[JustTrevor]

So a good buddy of mine let me borrow his old, spare laptop due to mine breaking due to some hardware failures (and I didn't want to waste money fixing it) but I think he may have given it to me infected. Now the laptop is rather old and hardware wise its not that great but somethings just seem so unnecessarily slow its ridiculous and odd to say the least. Things such as right clicking on the desktop sometimes taking 3-15seconds, same thing when clicking the start button, basic web pages like facebook freezing the computer for a good 30 seconds before properly loading, small folders freezing or going unresponsive when opening (like downloads folders) or even shutting the computer down can sometimes take far longer than it should. Things of this nature.

I ended up taking a look at his installed programs and noticed he had a lot of of those 3rd party crappy programs you get from downloading something else and not unchecking the random boxes (and a few programs I didn't even recognize). I don't know if these are the problems or something else entirely. So I came here to see if there was anything else lingering.

Thanks for your time and help.

OTL quickscan file:


OTL logfile created on: 10/30/2013 9:38:22 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 60.26% Memory free
7.27 Gb Paging File | 6.03 Gb Available in Paging File | 82.88% Paging File free
Paging file location(s): c:\pagefile.sys 4600 6600 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144.21 Gb Total Space | 94.15 Gb Free Space | 65.29% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 4.72 Gb Free Space | 97.83% Space Free | Partition Type: FAT32

Computer Name: ROSCO-PC | User Name: T | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/10/30 21:37:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
PRC - [2013/10/14 15:14:25 | 000,166,352 | ---- | M] (APN LLC.) -- C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
PRC - [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/08/12 10:12:38 | 000,295,376 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\NisSrv.exe
PRC - [2013/08/12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/08/12 10:11:20 | 000,995,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/05/07 20:18:34 | 000,097,056 | ---- | M] (Conduit) -- C:\Program Files\SearchProtect\bin\CltMngSvc.exe
PRC - [2013/04/22 08:18:52 | 000,109,064 | ---- | M] (Wajam) -- C:\Program Files\Wajam\Updater\WajamUpdater.exe
PRC - [2013/03/25 05:20:50 | 000,520,360 | ---- | M] (iWin Inc.) -- C:\Program Files\Pogo Games\PGMTrusted.exe
PRC - [2009/04/10 20:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2013/10/08 14:02:43 | 000,415,184 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppgooglenaclpluginchrome.dll
MOD - [2013/10/08 14:02:42 | 013,584,336 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
MOD - [2013/10/08 14:02:41 | 004,055,504 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
MOD - [2013/10/08 14:01:50 | 000,698,832 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
MOD - [2013/10/08 14:01:49 | 000,099,792 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\libegl.dll
MOD - [2013/10/08 14:01:47 | 001,604,560 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll


========== Services (SafeList) ==========

SRV - [2013/10/14 15:14:25 | 000,166,352 | ---- | M] (APN LLC.) [Auto | Running] -- C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe -- (APNMCP)
SRV - [2013/10/08 16:22:44 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/09/05 10:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/08/12 10:12:38 | 000,295,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013/08/12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/05/07 20:18:34 | 000,097,056 | ---- | M] (Conduit) [Auto | Running] -- C:\Program Files\SearchProtect\bin\CltMngSvc.exe -- (CltMngSvc)
SRV - [2013/04/22 08:18:52 | 000,109,064 | ---- | M] (Wajam) [Auto | Running] -- C:\Program Files\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2013/03/25 05:20:50 | 000,520,360 | ---- | M] (iWin Inc.) [Auto | Running] -- C:\Program Files\Pogo Games\PGMTrusted.exe -- (PGMTrusted)
SRV - [2010/02/20 13:05:18 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2009/04/10 20:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/11/04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)
SRV - [2008/01/20 16:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTGLM7X.sys -- (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\BootDefragDriver.sys -- (BootDefragDriver)
DRV - [2013/08/06 16:31:26 | 000,011,552 | ---- | M] (Glarysoft Ltd) [Kernel | On_Demand | Running] -- C:\Program Files\Glary Utilities 3\ProcObsrv.sys -- (ProcObsrv)
DRV - [2013/06/18 21:50:08 | 000,107,392 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/03/15 07:44:48 | 000,127,488 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009/05/14 08:40:38 | 004,231,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2009/04/10 18:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2008/11/04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2008/09/18 03:14:44 | 000,251,392 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/06/26 16:23:12 | 000,011,264 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV - [2008/01/20 16:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
DRV - [2008/01/20 16:23:02 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006/11/01 21:30:56 | 002,589,184 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw2v32.sys -- (NETw2v32)
DRV - [2005/11/14 13:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {01e86e69-a2f8-48a0-b068-83869bdba3d0} - C:\Program Files\VisualBee_V.9\prxtbVis0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhit.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {d2cf9842-af95-48cd-b873-bfbb48cd7f5e} - C:\Program Files\MixiDJ_V45\prxtbMix0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 75 05 5B 09 AD 8E CE 01 [binary data]
IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...1I7NDKB_enUS521
IE - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: c:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: c:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)


[2013/07/25 04:38:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Ask Search (Enabled)
CHR - default_search_provider: search_url = http://www.search.as...q={searchTerms}
CHR - default_search_provider: suggest_url = http://ss.websearch....q={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Acrobat3\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Disabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Disabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Disabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll
CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Disabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Disabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Ask Toolbar = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaajpkhjdkhhnkmgfjodbkfpbmibkkk\25.60699_0\
CHR - Extension: Google Docs = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0\
CHR - Extension: Google Search = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Chrome In-App Payments service = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: Gmail = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006/09/18 11:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (VisualBee V.9 Toolbar) - {01e86e69-a2f8-48a0-b068-83869bdba3d0} - C:\Program Files\VisualBee_V.9\prxtbVis0.dll (Conduit Ltd.)
O2 - BHO: (hosts) - {11111111-1111-1111-1111-110311531182} - C:\Program Files\hosts\hosts-bho.dll (Alex)
O2 - BHO: (Coupon Server) - {11111111-1111-1111-1111-110311581152} - C:\Program Files\Coupon Server\Coupon Server-bho.dll (Innovative Apps)
O2 - BHO: (LessTabs) - {3178A392-8963-471E-B7A2-969CB58D6496} - C:\Program Files\LessTabs\IE32\LessTabsClientIE.dll (LessTabs)
O2 - BHO: (WhiteSmoke New Toolbar) - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhit.dll (Conduit Ltd.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (TopArcadeHits Games) - {A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - C:\Users\Rosco\AppData\Local\TopArcadeHits\Toparcadehits.dll ()
O2 - BHO: (MixiDJ V45 Toolbar) - {d2cf9842-af95-48cd-b873-bfbb48cd7f5e} - C:\Program Files\MixiDJ_V45\prxtbMix0.dll (Conduit Ltd.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (VisualBee V.9 Toolbar) - {01e86e69-a2f8-48a0-b068-83869bdba3d0} - C:\Program Files\VisualBee_V.9\prxtbVis0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (WhiteSmoke New Toolbar) - {739df940-c5ee-4bab-9d7e-270894ae687a} - C:\Program Files\WhiteSmoke_New\prxtbWhit.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MixiDJ V45 Toolbar) - {d2cf9842-af95-48cd-b873-bfbb48cd7f5e} - C:\Program Files\MixiDJ_V45\prxtbMix0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\..\Toolbar\WebBrowser: (VisualBee V.9 Toolbar) - {01E86E69-A2F8-48A0-B068-83869BDBA3D0} - C:\Program Files\VisualBee_V.9\prxtbVis0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\..\Toolbar\WebBrowser: (WhiteSmoke New Toolbar) - {739DF940-C5EE-4BAB-9D7E-270894AE687A} - C:\Program Files\WhiteSmoke_New\prxtbWhit.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-598869867-4264938955-1491418867-1003\..\Toolbar\WebBrowser: (MixiDJ V45 Toolbar) - {D2CF9842-AF95-48CD-B873-BFBB48CD7F5E} - C:\Program Files\MixiDJ_V45\prxtbMix0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.200.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4BE43AF-278C-44F2-9144-9860E01511D5}: DhcpNameServer = 192.168.200.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 11:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004/09/13 19:15:24 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{37c53c14-77ca-11e2-b28c-00238b48e0fc}\Shell - "" = AutoRun
O33 - MountPoints2\{37c53c14-77ca-11e2-b28c-00238b48e0fc}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/10/30 21:37:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
[2013/10/25 09:50:42 | 000,000,000 | ---D | C] -- C:\ProgramData\AskPartnerNetwork
[2013/10/25 09:50:42 | 000,000,000 | ---D | C] -- C:\Program Files\AskPartnerNetwork
[2013/10/25 09:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2013/10/25 09:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013/10/25 09:48:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/10/23 22:18:24 | 000,000,000 | ---D | C] -- C:\Users\T\AppData\Roaming\GlarySoft
[2013/10/13 15:28:13 | 000,000,000 | ---D | C] -- C:\Users\T\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
[2013/10/03 12:25:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/10/03 12:25:20 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2013/10/30 21:37:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
[2013/10/30 21:34:59 | 000,000,264 | ---- | M] () -- C:\Windows\tasks\TopArcadeHits.job
[2013/10/30 21:22:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/10/30 21:06:10 | 000,000,312 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize 3.job
[2013/10/30 21:05:33 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/10/30 21:05:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/10/30 21:05:23 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/10/30 21:05:07 | 000,230,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/10/30 21:05:01 | 000,000,356 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2013/10/30 21:04:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/10/30 20:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/10/28 18:37:01 | 000,640,658 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/10/28 18:37:00 | 000,118,878 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/10/28 00:03:12 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/10/15 15:31:13 | 000,000,000 | ---- | M] () -- C:\END
[2013/10/15 06:48:22 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/10/03 12:25:29 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2013/10/03 12:25:29 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/09/23 22:39:25 | 000,000,680 | ---- | C] () -- C:\Users\T\AppData\Local\d3d9caps.dat
[2013/07/25 23:26:11 | 000,019,744 | ---- | C] () -- C:\Windows\System32\RegBootDefrag.exe
[2013/03/03 17:51:30 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2013/03/03 17:51:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2013/02/04 09:44:43 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012/11/13 15:43:38 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012/11/13 15:43:36 | 000,000,259 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

