = StarCraft II
"StarCraft II Beta" = StarCraft II Beta

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 26/01/2013 3:27:50 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 26/01/2013 9:05:59 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 683643

Error - 26/01/2013 10:51:44 PM | Computer Name = Jesse-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 683643

Error - 28/01/2013 2:47:13 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 2:56:42 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 3:34:50 AM | Computer Name = Jesse-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16457 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 129c Start
Time: 01cdfd28d2a39e86 Termination Time: 20 Application Path: C:\Program Files (x86)\Internet
Explorer\iexplore.exe Report Id:

Error - 28/01/2013 7:20:31 AM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

Error - 28/01/2013 9:29:08 PM | Computer Name = Jesse-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 28/01/2013 5:07:55 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 5:07:55 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 5:10:39 AM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 7:02:10 AM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 7:20:38 AM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 4:33:25 PM | Computer Name = Jesse-PC | Source = Schannel | ID = 36887
Description = The following fatal alert was received: 80.

Error - 28/01/2013 8:57:51 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 9:28:01 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 9:28:10 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
error: %%5

Error - 28/01/2013 11:35:25 PM | Computer Name = Jesse-PC | Source = Service Control Manager | ID = 7034
Description = The Adobe Acrobat Update Service service terminated unexpectedly.
It has done this 1 time(s).


< End of report >

[Jesse596994]

GMER Log

GMER 2.0.18454 - http://www.gmer.net
Rootkit scan 2013-01-29 01:09:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000BPVT-00HXZT3 rev.01.01A01 465.76GB
Running: p9zbbeiv.exe; Driver: C:\Users\Jesse\AppData\Local\Temp\ugloypoc.sys


---- User code sections - GMER 2.0 ----

.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075211401 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075211419 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075211431 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007521144a 2 bytes [21, 75]
.text ... * 9
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000752114dd 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000752114f5 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007521150d 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075211525 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007521153d 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075211555 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007521156d 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075211585 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007521159d 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000752115b5 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000752115cd 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000752116b2 2 bytes [21, 75]
.text C:\Users\Jesse\AppData\Roaming\Dropbox\bin\Dropbox.exe[3824] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000752116bd 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075211401 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075211419 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075211431 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007521144a 2 bytes [21, 75]
.text ... * 9
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000752114dd 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000752114f5 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007521150d 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075211525 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007521153d 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075211555 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007521156d 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075211585 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007521159d 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000752115b5 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000752115cd 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000752116b2 2 bytes [21, 75]
.text C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_5_502_146_ActiveX.exe[4724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000752116bd 2 bytes [21, 75]

---- EOF - GMER 2.0 ----

[maliprog]

Hi Jesse596994,

Step 1

Download the adwCleaner

• Run the Tool
  (Windows Vista and Windows 7 users: right click in the adwCleaner.exe and select the Run as Administrator option)
• Select the Delete button.
• When the scan completes, it will open a notepad windows.
• Please, copy the content of this file in your next reply.

Step 2

Download and run Puran Disc Defragmenter
Click on Boot Time Defrag button and choose Restart-Defrag-Restart + Check Disk



Step 3

Please don't forget to include these items in your reply:

• adwCleaner log

It would be helpful if you could post each log in separate post using "Add Reply" button

[Jesse596994]

# AdwCleaner v2.109 - Logfile created 01/29/2013 at 11:30:39
# Updated 26/01/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Jesse - JESSE-PC
# Boot Mode : Normal
# Running from : C:\Users\Jesse\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\END
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Browse2save
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Jesse\AppData\Local\Conduit
Folder Deleted : C:\Users\Jesse\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\Jesse\AppData\LocalLow\Browse2save
Folder Deleted : C:\Users\Jesse\AppData\LocalLow\Conduit

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Key Deleted : HKLM\SOFTWARE\Tarma Installer

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Google Chrome v24.0.1312.56

File : C:\Users\Jesse\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [318 octets] - [29/01/2013 11:30:08]
AdwCleaner[S2].txt - [5362 octets] - [29/01/2013 11:30:39]

########## EOF - C:\AdwCleaner[S2].txt - [5422 octets] ##########

[maliprog]

Hi Jesse596994,

Did you run Puran Disc Defragmenter? How is your system now? Any changes?

[Jesse596994]

I ran the defrag, nothing has changed.

[maliprog]

Please click on Start and then type in search box msconfig and press Enter.
Now click on Startups
Then uncheck everything and press Apply button.
Restart your system now
IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.

If system boots correctly and is running smoothly and faster then we have a startup problem
Try going back into msconfig and check one item and reboot
Keep doing that till you have found the problem or all are finally checked.
Post back with the results

[Jesse596994]

Ok so I unchecked everything and then rebooted. Doing so didn't change the speed in which the comp started up. I then checked everything one at a time rebooting after each check and still the speed in which the comp starting up didn't change. I looked at my task manager just now and there are ten scvhost's. Hmm now AVG PC TuneUp poped up telling me "Your system start up took too long!"

[maliprog]

Let's try services and see if there is anything that we could fix.

Please click on Start and then type in search box msconfig and press Enter.
Type in msconfig and press Enter
Now click on Services
Click on the Hide All Microsoft Services
Then uncheck everything and press Apply button.
Restart your system now

If system boots correctly and is running smoothly and faster then we have a startup problem
Try going back into msconfig and check one item and reboot
Keep doing that till you have found the problem or all are finally checked.
Post back with the results

[Jesse596994]

there is still no difference in start up speed.

[maliprog]

Let's do antivirus scan to see if anything is hiding from us.

Download Virus Removal Tool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right



Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan


Allow Virus Removal Tool to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threads report from the left and press Save button
Save it to your desktop and attach to your next post

[Jesse596994]

So there were no deleted threats. So what does all this mean? My computer is fine but runs slowly?