========== ZeroAccess Check ==========

[2006/11/02 02:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 07:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/10 20:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/10 20:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/08/12 23:47:11 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Glarysoft
[2013/07/27 08:33:52 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\SearchProtect
[2013/08/13 00:29:29 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Windows Live Writer
[2013/07/25 23:53:01 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\BabSolution
[2013/07/25 04:36:52 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\Babylon
[2013/07/16 17:00:28 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\GlarySoft
[2013/03/27 11:20:22 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\OnlineVault
[2013/03/27 11:20:28 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\PCPowerSpeed
[2013/07/24 13:44:55 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\player
[2013/07/27 03:17:37 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\SearchProtect
[2013/09/17 03:02:08 | 000,000,000 | ---D | M] -- C:\Users\Rosco\AppData\Roaming\Spotify
[2013/09/27 20:42:42 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\.minecraft
[2013/10/23 22:18:24 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\GlarySoft
[2013/07/27 08:29:52 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\SearchProtect
[2013/08/29 21:42:34 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\SystemRequirementsLab

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:373E1720

< End of report >



OTL Extras report


OTL Extras logfile created on: 10/30/2013 9:38:22 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.73 Gb Available Physical Memory | 60.26% Memory free
7.27 Gb Paging File | 6.03 Gb Available in Paging File | 82.88% Paging File free
Paging file location(s): c:\pagefile.sys 4600 6600 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144.21 Gb Total Space | 94.15 Gb Free Space | 65.29% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 4.72 Gb Free Space | 97.83% Space Free | Partition Type: FAT32

Computer Name: ROSCO-PC | User Name: T | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-598869867-4264938955-1491418867-1000]
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0392F4CD-8F1C-446A-B01E-80C1776A2E99}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{06FDD7FF-F702-44D9-A047-7DA40B592BB0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{1186D64E-F21C-483A-B8F4-912F0C8161BF}" = lport=137 | protocol=17 | dir=in | app=system |
"{175D4CBF-B3B2-44F0-A03C-40AD3553BD3E}" = lport=445 | protocol=6 | dir=in | app=system |
"{19B84BE8-D1E5-4C49-84CF-04771AEF43C4}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{1BB6D9FE-0B82-47ED-9549-052E918B4F96}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{247664C8-6FD4-4E61-9E78-BD241665EAA5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{2E2615DF-1C10-4BF9-B32B-A3A05D8CDAED}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{37341C6D-7F74-41A7-9155-2B8892AEAED5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{3759143D-E2E8-453A-B4F0-5524E2B66B6E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{38A9AA8D-134C-47C0-88EF-C0BB525CACE8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{47F63127-B691-47BB-9EA8-6C64F05987C3}" = rport=445 | protocol=6 | dir=out | app=system |
"{62082A64-68E3-4BA5-B725-F3DEE8CAA160}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{66108294-CC47-45C8-9E27-48424C228102}" = lport=139 | protocol=6 | dir=in | app=system |
"{80E6BE8B-E78F-48A2-8834-84FC22B32872}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{8279608E-88DA-4078-A6F8-BEEDA7E282FD}" = rport=139 | protocol=6 | dir=out | app=system |
"{8884BDB7-1058-4100-8971-4E46B2F03DB9}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9A4FEA26-08AB-45DB-A64E-2A50FF03A0CE}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{C02122B6-0C59-48F1-8750-394443538CB3}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D552871B-5043-4A64-8C13-A7FCDFBE04E9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{E26DBCB4-78A4-4381-A320-E957009A2030}" = lport=138 | protocol=17 | dir=in | app=system |
"{E8CA52D6-3B71-41F2-A5B8-E6101E607E00}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EE8AF40B-0C9D-4D86-81C6-AD7790D6FAAC}" = rport=138 | protocol=17 | dir=out | app=system |
"{F0737BBA-0BE4-4BE1-ACA2-D958A01D43D5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{FC49B697-EA8B-4169-BE59-115832AE2173}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05130E3F-4755-4914-9187-C235BC7A80D6}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{1105D7D7-BFB6-4499-94A7-453284097F7E}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{1202830A-EAC0-471E-B01A-9D08794F516F}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{132E1DBE-555B-4119-9B77-150042EBADC3}" = protocol=17 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{1A09B301-B825-4E1F-831A-F6391D58AE5A}" = protocol=17 | dir=in | app=c:\program files\windows defender\msascui.exe |
"{1D00346C-7B89-496A-858B-448D6885FF8B}" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{2A47AD38-16AD-4285-8275-BC27540A10B0}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{2AEF56CA-4D1E-456A-A412-26F8B0300C5F}" = protocol=58 | dir=out | [email protected],-28546 |
"{2D3751A0-1EA2-4AE3-B74D-352636AFD47A}" = protocol=6 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{2DEEE9FD-581C-4927-B506-7A0B20139EEC}" = protocol=6 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"{31C50A7E-C75F-489C-B76C-41BDAEA68795}" = protocol=58 | dir=in | [email protected],-28545 |
"{3287ABA2-694A-4179-B033-5A853EB7DF07}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{3550DDDC-0B98-41BD-B588-9431EA9C7DBC}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{3EA65A5E-F888-463D-BB7B-E3A406F1C861}" = protocol=1 | dir=in | [email protected],-28543 |
"{42512F4C-EA0C-4C46-8673-5FE3FF4552A5}" = protocol=6 | dir=out | app=system |
"{436F3600-65B2-428B-94C8-D7152EDCD936}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\remotecrashsender.exe |
"{466A79B3-9CA2-4930-81E2-583504AB479F}" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{467FA57E-8124-4579-B9C6-2FED32D163B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4D570EFF-67A9-4CDB-BF15-7E6142C70B4B}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{69E4E3A9-0B14-4421-A85E-C6C160D7F0FD}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{71B15798-129E-4CCF-8325-662B37BDB16F}" = protocol=17 | dir=in | app=c:\program files\pogo games\webupdater.exe |
"{85737291-0EA9-4253-AB8B-20F3F3FF8C84}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{85E9FE8A-777E-4137-B0D5-32C8574D9EC0}" = protocol=17 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{870AFFD1-F295-45DD-8D7D-46B43AEE0479}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{8D004390-737E-47D8-84CB-D64450C151C7}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8DDA6B4C-6386-4BD7-B578-58F4CCA9D47A}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{94C8223F-87DB-44E8-9528-85FECF03A86D}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\launcher.exe |
"{9C9059CE-4F8A-422A-AEDD-67C5D1379A12}" = protocol=1 | dir=out | [email protected],-28544 |
"{B6FD0C87-305A-4ACA-B9C3-09B237FE0C4F}" = protocol=6 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{BFEB8555-0562-4A9E-B341-B13B2F79CABA}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{C1B972E1-0A80-4AC6-A4F9-AE4988DE0F6F}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{C621E957-0B48-4DF4-AF96-D4EEC6E4D0C6}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{E0F7E863-AB7B-4321-83A2-1CCF3A8A875A}" = protocol=17 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"{E18F3C68-9766-406C-8FF8-D5CC1146438B}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{E511712E-7919-4F2C-B006-CA11611C5F4A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E9003816-0813-467F-B7DD-50C4012C0B11}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{EC15F3D0-D29D-44D7-8E72-FA014BB2C6BE}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\launcher.exe |
"{F64BC326-DAE0-49AB-9B12-99667C15434F}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{F79C82CD-21DA-49FF-B3C0-7EF0C230A274}" = protocol=6 | dir=in | app=c:\program files\pogo games\webupdater.exe |
"{F9EA74DA-FF3E-45B0-ACAE-6A9B4ED51C82}" = protocol=6 | dir=in | app=c:\program files\windows defender\msascui.exe |
"{FA3ED778-BA60-4C3F-9074-4294E0EB7452}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"TCP Query User{63489769-A7A8-401C-B6B4-64CE8577A00F}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"TCP Query User{75496244-83C8-4B2F-B290-DAE7C671C991}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"UDP Query User{89A40A6F-8718-439A-A1D8-6296653928B9}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"UDP Query User{B9A1BCF9-8E5D-439D-9031-7174813779F0}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E08BAC8-845B-4327-8CDB-4B0F8C9857A5}_is1" = FLV Media Player version 1.3
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D24F198-A2CB-46B5-BB16-41B69C644B6C}" = Microsoft Security Client
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.9
"{4F524A2D-5637-006A-76A7-A758B70C0600}" = Ask Toolbar
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{53C63F43-B827-42D9-8886-4698D91EA33B}" = System Requirements Lab for Intel
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97FFE5B0-D264-45A7-A7E0-758C7B488F73}" = Warframe
"{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}" = Software Version Updater
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}" = VAFPlayer
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Acrobat Reader 3.01" = Adobe Acrobat Reader 3.01
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Belarc Advisor" = Belarc Advisor 8.2
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"Coupon Server" = Coupon Server
"F5E2C08F5DFFC049AF4EA7617C2ADBBCB8CA8D78" = Windows Driver Package - Intel (NETw5v32) net (05/14/2009 12.4.1.11)
"Glary Utilities 3" = Glary Utilities 3.8
"Google Chrome" = Google Chrome
"hosts" = hosts
"Jewel Match: Winter Wonderland" = Jewel Match: Winter Wonderland
"LessTabs" = LessTabs
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"MixiDJ_V45 Toolbar" = MixiDJ V45 Toolbar
"PogoDGC" = Pogo Games
"SearchProtect" = Search Protect by conduit
"VisualBee_V.9 Toolbar" = VisualBee V.9 Toolbar
"VLC media player" = VLC media player 2.0.6
"Wajam" = Wajam
"WhiteSmoke_New Toolbar" = WhiteSmoke New Toolbar
"WinLiveSuite" = Windows Live Essentials

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 10/27/2013 7:31:14 PM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/28/2013 6:28:06 AM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/28/2013 6:37:38 AM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/28/2013 9:43:17 AM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/28/2013 7:28:10 PM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/29/2013 8:11:22 PM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/30/2013 9:43:39 AM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/30/2013 8:21:57 PM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2013 3:06:09 AM | Computer Name = Rosco-PC | Source = WinMgmt | ID = 10
Description =

Error - 10/31/2013 3:07:10 AM | Computer Name = Rosco-PC | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 7b4 Start Time: 01ced607822e455e Termination Time: 38

[ System Events ]
Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

Error - 10/31/2013 3:06:09 AM | Computer Name = Rosco-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

[Advertisements]

Go to the PC maker's site and see if they have a new driver for your Ethernet network adapter (Marvell Yukon Gigabit Ethernet Controller). It is throwing errors:

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

If your PC maker doesn't have a new driver then get the one from Marvell: http://www.marvell.c...oads/search.do#


Uninstall as many of these as you can find:


Ask Toolbar
Coupon Server
Glary Utilities 3.8
Google Toolbar for Internet Explorer
LessTabs
MixiDJ V45 Toolbar
VisualBee V.9 Toolbar
Wajam
WhiteSmoke New Toolbar


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply. Close n0tepad. Close the Command Window.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.




Download : ADWCleaner to your desktop. Make sure you get the correct Download button. Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).



Click on Scan and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder.



Junkware-Removal-Tool

Please download Junkware Removal Tool to your desktop. Make sure you get the correct Download button. Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus. Close all browsers.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Copy the text in the code box:

DRIVES
nnetsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\assembly\GAC_32\*.ini
%systemroot%\assembly\GAC_64\*.ini
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe
%APPDATA%\*.
/md5start
rsvpsp.dll
pnrpnsp.dll 
nwprovau.dll
nlaapi.dll
napinsp.dll
mswsock.dll
winrnr.dll
wshelper.dll
services.exe
atapi.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
csrss.exe
PrintIsolationHost.exe
consrv.dll
user32.dll
/md5stop
dir C:\ /S /A:L /C
C:\Windows\assembly\tmp\U\*.* /s
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%ProgramFiles%\WINDOWS NT\*.* /s
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

Run OTL (Vista or Win 7 => right click and Run As Administrator)

Paste (Ctrl + v) the copied text in the box where it says Custom Scan/Fixes

Select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.


Get the free version of Speccy:

http://www.filehippo...download_speccy (Look in the upper right for the Download
Latest Version button - Do NOT press the large Start Download button on the upper left!) Download, Save and Install it. Run Speccy. When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System. (It will be near the top about 10 lines down.) Attach the file to your next post. Uninstall Speccy when done.

[RKinner]

Go to the PC maker's site and see if they have a new driver for your Ethernet network adapter (Marvell Yukon Gigabit Ethernet Controller). It is throwing errors:

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

If your PC maker doesn't have a new driver then get the one from Marvell: http://www.marvell.c...oads/search.do#


Uninstall as many of these as you can find:


Ask Toolbar
Coupon Server
Glary Utilities 3.8
Google Toolbar for Internet Explorer
LessTabs
MixiDJ V45 Toolbar
VisualBee V.9 Toolbar
Wajam
WhiteSmoke New Toolbar


1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply. Close n0tepad. Close the Command Window.)


1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.




Download : ADWCleaner to your desktop. Make sure you get the correct Download button. Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @BleepingComputer

NOTE: If using Internet Explorer and you get an alert that stops the program downloading, click on the warning and allow the download to complete.

Close all programs, pause your anti-virus and run AdwCleaner (Vista or Win 7 => right click and Run As Administrator).



Click on Scan and follow the prompts. Let it run unhindered. When done, click on the Clean button, and follow the prompts. Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

The report will be saved in the C:\AdwCleaner folder.



Junkware-Removal-Tool

Please download Junkware Removal Tool to your desktop. Make sure you get the correct Download button. Sometimes the ads on BleepingComputer will mimic the real Download button which should say: Download Now @Author's site

• Pause your anti-virus. Close all browsers.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Copy the text in the code box:

DRIVES
nnetsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\assembly\GAC_32\*.ini
%systemroot%\assembly\GAC_64\*.ini
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.exe
%APPDATA%\*.
/md5start
rsvpsp.dll
pnrpnsp.dll 
nwprovau.dll
nlaapi.dll
napinsp.dll
mswsock.dll
winrnr.dll
wshelper.dll
services.exe
atapi.sys
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
csrss.exe
PrintIsolationHost.exe
consrv.dll
user32.dll
/md5stop
dir C:\ /S /A:L /C
C:\Windows\assembly\tmp\U\*.* /s
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%ProgramFiles%\WINDOWS NT\*.* /s
%systemroot%\system32\drivers\*.sys /lockedfiles
CREATERESTOREPOINT

Run OTL (Vista or Win 7 => right click and Run As Administrator)

Paste (Ctrl + v) the copied text in the box where it says Custom Scan/Fixes

Select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.


Get the free version of Speccy:

http://www.filehippo...download_speccy (Look in the upper right for the Download
Latest Version button - Do NOT press the large Start Download button on the upper left!) Download, Save and Install it. Run Speccy. When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File, (to your desktop) note the name it gives. OK. Open the file in notepad and delete the line that gives the serial number of your Operating System. (It will be near the top about 10 lines down.) Attach the file to your next post. Uninstall Speccy when done.

[JustTrevor]

Go to the PC maker's site and see if they have a new driver for your Ethernet network adapter (Marvell Yukon Gigabit Ethernet Controller). It is throwing errors:

Error - 10/31/2013 3:04:16 AM | Computer Name = Rosco-PC | Source = yukonwlh | ID = 458853
Description = Driver has encountered an internal error

If your PC maker doesn't have a new driver then get the one from Marvell: http://www.marvell.c...oads/search.do#


Uninstall as many of these as you can find:


Ask Toolbar
Coupon Server
Glary Utilities 3.8
Google Toolbar for Internet Explorer
LessTabs
MixiDJ V45 Toolbar
VisualBee V.9 Toolbar
Wajam
WhiteSmoke New Toolbar

Sorry for the late reply, schedule/time zones but thanks for the help.

Anyway, I'm not sure what driver update or whatever I'm supposed to be downloading.


Will be uninstalling those programs and will edit when I'm done/what I uninstalled.

Do I continue with the rest of the post without updating the driver? I'll assume no for now.

[RKinner]

Do what you can. For the driver, give me the make and model number and if applicable the service tag number and I will look for you.

[JustTrevor]

Do what you can. For the driver, give me the make and model number and if applicable the service tag number and I will look for you.

Um, its not my computer so where can I find that info?

And I uninstalled all of what you listed, plus looked up a few others and uninstalled those as well.

Which included:

search protect by conduit
VAFPlayer
Bonjour
hosts (by alex)

So continue with the rest of your post?

[RKinner]

Make and Part number should be on a sticker on the bottom.

Go ahead and finish the other instructions. I've got to go to bed now. It's 1 AM here.

[JustTrevor]

1. Double-click My Computer, and then right-click the hard disk that you want to check. C:
2. Click Properties, and then click Tools.
3. Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed,
4. Check both boxes and then click Start.
You will receive the following message:
The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?
Click Yes to schedule the disk check, but don't restart yet.

Right click on (My) Computer and select Manage (Continue) Then the Event Viewer. Next select Windows Logs. Right click on System and Clear Log, Clear. Repeat for Application. Reboot. The disk check will run and will probably take an hour or more to finish.


Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator. Then type (with an Enter after each line).

sfc /scannow

(SPACE after sfc. This will check your critical system files. Does this finish without complaint? IF it says it couldn't fix everything then:

Copy the next two lines:

findstr /c:"[SR]" \windows\logs\cbs\cbs.log > \windows\logs\cbs\junk.txt
notepad \windows\logs\cbs\junk.txt

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Right click and Paste or Edit then Paste and the copied line should appear.
Hit Enter if notepad does not open. Copy and paste the text from notepad into a reply. Close n0tepad. Close the Command Window.)

Was only able to do up to this tonight, will continue with it tomorrow. Heres that notepad text.

Spoiler

2013-10-31 23:47:18, Info CSI 00000006 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:18, Info CSI 00000007 [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:26, Info CSI 00000009 [SR] Verify complete
2013-10-31 23:47:27, Info CSI 0000000a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:27, Info CSI 0000000b [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:34, Info CSI 0000000d [SR] Verify complete
2013-10-31 23:47:36, Info CSI 0000000e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:36, Info CSI 0000000f [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:38, Info CSI 00000011 [SR] Verify complete
2013-10-31 23:47:40, Info CSI 00000012 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:40, Info CSI 00000013 [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:45, Info CSI 00000015 [SR] Verify complete
2013-10-31 23:47:47, Info CSI 00000016 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:47, Info CSI 00000017 [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:50, Info CSI 00000019 [SR] Verify complete
2013-10-31 23:47:52, Info CSI 0000001a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:52, Info CSI 0000001b [SR] Beginning Verify and Repair transaction
2013-10-31 23:47:55, Info CSI 0000001d [SR] Verify complete
2013-10-31 23:47:56, Info CSI 0000001e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:47:56, Info CSI 0000001f [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:00, Info CSI 00000021 [SR] Verify complete
2013-10-31 23:48:02, Info CSI 00000022 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:02, Info CSI 00000023 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:05, Info CSI 00000025 [SR] Verify complete
2013-10-31 23:48:07, Info CSI 00000026 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:07, Info CSI 00000027 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:10, Info CSI 00000029 [SR] Verify complete
2013-10-31 23:48:12, Info CSI 0000002a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:12, Info CSI 0000002b [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:16, Info CSI 0000002d [SR] Verify complete
2013-10-31 23:48:18, Info CSI 0000002e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:18, Info CSI 0000002f [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:21, Info CSI 00000031 [SR] Verify complete
2013-10-31 23:48:22, Info CSI 00000032 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:22, Info CSI 00000033 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:26, Info CSI 00000035 [SR] Verify complete
2013-10-31 23:48:28, Info CSI 00000036 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:28, Info CSI 00000037 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:32, Info CSI 00000039 [SR] Verify complete
2013-10-31 23:48:34, Info CSI 0000003a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:34, Info CSI 0000003b [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:39, Info CSI 0000003d [SR] Verify complete
2013-10-31 23:48:40, Info CSI 0000003e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:40, Info CSI 0000003f [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:44, Info CSI 00000041 [SR] Verify complete
2013-10-31 23:48:46, Info CSI 00000042 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:46, Info CSI 00000043 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:49, Info CSI 00000045 [SR] Verify complete
2013-10-31 23:48:50, Info CSI 00000046 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:50, Info CSI 00000047 [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:51, Info CSI 00000049 [SR] Verify complete
2013-10-31 23:48:52, Info CSI 0000004a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:52, Info CSI 0000004b [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:54, Info CSI 0000004d [SR] Verify complete
2013-10-31 23:48:55, Info CSI 0000004e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:55, Info CSI 0000004f [SR] Beginning Verify and Repair transaction
2013-10-31 23:48:58, Info CSI 00000051 [SR] Verify complete
2013-10-31 23:48:59, Info CSI 00000052 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:48:59, Info CSI 00000053 [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:03, Info CSI 00000055 [SR] Verify complete
2013-10-31 23:49:04, Info CSI 00000056 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:04, Info CSI 00000057 [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:09, Info CSI 00000059 [SR] Verify complete
2013-10-31 23:49:10, Info CSI 0000005a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:10, Info CSI 0000005b [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:15, Info CSI 0000005d [SR] Verify complete
2013-10-31 23:49:16, Info CSI 0000005e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:16, Info CSI 0000005f [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:20, Info CSI 00000061 [SR] Verify complete
2013-10-31 23:49:21, Info CSI 00000062 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:21, Info CSI 00000063 [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:33, Info CSI 00000065 [SR] Verify complete
2013-10-31 23:49:34, Info CSI 00000066 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:34, Info CSI 00000067 [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:37, Info CSI 00000069 [SR] Verify complete
2013-10-31 23:49:38, Info CSI 0000006a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:38, Info CSI 0000006b [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:43, Info CSI 0000006d [SR] Verify complete
2013-10-31 23:49:44, Info CSI 0000006e [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:44, Info CSI 0000006f [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:51, Info CSI 00000071 [SR] Verify complete
2013-10-31 23:49:52, Info CSI 00000072 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:52, Info CSI 00000073 [SR] Beginning Verify and Repair transaction
2013-10-31 23:49:58, Info CSI 00000075 [SR] Verify complete
2013-10-31 23:49:59, Info CSI 00000076 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:49:59, Info CSI 00000077 [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:03, Info CSI 00000079 [SR] Verify complete
2013-10-31 23:50:03, Info CSI 0000007a [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:03, Info CSI 0000007b [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:10, Info CSI 0000007e [SR] Verify complete
2013-10-31 23:50:11, Info CSI 0000007f [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:11, Info CSI 00000080 [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:15, Info CSI 00000082 [SR] Verify complete
2013-10-31 23:50:16, Info CSI 00000083 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:16, Info CSI 00000084 [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:22, Info CSI 00000087 [SR] Verify complete
2013-10-31 23:50:22, Info CSI 00000088 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:22, Info CSI 00000089 [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:28, Info CSI 0000008b [SR] Verify complete
2013-10-31 23:50:29, Info CSI 0000008c [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:29, Info CSI 0000008d [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:39, Info CSI 00000097 [SR] Verify complete
2013-10-31 23:50:39, Info CSI 00000098 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:39, Info CSI 00000099 [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:46, Info CSI 0000009b [SR] Verify complete
2013-10-31 23:50:46, Info CSI 0000009c [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:46, Info CSI 0000009d [SR] Beginning Verify and Repair transaction
2013-10-31 23:50:52, Info CSI 0000009f [SR] Verify complete
2013-10-31 23:50:53, Info CSI 000000a0 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:50:53, Info CSI 000000a1 [SR] Beginning Verify and Repair transaction
2013-10-31 23:51:00, Info CSI 000000a3 [SR] Verify complete
2013-10-31 23:51:01, Info CSI 000000a4 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:51:01, Info CSI 000000a5 [SR] Beginning Verify and Repair transaction
2013-10-31 23:51:10, Info CSI 000000a7 [SR] Verify complete
2013-10-31 23:51:11, Info CSI 000000a8 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:51:11, Info CSI 000000a9 [SR] Beginning Verify and Repair transaction
2013-10-31 23:51:21, Info CSI 000000ad [SR] Verify complete
2013-10-31 23:51:21, Info CSI 000000ae [SR] Verifying 100 (0x00000064) components
2013-10-31 23:51:21, Info CSI 000000af [SR] Beginning Verify and Repair transaction
2013-10-31 23:51:36, Info CSI 000000b1 [SR] Verify complete
2013-10-31 23:51:36, Info CSI 000000b2 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:51:36, Info CSI 000000b3 [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:00, Info CSI 000000b5 [SR] Verify complete
2013-10-31 23:52:01, Info CSI 000000b6 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:01, Info CSI 000000b7 [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:07, Info CSI 000000b9 [SR] Verify complete
2013-10-31 23:52:07, Info CSI 000000ba [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:07, Info CSI 000000bb [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:09, Info CSI 000000bd [SR] Verify complete
2013-10-31 23:52:10, Info CSI 000000be [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:10, Info CSI 000000bf [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:12, Info CSI 000000c1 [SR] Verify complete
2013-10-31 23:52:12, Info CSI 000000c2 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:12, Info CSI 000000c3 [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:27, Info CSI 000000d7 [SR] Verify complete
2013-10-31 23:52:28, Info CSI 000000d8 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:28, Info CSI 000000d9 [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:37, Info CSI 000000e5 [SR] Verify complete
2013-10-31 23:52:39, Info CSI 000000e6 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:39, Info CSI 000000e7 [SR] Beginning Verify and Repair transaction
2013-10-31 23:52:47, Info CSI 000000e9 [SR] Verify complete
2013-10-31 23:52:48, Info CSI 000000ea [SR] Verifying 100 (0x00000064) components
2013-10-31 23:52:48, Info CSI 000000eb [SR] Beginning Verify and Repair transaction
2013-10-31 23:53:07, Info CSI 000000ed [SR] Verify complete
2013-10-31 23:53:08, Info CSI 000000ee [SR] Verifying 100 (0x00000064) components
2013-10-31 23:53:08, Info CSI 000000ef [SR] Beginning Verify and Repair transaction
2013-10-31 23:53:30, Info CSI 000000f1 [SR] Verify complete
2013-10-31 23:53:31, Info CSI 000000f2 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:53:31, Info CSI 000000f3 [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:06, Info CSI 000000f6 [SR] Verify complete
2013-10-31 23:54:06, Info CSI 000000f7 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:06, Info CSI 000000f8 [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:12, Info CSI 000000fa [SR] Verify complete
2013-10-31 23:54:13, Info CSI 000000fb [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:13, Info CSI 000000fc [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:16, Info CSI 000000fe [SR] Verify complete
2013-10-31 23:54:16, Info CSI 000000ff [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:16, Info CSI 00000100 [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:25, Info CSI 00000102 [SR] Verify complete
2013-10-31 23:54:25, Info CSI 00000103 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:25, Info CSI 00000104 [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:31, Info CSI 00000106 [SR] Verify complete
2013-10-31 23:54:33, Info CSI 00000107 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:33, Info CSI 00000108 [SR] Beginning Verify and Repair transaction
2013-10-31 23:54:42, Info CSI 0000010a [SR] Verify complete
2013-10-31 23:54:43, Info CSI 0000010b [SR] Verifying 100 (0x00000064) components
2013-10-31 23:54:43, Info CSI 0000010c [SR] Beginning Verify and Repair transaction
2013-10-31 23:55:02, Info CSI 00000131 [SR] Verify complete
2013-10-31 23:55:02, Info CSI 00000132 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:55:02, Info CSI 00000133 [SR] Beginning Verify and Repair transaction
2013-10-31 23:55:13, Info CSI 00000135 [SR] Verify complete
2013-10-31 23:55:14, Info CSI 00000136 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:55:14, Info CSI 00000137 [SR] Beginning Verify and Repair transaction
2013-10-31 23:55:35, Info CSI 00000139 [SR] Repairing corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:22{11}]"netbios.sys" from store
2013-10-31 23:55:41, Info CSI 0000013b [SR] Verify complete
2013-10-31 23:55:42, Info CSI 0000013c [SR] Verifying 100 (0x00000064) components
2013-10-31 23:55:42, Info CSI 0000013d [SR] Beginning Verify and Repair transaction
2013-10-31 23:56:03, Info CSI 0000013f [SR] Verify complete
2013-10-31 23:56:04, Info CSI 00000140 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:56:04, Info CSI 00000141 [SR] Beginning Verify and Repair transaction
2013-10-31 23:56:27, Info CSI 00000143 [SR] Verify complete
2013-10-31 23:56:28, Info CSI 00000144 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:56:28, Info CSI 00000145 [SR] Beginning Verify and Repair transaction
2013-10-31 23:56:43, Info CSI 00000147 [SR] Verify complete
2013-10-31 23:56:44, Info CSI 00000148 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:56:44, Info CSI 00000149 [SR] Beginning Verify and Repair transaction
2013-10-31 23:57:00, Info CSI 0000014b [SR] Verify complete
2013-10-31 23:57:01, Info CSI 0000014c [SR] Verifying 100 (0x00000064) components
2013-10-31 23:57:01, Info CSI 0000014d [SR] Beginning Verify and Repair transaction
2013-10-31 23:57:14, Info CSI 00000150 [SR] Verify complete
2013-10-31 23:57:17, Info CSI 00000151 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:57:17, Info CSI 00000152 [SR] Beginning Verify and Repair transaction
2013-10-31 23:57:46, Info CSI 00000154 [SR] Verify complete
2013-10-31 23:57:49, Info CSI 00000155 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:57:49, Info CSI 00000156 [SR] Beginning Verify and Repair transaction
2013-10-31 23:58:03, Info CSI 00000158 [SR] Verify complete
2013-10-31 23:58:05, Info CSI 00000159 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:58:05, Info CSI 0000015a [SR] Beginning Verify and Repair transaction
2013-10-31 23:58:30, Info CSI 0000015c [SR] Verify complete
2013-10-31 23:58:32, Info CSI 0000015d [SR] Verifying 100 (0x00000064) components
2013-10-31 23:58:32, Info CSI 0000015e [SR] Beginning Verify and Repair transaction
2013-10-31 23:59:05, Info CSI 00000160 [SR] Verify complete
2013-10-31 23:59:06, Info CSI 00000161 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:59:06, Info CSI 00000162 [SR] Beginning Verify and Repair transaction
2013-10-31 23:59:31, Info CSI 00000164 [SR] Verify complete
2013-10-31 23:59:33, Info CSI 00000165 [SR] Verifying 100 (0x00000064) components
2013-10-31 23:59:33, Info CSI 00000166 [SR] Beginning Verify and Repair transaction
2013-11-01 00:00:22, Info CSI 00000168 [SR] Verify complete
2013-11-01 00:00:24, Info CSI 00000169 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:00:24, Info CSI 0000016a [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:09, Info CSI 0000016d [SR] Verify complete
2013-11-01 00:01:09, Info CSI 0000016e [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:09, Info CSI 0000016f [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:14, Info CSI 00000171 [SR] Verify complete
2013-11-01 00:01:14, Info CSI 00000172 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:14, Info CSI 00000173 [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:20, Info CSI 00000175 [SR] Verify complete
2013-11-01 00:01:21, Info CSI 00000176 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:21, Info CSI 00000177 [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:27, Info CSI 00000179 [SR] Verify complete
2013-11-01 00:01:28, Info CSI 0000017a [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:28, Info CSI 0000017b [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:34, Info CSI 0000017c [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
2013-11-01 00:01:34, Info CSI 0000017d [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
2013-11-01 00:01:36, Info CSI 00000182 [SR] Verify complete
2013-11-01 00:01:36, Info CSI 00000183 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:36, Info CSI 00000184 [SR] Beginning Verify and Repair transaction
2013-11-01 00:01:45, Info CSI 00000186 [SR] Verify complete
2013-11-01 00:01:49, Info CSI 00000187 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:01:49, Info CSI 00000188 [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:00, Info CSI 0000018a [SR] Verify complete
2013-11-01 00:02:00, Info CSI 0000018b [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:00, Info CSI 0000018c [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:02, Info CSI 0000018e [SR] Verify complete
2013-11-01 00:02:02, Info CSI 0000018f [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:02, Info CSI 00000190 [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:09, Info CSI 00000192 [SR] Verify complete
2013-11-01 00:02:10, Info CSI 00000193 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:10, Info CSI 00000194 [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:26, Info CSI 00000196 [SR] Verify complete
2013-11-01 00:02:28, Info CSI 00000197 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:28, Info CSI 00000198 [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:35, Info CSI 0000019a [SR] Verify complete
2013-11-01 00:02:36, Info CSI 0000019b [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:36, Info CSI 0000019c [SR] Beginning Verify and Repair transaction
2013-11-01 00:02:54, Info CSI 0000019e [SR] Verify complete
2013-11-01 00:02:55, Info CSI 0000019f [SR] Verifying 100 (0x00000064) components
2013-11-01 00:02:55, Info CSI 000001a0 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:00, Info CSI 000001a2 [SR] Verify complete
2013-11-01 00:03:00, Info CSI 000001a3 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:03:00, Info CSI 000001a4 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:07, Info CSI 000001a6 [SR] Verify complete
2013-11-01 00:03:08, Info CSI 000001a7 [SR] Verifying 100 (0x00000064) components
2013-11-01 00:03:08, Info CSI 000001a8 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:16, Info CSI 000001b3 [SR] Verify complete
2013-11-01 00:03:17, Info CSI 000001b4 [SR] Verifying 40 (0x00000028) components
2013-11-01 00:03:17, Info CSI 000001b5 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:19, Info CSI 000001b7 [SR] Verify complete
2013-11-01 00:03:19, Info CSI 000001b8 [SR] Repairing 2 components
2013-11-01 00:03:19, Info CSI 000001b9 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:19, Info CSI 000001ba [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
2013-11-01 00:03:19, Info CSI 000001bb [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
2013-11-01 00:03:19, Info CSI 000001bd [SR] Repairing corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:22{11}]"netbios.sys" from store
2013-11-01 00:03:19, Info CSI 000001bf [SR] Repair complete
2013-11-01 00:03:19, Info CSI 000001c0 [SR] Committing transaction
2013-11-01 00:03:19, Info CSI 000001c1 [SR] Cannot commit interactively, there are boot critical components being repaired
2013-11-01 00:03:19, Info CSI 000001c2 [SR] Repairing 2 components
2013-11-01 00:03:19, Info CSI 000001c3 [SR] Beginning Verify and Repair transaction
2013-11-01 00:03:19, Info CSI 000001c4 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:42{21}]"Wdf01000Uninstall.mof" from store
2013-11-01 00:03:19, Info CSI 000001c5 [SR] Repairing corrupted file [ml:58{29},l:56{28}]"\??\C:\Windows\system32\wbem"\[l:24{12}]"Wdf01000.mof" from store
2013-11-01 00:03:19, Info CSI 000001c7 [SR] Repairing corrupted file [ml:520{260},l:62{31}]"\??\C:\Windows\System32\drivers"\[l:22{11}]"netbios.sys" from store
2013-11-01 00:03:19, Info CSI 000001c9 [SR] Repair complete

The sfc scan said the following "Windows Resource Protection found corrupt files but was unable to fix some of them.

Details are included in the CBS.Log

The system file repair changes will take effect after the next reboot".

[JustTrevor]

1. Please download the Event Viewer Tool by Vino Rosso
http://images.malwar...om/vino/VEW.exe
and save it to your Desktop:
2. Right-click VEW.exe and Run AS Administrator
3. Under 'Select log to query', select:

* System
4. Under 'Select type to list', select:
* Error
* Warning


Then use the 'Number of events' as follows:


1. Click the radio button for 'Number of events'
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.


Please post the Output log in your next reply then repeat but select Application.

I try this and get a run time error 75. Path/file access error. For both system and application.

If you don't mind me asking, whats all this been for so far? what exactly seems to be the problem.

Edited by JustTrevor, 02 November 2013 - 03:42 AM.

[JustTrevor]

Scans logs:

Will edit them as I get them done.

ADW:

Spoiler

# AdwCleaner v3.010 - Report created 01/11/2013 at 23:21:02
# Updated 20/10/2013 by Xplode
# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)
# Username : T - ROSCO-PC
# Running from : C:\Users\T\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\StarApp
Folder Deleted : C:\ProgramData\VisualBee
Folder Deleted : C:\ProgramData\MaGniPici
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Users\T\AppDaTa\LocalLow\Conduit
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oahepomnpijmejhllnialnkhnadmcjdp
File Deleted : C:\END
File Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
File Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
File Deleted : C:\Users\Rosco\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage
File Deleted : C:\Users\Rosco\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage-journal
File Deleted : C:\Users\Rosco\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
File Deleted : C:\Users\Rosco\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
File Deleted : C:\Windows\Tasks\AmiUpdXp.job
File Deleted : C:\Windows\System32\Tasks\AmiUpdXp

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\oahepomnpijmejhllnialnkhnadmcjdp
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CAF0821B-0040-4B36-89AE-7CF7D7C88ADA}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CAF0821B-0040-4B36-89AE-7CF7D7C88ADA}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\Updater.AmiUpd
Key Deleted : HKLM\SOFTWARE\Classes\Updater.AmiUpd.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtectAll
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287808
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298581
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKCU\Software\AppDataLow\Software\smartbar
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\DomaIQ
Key Deleted : HKLM\Software\visualbee
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16514


-\\ Google Chrome v30.0.1599.101

[ File : C:\Users\Rosco\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : icon_url
Deleted : search_url
Deleted : suggest_url
Deleted : homepage

[ File : C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : icon_url
Deleted : search_url
Deleted : suggest_url

[ File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [6477 octets] - [01/11/2013 23:18:46]
AdwCleaner[S0].txt - [6444 octets] - [01/11/2013 23:21:02]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6504 octets] ##########

JRT

Spoiler

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows Vista ™ Home Premium x86
Ran by T on 01/11/2013 at 23:33:18.12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110311531182}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311531182}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\toparcadehits.job



~~~ Folders



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\extensioninstallforcelist [Blacklisted Policy]
Successfully deleted: [Folder] C:\Users\T\appdata\local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01/11/2013 at 23:35:38.39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

Spoiler

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by T (administrator) on ROSCO-PC on 01-11-2013 23:40:33
Running from C:\Users\T\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(iWin Inc.) C:\Program Files\Pogo Games\PGMTrusted.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-08-12] (Microsoft Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
MountPoints2: F - F:\LaunchU3.exe
MountPoints2: {37c53c14-77ca-11e2-b28c-00238b48e0fc} - F:\LaunchU3.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Rosco\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2008-01-20] (Microsoft Corporation)
HKU\Rosco\...\Run: [Spotify Web Helper] - C:\Users\Rosco\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [ 2013-07-05] (Spotify Ltd)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x75055B09AD8ECE01
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.200.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: ""
CHR DefaultSearchURL: (Ask Search) - http://www.search.as...q={searchTerms}
CHR DefaultSuggestURL: (Ask Search) - http://ss.websearch....q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Acrobat3\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java™ Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (MixiDJ V45) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.16.70.1_0
CHR Extension: (Gmail) - C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [iehjklkgijkjfcfmmjmjlmcccholamaf] - C:\Users\Rosco\AppData\Local\CRE\iehjklkgijkjfcfmmjmjlmcccholamaf.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-08-12] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-08-12] (Microsoft Corporation)
R2 PGMTrusted; C:\Program Files\Pogo Games\PGMTrusted.exe [520360 2013-03-25] (iWin Inc.)

==================== Drivers (Whitelisted) ====================

S3 ialm; C:\Windows\System32\DRIVERS\ialmnt5.sys [1302492 2006-11-01] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-01] (Intel® Corporation)
R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [11264 2008-06-26] (Chicony Electronics Co., Ltd.)
S3 GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 ProcObsrv; \??\C:\Program Files\Glary Utilities 3\ProcObsrv.sys [x]
S3 SetupNTGLM7X; \??\E:\NTGLM7X.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-01 23:40 - 2013-11-01 23:40 - 01089445 _____ (Farbar) C:\Users\T\Downloads\FRST.exe
2013-11-01 23:40 - 2013-11-01 23:40 - 00000000 ____D C:\FRST
2013-11-01 23:33 - 2013-11-01 23:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-01 23:32 - 2013-11-01 23:32 - 01033335 _____ (Thisisu) C:\Users\T\Downloads\JRT.exe
2013-11-01 23:07 - 2013-11-01 23:07 - 00061440 _____ ( ) C:\Users\T\Downloads\VEW.exe
2013-10-30 21:37 - 2013-10-30 21:37 - 00602112 _____ (OldTimer Tools) C:\Users\T\Desktop\OTL.exe
2013-10-28 00:03 - 2013-09-22 00:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-28 00:03 - 2013-09-22 00:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-28 00:03 - 2013-09-22 00:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-28 00:03 - 2013-09-22 00:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-28 00:03 - 2013-09-22 00:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-28 00:03 - 2013-09-22 00:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-28 00:03 - 2013-09-22 00:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-28 00:03 - 2013-09-22 00:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-28 00:03 - 2013-09-22 00:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-28 00:03 - 2013-09-22 00:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-28 00:03 - 2013-09-22 00:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-28 00:03 - 2013-09-22 00:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-28 00:03 - 2013-09-22 00:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-28 00:03 - 2013-09-22 00:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-28 00:03 - 2013-09-22 00:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-28 00:03 - 2013-09-21 23:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-25 09:50 - 2013-10-25 09:50 - 00000000 ____D C:\ProgramData\Oracle
2013-10-25 09:48 - 2013-10-25 09:48 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-25 09:48 - 2013-10-08 07:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-25 09:48 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-25 09:48 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-25 09:48 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-25 09:45 - 2013-10-25 09:48 - 00004803 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-23 22:18 - 2013-10-23 22:18 - 00000000 ____D C:\Users\T\AppData\Roaming\GlarySoft
2013-10-13 15:28 - 2013-10-13 15:28 - 00000000 ____D C:\Users\T\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2013-10-09 21:50 - 2013-08-26 16:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-09 21:50 - 2013-08-26 16:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-09 21:50 - 2013-08-26 16:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-09 21:50 - 2013-08-26 16:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-09 21:50 - 2013-08-26 15:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-09 21:50 - 2013-08-26 15:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-09 21:50 - 2013-08-26 15:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-09 21:50 - 2013-08-26 15:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-09 21:50 - 2013-08-26 15:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-09 21:50 - 2013-07-31 17:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 21:50 - 2013-07-31 16:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-09 21:49 - 2013-08-28 21:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 21:49 - 2013-07-20 00:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 21:47 - 2013-07-11 23:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 21:47 - 2013-06-28 16:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 21:47 - 2013-06-28 16:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 21:47 - 2013-06-28 16:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 21:47 - 2013-06-28 16:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 21:47 - 2011-05-05 03:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 21:47 - 2011-05-05 03:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 21:46 - 2013-06-26 13:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 21:46 - 2013-06-03 18:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 21:46 - 2013-06-03 15:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 21:45 - 2013-07-03 18:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 21:45 - 2013-07-02 16:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-03 12:25 - 2013-10-03 12:25 - 00000804 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-03 12:25 - 2013-10-03 12:25 - 00000000 ____D C:\Program Files\CCleaner
2013-10-03 12:24 - 2013-10-03 12:24 - 04369632 _____ (Piriform Ltd) C:\Users\T\Downloads\ccsetup406.exe

==================== One Month Modified Files and Folders =======

2013-11-01 23:40 - 2013-11-01 23:40 - 01089445 _____ (Farbar) C:\Users\T\Downloads\FRST.exe
2013-11-01 23:40 - 2013-11-01 23:40 - 00000000 ____D C:\FRST
2013-11-01 23:33 - 2013-11-01 23:33 - 00000000 ____D C:\Windows\ERUNT
2013-11-01 23:32 - 2013-11-01 23:32 - 01033335 _____ (Thisisu) C:\Users\T\Downloads\JRT.exe
2013-11-01 23:26 - 2008-01-20 15:35 - 00647000 _____ C:\Windows\WindowsUpdate.log
2013-11-01 23:23 - 2013-01-31 11:02 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-01 23:23 - 2006-11-02 03:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-01 23:23 - 2006-11-02 02:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-01 23:23 - 2006-11-02 02:47 - 00003712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-01 23:22 - 2013-01-31 11:02 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-01 23:22 - 2006-11-02 03:01 - 00032612 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-01 23:07 - 2013-11-01 23:07 - 00061440 _____ ( ) C:\Users\T\Downloads\VEW.exe
2013-11-01 22:42 - 2013-01-31 11:02 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-01 20:38 - 2013-07-26 12:12 - 00000000 ____D C:\Users\T\AppData\Local\Warframe
2013-10-31 21:56 - 2013-01-31 11:02 - 00000000 ____D C:\Program Files\Google
2013-10-31 21:47 - 2013-08-12 23:53 - 00000075 _____ C:\DiskDefrag.log
2013-10-31 21:44 - 2013-07-26 11:48 - 00000000 ____D C:\Users\T\AppData\Local\Google
2013-10-31 21:43 - 2013-07-24 13:36 - 00000000 ____D C:\Users\Rosco\AppData\Local\Conduit
2013-10-31 02:22 - 2011-10-02 22:40 - 00049952 _____ C:\Users\Rosco\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-30 21:37 - 2013-10-30 21:37 - 00602112 _____ (OldTimer Tools) C:\Users\T\Desktop\OTL.exe
2013-10-30 21:05 - 2013-07-26 11:47 - 00049952 _____ C:\Users\T\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-30 21:05 - 2006-11-02 02:47 - 00230896 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-30 17:56 - 2013-07-26 12:36 - 00000000 ____D C:\Users\T\AppData\Roaming\Skype
2013-10-28 18:37 - 2006-11-02 00:33 - 00755906 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-28 00:51 - 2006-11-02 01:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-28 00:26 - 2013-07-25 04:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-28 00:08 - 2013-08-13 00:06 - 00000000 ____D C:\Windows\system32\MRT
2013-10-28 00:06 - 2006-11-02 00:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-28 00:03 - 2012-11-11 16:02 - 00001945 _____ C:\Windows\epplauncher.mif
2013-10-28 00:02 - 2012-11-11 16:01 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-26 03:41 - 2013-09-17 21:02 - 00000000 ___RD C:\Program Files\Skype
2013-10-26 03:41 - 2013-07-23 17:58 - 00000000 ____D C:\ProgramData\Skype
2013-10-25 09:50 - 2013-10-25 09:50 - 00000000 ____D C:\ProgramData\Oracle
2013-10-25 09:48 - 2013-10-25 09:48 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-25 09:48 - 2013-10-25 09:45 - 00004803 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-25 09:48 - 2013-03-23 00:26 - 00000000 ____D C:\Program Files\Java
2013-10-23 22:18 - 2013-10-23 22:18 - 00000000 ____D C:\Users\T\AppData\Roaming\GlarySoft
2013-10-15 06:48 - 2013-01-31 11:04 - 00001971 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-13 15:28 - 2013-10-13 15:28 - 00000000 ____D C:\Users\T\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
2013-10-08 16:22 - 2013-01-31 11:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-08 16:22 - 2013-01-31 11:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 07:50 - 2013-10-25 09:48 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 07:46 - 2013-10-25 09:48 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 07:46 - 2013-10-25 09:48 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 07:46 - 2013-10-25 09:48 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-03 12:25 - 2013-10-03 12:25 - 00000804 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-03 12:25 - 2013-10-03 12:25 - 00000000 ____D C:\Program Files\CCleaner
2013-10-03 12:24 - 2013-10-03 12:24 - 04369632 _____ (Piriform Ltd) C:\Users\T\Downloads\ccsetup406.exe

Files to move or delete:
====================
C:\Users\Administrator\jagex_cl_oldschool_LIVE.dat
C:\Users\Administrator\jagex_cl_runescape_LIVE.dat
C:\Users\Administrator\random.dat


Some content of TEMP:
====================
C:\Users\Rosco\AppData\Local\Temp\APNSetup.exe
C:\Users\Rosco\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\T\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 23:29

==================== End Of Log ============================



Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by T at 2013-11-01 23:41:28
Running from C:\Users\T\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Acrobat Reader 3.01
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Belarc Advisor 8.2 (Version: 8.2.7.16)
Camera Assistant Software for Gateway (Version: 1.7.077.1117)
CCleaner (Version: 4.06)
Conexant HD Audio (Version: 4.75.0.0)
D3DX10 (Version: 15.4.2368.0902)
FLV Media Player version 1.3 (Version: 1.3)
Google Chrome (Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
HDAUDIO Soft Data Fax Modem with SmartCP (Version: 7.80.2.0)
Intel® Graphics Media Accelerator Driver (Version: 8.15.10.2869)
iTunes (Version: 11.0.3.42)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Jewel Match: Winter Wonderland
Junk Mail filter update (Version: 15.4.3502.0922)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Security Client (Version: 4.3.0219.0)
Microsoft Security Essentials (Version: 4.3.219.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
MSVCRT (Version: 15.4.2862.0708)
Pogo Games (Version: 1.0)
QuickTime (Version: 7.73.80.64)
Segoe UI (Version: 15.4.2271.0615)
Skype™ 6.9 (Version: 6.9.106)
System Requirements Lab for Intel (Version: 4.5.15.0)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
VLC media player 2.0.6 (Version: 2.0.6)
Warframe (Version: 1.0.0)
Windows Driver Package - Intel (NETw5v32) net (05/14/2009 12.4.1.11) (Version: 05/14/2009 12.4.1.11)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)

==================== Restore Points =========================

26-10-2013 16:17:54 Scheduled Checkpoint
27-10-2013 13:00:06 Scheduled Checkpoint
28-10-2013 04:33:20 Scheduled Checkpoint
28-10-2013 10:01:29 Windows Update
29-10-2013 04:10:17 Scheduled Checkpoint
30-10-2013 09:54:04 Scheduled Checkpoint
31-10-2013 04:46:36 Scheduled Checkpoint
31-10-2013 17:23:43 Scheduled Checkpoint
01-11-2013 07:31:54 Removed Ask Toolbar
01-11-2013 07:36:46 Removed Ask Toolbar
01-11-2013 07:48:20 Quitado VAFPlayer
01-11-2013 07:49:18 Removed Bonjour
01-11-2013 09:58:40 Windows Update
02-11-2013 07:09:29 Scheduled Checkpoint

==================== Hosts content: ==========================

2006-11-02 00:23 - 2006-09-18 11:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2DF61206-9174-408D-A865-4C2F78C31F6E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {334B1EFB-B613-4F92-B22D-69504A5B3CCD} - System32\Tasks\RunAsStdUser Task => C:\Program Files\Pogo Games\PogoDGC.exe [2013-03-25] (iWin Inc.)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\System32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {482740D4-A66F-4B74-9684-091455FEAAD4} - System32\Tasks\GlaryInitialize => C:\Program Files\Glary Utilities\initialize.exe
Task: {9D3D6944-CFE1-4EDD-9F36-9A22149925AE} - System32\Tasks\VisualBeeRecovery => C:\Users\Rosco\AppData\Local\VisualBeeExe\VisualBeeRecovery.exe
Task: {B4F0AB2E-A710-4D8B-A211-1D2A7A54B6D7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {CD3D61EA-5897-42C0-96D2-B2ED8347BA4F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-08] (Adobe Systems Incorporated)
Task: {D6DD6DA7-CD6C-4C77-970F-B3E5D3C17216} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-01-31] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\System32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {EE39A54B-2FEB-4EB0-9425-E30E23FF4091} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-01-31] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-10-15 06:48 - 2013-10-08 14:02 - 04055504 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
2013-10-15 06:48 - 2013-10-08 14:02 - 00415184 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
2013-10-15 06:48 - 2013-10-08 14:01 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll
2013-10-15 06:48 - 2013-10-08 14:01 - 00698832 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
2013-10-15 06:48 - 2013-10-08 14:01 - 00099792 _____ () C:\Program Files\Google\Chrome\Application\30.0.1599.101\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2013-10-28 00:02:34.455
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:34.315
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:34.190
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:34.065
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:15.173
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:15.017
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:14.893
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:14.752
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:14.487
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-10-28 00:02:14.347
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Microsoft Security Client\Drivers\Backup\NisDrv\NisDrvWFP.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Percentage of memory in use: 35%
Total physical RAM: 2936 MB
Available physical RAM: 1884.5 MB
Total Pagefile: 7444.27 MB
Available Pagefile: 6363.57 MB
Total Virtual: 2047.88 MB
Available Virtual: 1905.92 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:144.21 GB) (Free:95.62 GB) NTFS
Drive d: () (Fixed) (Total:4.82 GB) (Free:4.72 GB) FAT32 ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 169D169C)
Partition 1: (Active) - (Size=5 GB) - (Type=0B)
Partition 2: (Not Active) - (Size=144 GB) - (Type=07 NTFS)

==================== End Of Log ============================

OTL

Spoiler

OTL logfile created on: 01/11/2013 11:46:35 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd/MM/yyyy

2.87 Gb Total Physical Memory | 1.86 Gb Available Physical Memory | 64.91% Memory free
7.27 Gb Paging File | 6.24 Gb Available in Paging File | 85.80% Paging File free
Paging file location(s): c:\pagefile.sys 4600 6600 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144.21 Gb Total Space | 95.62 Gb Free Space | 66.30% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 4.72 Gb Free Space | 97.83% Space Free | Partition Type: FAT32

Computer Name: ROSCO-PC | User Name: T | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/10/30 21:37:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
PRC - [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2013/08/12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/08/12 10:11:20 | 000,995,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/03/25 05:20:50 | 000,520,360 | ---- | M] (iWin Inc.) -- C:\Program Files\Pogo Games\PGMTrusted.exe
PRC - [2009/04/10 20:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2013/10/08 14:02:43 | 000,415,184 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppgooglenaclpluginchrome.dll
MOD - [2013/10/08 14:02:41 | 004,055,504 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
MOD - [2013/10/08 14:01:50 | 000,698,832 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
MOD - [2013/10/08 14:01:49 | 000,099,792 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\libegl.dll
MOD - [2013/10/08 14:01:47 | 001,604,560 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll


========== Services (SafeList) ==========

SRV - [2013/10/08 16:22:44 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/09/05 10:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/08/12 10:12:38 | 000,295,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013/08/12 10:12:38 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/03/25 05:20:50 | 000,520,360 | ---- | M] (iWin Inc.) [Auto | Running] -- C:\Program Files\Pogo Games\PGMTrusted.exe -- (PGMTrusted)
SRV - [2010/02/20 13:05:18 | 000,373,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2009/04/10 20:28:17 | 000,052,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2008/11/04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)
SRV - [2008/01/20 16:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- E:\NTGLM7X.sys -- (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Glary Utilities 3\ProcObsrv.sys -- (ProcObsrv)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- E:\INSTALL\GMSIPCI.SYS -- (GMSIPCI)
DRV - [2013/06/18 21:50:08 | 000,107,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010/03/15 07:44:48 | 000,127,488 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009/05/14 08:40:38 | 004,231,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2009/04/10 18:45:24 | 000,113,664 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2008/11/04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)
DRV - [2008/09/18 03:14:44 | 000,251,392 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2008/06/26 16:23:12 | 000,011,264 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV - [2008/01/20 16:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
DRV - [2008/01/20 16:23:02 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006/11/01 21:30:56 | 002,589,184 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw2v32.sys -- (NETw2v32)
DRV - [2005/11/14 13:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 75 05 5B 09 AD 8E CE 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...1I7NDKB_enUS521
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: c:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: c:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)


[2013/07/25 04:38:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Ask Search (Enabled)
CHR - default_search_provider: search_url = http://www.search.as...q={searchTerms}
CHR - default_search_provider: suggest_url = http://ss.websearch....q={searchTerms},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\30.0.1599.101\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Acrobat3\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.3 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Disabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Disabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Disabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll
CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Disabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Disabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Docs = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0\
CHR - Extension: Google Search = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: MixiDJ V45 = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.16.70.1_0\
CHR - Extension: Gmail = C:\Users\T\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006/09/18 11:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Activities present
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.200.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C4BE43AF-278C-44F2-9144-9860E01511D5}: DhcpNameServer = 192.168.200.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 11:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004/09/13 19:15:24 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{37c53c14-77ca-11e2-b28c-00238b48e0fc}\Shell - "" = AutoRun
O33 - MountPoints2\{37c53c14-77ca-11e2-b28c-00238b48e0fc}\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - StartUpReg: ApnTBMon - hkey= - key= - File not found
MsConfig - StartUpReg: APSDaemon - hkey= - key= - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
MsConfig - StartUpReg: Camera Assistant Software - hkey= - key= - C:\Program Files\Camera Assistant Software for Gateway\traybar.exe (Chicony)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Oracle Corporation)
MsConfig - StartUpReg: swg - hkey= - key= - File not found
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\30.0.1599.101\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/11/01 23:40:28 | 000,000,000 | ---D | C] -- C:\FRST
[2013/11/01 23:33:14 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/10/31 21:48:42 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/10/30 21:37:52 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
[2013/10/28 00:03:43 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/10/28 00:03:42 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/10/28 00:03:41 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/10/28 00:03:41 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/10/28 00:03:41 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/10/28 00:03:40 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/10/28 00:03:39 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/10/28 00:03:37 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/10/25 09:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2013/10/25 09:48:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2013/10/25 09:48:12 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2013/10/25 09:48:03 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2013/10/25 09:48:03 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2013/10/25 09:48:03 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2013/10/25 09:48:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2013/10/23 22:18:24 | 000,000,000 | ---D | C] -- C:\Users\T\AppData\Roaming\GlarySoft
[2013/10/13 15:28:13 | 000,000,000 | ---D | C] -- C:\Users\T\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Warframe
[2013/10/09 21:50:35 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2013/10/09 21:50:35 | 001,069,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2013/10/09 21:50:35 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2013/10/09 21:50:35 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2013/10/09 21:50:35 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2013/10/09 21:50:35 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2013/10/09 21:50:35 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2013/10/09 21:50:35 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2013/10/09 21:50:06 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013/10/09 21:49:37 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
[2013/10/09 21:49:09 | 002,050,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013/10/09 21:47:43 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2013/10/09 21:47:43 | 000,006,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2013/10/09 21:46:18 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013/10/09 21:46:18 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013/10/09 21:45:32 | 000,025,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidparse.sys
[2013/10/03 12:25:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2013/10/03 12:25:20 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2013/11/01 23:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/11/01 23:23:34 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/11/01 23:23:05 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/11/01 23:23:05 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/11/01 23:22:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/11/01 23:22:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/10/30 21:37:54 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\T\Desktop\OTL.exe
[2013/10/30 21:05:07 | 000,230,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/10/28 18:37:01 | 000,640,658 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/10/28 18:37:00 | 000,118,878 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/10/28 00:03:12 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013/10/15 06:48:22 | 000,001,971 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/10/08 16:22:43 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013/10/08 16:22:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/10/08 07:50:41 | 000,094,632 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2013/10/08 07:46:52 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2013/10/08 07:46:47 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2013/10/08 07:46:23 | 000,174,504 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2013/10/03 12:25:29 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2013/10/03 12:25:29 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013/09/23 22:39:25 | 000,000,680 | ---- | C] () -- C:\Users\T\AppData\Local\d3d9caps.dat
[2013/07/25 23:26:11 | 000,019,744 | ---- | C] () -- C:\Windows\System32\RegBootDefrag.exe
[2013/03/03 17:51:30 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2013/03/03 17:51:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2013/02/04 09:44:43 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012/11/13 15:43:38 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012/11/13 15:43:36 | 000,000,259 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

========== ZeroAccess Check ==========

[2006/11/02 02:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 07:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/10 20:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/10 20:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: ST9160821AS ATA Device
Partitions: 2
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 5.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 144.00GB
Starting Offset: 5190451200
Hidden sectors: 0


< %SYSTEMDRIVE%\*.exe >

< %systemroot%\assembly\GAC_32\*.ini >

< %systemroot%\assembly\GAC_64\*.ini >

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*.exe >

< %APPDATA%\*. >
[2013/09/27 20:42:42 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\.minecraft
[2013/07/26 12:44:23 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Adobe
[2013/07/26 11:47:20 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Apple Computer
[2013/10/23 22:18:24 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\GlarySoft
[2013/07/26 11:47:06 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Identities
[2013/07/26 12:50:00 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Macromedia
[2006/11/02 02:37:34 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Media Center Programs
[2013/10/13 15:28:14 | 000,000,000 | --SD | M] -- C:\Users\T\AppData\Roaming\Microsoft
[2013/10/30 17:56:22 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\Skype
[2013/08/29 21:42:34 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\SystemRequirementsLab
[2013/09/16 23:58:38 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\U3
[2013/09/26 17:45:21 | 000,000,000 | ---D | M] -- C:\Users\T\AppData\Roaming\vlc

< MD5 for: ATAPI.SYS >
[2009/04/10 20:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009/04/10 20:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/10 20:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/20 16:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/20 16:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/01 23:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

< MD5 for: CSRSS.EXE >
[2008/01/20 16:24:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=ABCA209EBA02CB59233614DB83B4F50D -- C:\Windows\System32\csrss.exe
[2008/01/20 16:24:54 | 000,006,144 | ---- | M] (Microsoft Corporation) MD5=ABCA209EBA02CB59233614DB83B4F50D -- C:\Windows\winsxs\x86_microsoft-windows-csrss_31bf3856ad364e35_6.0.6001.18000_none_58e3e3d7e415ae4c\csrss.exe

< MD5 for: EXPLORER.EXE >
[2008/10/28 20:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/28 20:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/29 17:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/10 20:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/10 20:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/27 16:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 16:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: MSWSOCK.DLL >
[2009/04/10 20:28:22 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=8617350C9B590B63E620881092751BCB -- C:\Windows\System32\mswsock.dll
[2009/04/10 20:28:22 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=8617350C9B590B63E620881092751BCB -- C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.0.6002.18005_none_ba3ed0122a6d89da\mswsock.dll
[2008/01/20 16:24:02 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=89FD0595EEA4E505CABEFCF7008F2612 -- C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.0.6001.18000_none_b85357062d4bbe8e\mswsock.dll

< MD5 for: NAPINSP.DLL >
[2008/01/20 16:24:29 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=FC62A635063B762E1C3C60EA77279378 -- C:\Windows\System32\NapiNSP.dll
[2008/01/20 16:24:29 | 000,050,176 | ---- | M] (Microsoft Corporation) MD5=FC62A635063B762E1C3C60EA77279378 -- C:\Windows\winsxs\x86_microsoft-windows-n..ider-infrastructure_31bf3856ad364e35_6.0.6001.18000_none_ac1d40c88f30e6c0\NapiNSP.dll

< MD5 for: NLAAPI.DLL >
[2008/01/20 16:23:44 | 000,048,128 | ---- | M] (Microsoft Corporation) MD5=D1A84F7D4CAFCFE2A32149FF418056E5 -- C:\Windows\System32\nlaapi.dll
[2008/01/20 16:23:44 | 000,048,128 | ---- | M] (Microsoft Corporation) MD5=D1A84F7D4CAFCFE2A32149FF418056E5 -- C:\Windows\winsxs\x86_microsoft-windows-nlasvc_31bf3856ad364e35_6.0.6001.18000_none_6785f5c70aea4565\nlaapi.dll

< MD5 for: PNRPNSP.DLL >
[2008/01/20 16:25:26 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=690D41DF1D555F96D4898A0F54EBA065 -- C:\Windows\System32\pnrpnsp.dll
[2008/01/20 16:25:26 | 000,062,464 | ---- | M] (Microsoft Corporation) MD5=690D41DF1D555F96D4898A0F54EBA065 -- C:\Windows\winsxs\x86_microsoft-windows-peertopeerpnrp_31bf3856ad364e35_6.0.6001.18000_none_717f15b322749509\pnrpnsp.dll

< MD5 for: SERVICES.EXE >
[2008/01/20 16:24:48 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2009/04/10 20:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\System32\services.exe
[2009/04/10 20:27:59 | 000,279,552 | ---- | M] (Microsoft Corporation) MD5=D4E6D91C1349B7BFB3599A6ADA56851B -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

< MD5 for: SVCHOST.EXE >
[2008/01/20 16:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008/01/20 16:23:43 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: USER32.DLL >
[2009/04/10 20:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009/04/10 20:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008/01/20 16:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

< MD5 for: USERINIT.EXE >
[2008/01/20 16:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/20 16:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/04/10 20:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/10 20:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/20 16:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< MD5 for: WINRNR.DLL >
[2009/04/10 20:28:25 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C411C80F90D6732380352B98B37BBD53 -- C:\Windows\System32\winrnr.dll
[2009/04/10 20:28:25 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=C411C80F90D6732380352B98B37BBD53 -- C:\Windows\winsxs\x86_microsoft-windows-dns-client-winrnr_31bf3856ad364e35_6.0.6002.18005_none_5b39cbfb4d3802b6\winrnr.dll
[2006/11/01 23:46:14 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=FF78B8E67EDCE9FEED651D7858D77A04 -- C:\Windows\winsxs\x86_microsoft-windows-dns-client-winrnr_31bf3856ad364e35_6.0.6000.16386_none_571790f3532b2696\winrnr.dll

< MD5 for: WSHELPER.DLL >
[2006/11/01 23:46:14 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=20614C9F12A3A09A5015C9EBBD4419D2 -- C:\Windows\System32\wshelper.dll
[2006/11/01 23:46:14 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=20614C9F12A3A09A5015C9EBBD4419D2 -- C:\Windows\winsxs\x86_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6000.16386_none_024e4071fa6fea95\wshelper.dll

< dir C:\ /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is 8E4A-C6CB
Directory of C:\
02/11/2006 03:02 AM <JUNCTION> Documents and Settings [C:\Users]
0 File(s) 0 bytes
Directory of C:\ProgramData
02/11/2006 03:02 AM <JUNCTION> Application Data [C:\ProgramData]
02/11/2006 03:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
02/11/2006 03:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
02/11/2006 03:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
02/11/2006 03:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
02/11/2006 03:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users
02/11/2006 03:02 AM <SYMLINKD> All Users [C:\ProgramData]
02/11/2006 03:02 AM <JUNCTION> Default User [C:\Users\Default]
0 File(s) 0 bytes
Directory of C:\Users\Administrator
30/08/2012 08:04 PM <JUNCTION> Application Data [C:\Users\Administrator\AppData\Roaming]
30/08/2012 08:04 PM <JUNCTION> Cookies [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies]
30/08/2012 08:04 PM <JUNCTION> Local Settings [C:\Users\Administrator\AppData\Local]
30/08/2012 08:04 PM <JUNCTION> My Documents [C:\Users\Administrator\Documents]
30/08/2012 08:04 PM <JUNCTION> NetHood [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
30/08/2012 08:04 PM <JUNCTION> PrintHood [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
30/08/2012 08:04 PM <JUNCTION> Recent [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent]
30/08/2012 08:04 PM <JUNCTION> SendTo [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\SendTo]
30/08/2012 08:04 PM <JUNCTION> Start Menu [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu]
30/08/2012 08:04 PM <JUNCTION> Templates [C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Administrator\AppData\Local
30/08/2012 08:04 PM <JUNCTION> Application Data [C:\Users\Administrator\AppData\Local]
30/08/2012 08:04 PM <JUNCTION> History [C:\Users\Administrator\AppData\Local\Microsoft\Windows\History]
30/08/2012 08:04 PM <JUNCTION> Temporary Internet Files [C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Administrator\Documents
30/08/2012 08:04 PM <JUNCTION> My Music [C:\Users\Administrator\Music]
30/08/2012 08:04 PM <JUNCTION> My Pictures [C:\Users\Administrator\Pictures]
30/08/2012 08:04 PM <JUNCTION> My Videos [C:\Users\Administrator\Videos]
0 File(s) 0 bytes
Directory of C:\Users\All Users
02/11/2006 03:02 AM <JUNCTION> Application Data [C:\ProgramData]
02/11/2006 03:02 AM <JUNCTION> Desktop [C:\Users\Public\Desktop]
02/11/2006 03:02 AM <JUNCTION> Documents [C:\Users\Public\Documents]
02/11/2006 03:02 AM <JUNCTION> Favorites [C:\Users\Public\Favorites]
02/11/2006 03:02 AM <JUNCTION> Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
02/11/2006 03:02 AM <JUNCTION> Templates [C:\ProgramData\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default
02/11/2006 03:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
02/11/2006 03:02 AM <JUNCTION> Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
02/11/2006 03:02 AM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
02/11/2006 03:02 AM <JUNCTION> My Documents [C:\Users\Default\Documents]
02/11/2006 03:02 AM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
02/11/2006 03:02 AM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
02/11/2006 03:02 AM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
02/11/2006 03:02 AM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
02/11/2006 03:02 AM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
02/11/2006 03:02 AM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Default\AppData\Local
02/11/2006 03:02 AM <JUNCTION> Application Data [C:\Users\Default\AppData\Local]
02/11/2006 03:02 AM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
02/11/2006 03:02 AM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Default\Documents
02/11/2006 03:02 AM <JUNCTION> My Music [C:\Users\Default\Music]
02/11/2006 03:02 AM <JUNCTION> My Pictures [C:\Users\Default\Pictures]
02/11/2006 03:02 AM <JUNCTION> My Videos [C:\Users\Default\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Public\Documents
02/11/2006 03:02 AM <JUNCTION> My Music [C:\Users\Public\Music]
02/11/2006 03:02 AM <JUNCTION> My Pictures [C:\Users\Public\Pictures]
02/11/2006 03:02 AM <JUNCTION> My Videos [C:\Users\Public\Videos]
0 File(s) 0 bytes
Directory of C:\Users\Rosco
02/10/2011 10:40 PM <JUNCTION> Application Data [C:\Users\Rosco\AppData\Roaming]
02/10/2011 10:40 PM <JUNCTION> Cookies [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Cookies]
02/10/2011 10:40 PM <JUNCTION> Local Settings [C:\Users\Rosco\AppData\Local]
02/10/2011 10:40 PM <JUNCTION> My Documents [C:\Users\Rosco\Documents]
02/10/2011 10:40 PM <JUNCTION> NetHood [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
02/10/2011 10:40 PM <JUNCTION> PrintHood [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
02/10/2011 10:40 PM <JUNCTION> Recent [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Recent]
02/10/2011 10:40 PM <JUNCTION> SendTo [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\SendTo]
02/10/2011 10:40 PM <JUNCTION> Start Menu [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Start Menu]
02/10/2011 10:40 PM <JUNCTION> Templates [C:\Users\Rosco\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\Rosco\AppData\Local
02/10/2011 10:40 PM <JUNCTION> Application Data [C:\Users\Rosco\AppData\Local]
02/10/2011 10:40 PM <JUNCTION> History [C:\Users\Rosco\AppData\Local\Microsoft\Windows\History]
02/10/2011 10:40 PM <JUNCTION> Temporary Internet Files [C:\Users\Rosco\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\Rosco\Documents
02/10/2011 10:40 PM <JUNCTION> My Music [C:\Users\Rosco\Music]
02/10/2011 10:40 PM <JUNCTION> My Pictures [C:\Users\Rosco\Pictures]
02/10/2011 10:40 PM <JUNCTION> My Videos [C:\Users\Rosco\Videos]
0 File(s) 0 bytes
Directory of C:\Users\T
26/07/2013 11:47 AM <JUNCTION> Application Data [C:\Users\T\AppData\Roaming]
26/07/2013 11:47 AM <JUNCTION> Cookies [C:\Users\T\AppData\Roaming\Microsoft\Windows\Cookies]
26/07/2013 11:47 AM <JUNCTION> Local Settings [C:\Users\T\AppData\Local]
26/07/2013 11:47 AM <JUNCTION> My Documents [C:\Users\T\Documents]
26/07/2013 11:47 AM <JUNCTION> NetHood [C:\Users\T\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
26/07/2013 11:47 AM <JUNCTION> PrintHood [C:\Users\T\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
26/07/2013 11:47 AM <JUNCTION> Recent [C:\Users\T\AppData\Roaming\Microsoft\Windows\Recent]
26/07/2013 11:47 AM <JUNCTION> SendTo [C:\Users\T\AppData\Roaming\Microsoft\Windows\SendTo]
26/07/2013 11:47 AM <JUNCTION> Start Menu [C:\Users\T\AppData\Roaming\Microsoft\Windows\Start Menu]
26/07/2013 11:47 AM <JUNCTION> Templates [C:\Users\T\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Users\T\AppData\Local
26/07/2013 11:47 AM <JUNCTION> Application Data [C:\Users\T\AppData\Local]
26/07/2013 11:47 AM <JUNCTION> History [C:\Users\T\AppData\Local\Microsoft\Windows\History]
26/07/2013 11:47 AM <JUNCTION> Temporary Internet Files [C:\Users\T\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Users\T\Documents
26/07/2013 11:47 AM <JUNCTION> My Music [C:\Users\T\Music]
26/07/2013 11:47 AM <JUNCTION> My Pictures [C:\Users\T\Pictures]
26/07/2013 11:47 AM <JUNCTION> My Videos [C:\Users\T\Videos]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile
19/04/2013 08:24 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Roaming]
19/04/2013 08:24 PM <JUNCTION> Cookies [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies]
19/04/2013 08:24 PM <JUNCTION> Local Settings [C:\Windows\system32\config\systemprofile\AppData\Local]
19/04/2013 08:24 PM <JUNCTION> My Documents [C:\Windows\system32\config\systemprofile\Documents]
19/04/2013 08:24 PM <JUNCTION> NetHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
19/04/2013 08:24 PM <JUNCTION> PrintHood [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
19/04/2013 08:24 PM <JUNCTION> Recent [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent]
19/04/2013 08:24 PM <JUNCTION> SendTo [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo]
19/04/2013 08:24 PM <JUNCTION> Start Menu [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu]
19/04/2013 08:24 PM <JUNCTION> Templates [C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\AppData\Local
19/04/2013 08:24 PM <JUNCTION> Application Data [C:\Windows\system32\config\systemprofile\AppData\Local]
19/04/2013 08:24 PM <JUNCTION> History [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History]
19/04/2013 08:24 PM <JUNCTION> Temporary Internet Files [C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files]
0 File(s) 0 bytes
Directory of C:\Windows\System32\config\systemprofile\Documents
19/04/2013 08:24 PM <JUNCTION> My Music [C:\Windows\system32\config\systemprofile\Music]
19/04/2013 08:24 PM <JUNCTION> My Pictures [C:\Windows\system32\config\systemprofile\Pictures]
19/04/2013 08:24 PM <JUNCTION> My Videos [C:\Windows\system32\config\systemprofile\Videos]
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
98 Dir(s) 102,608,273,408 bytes free

< C:\Windows\assembly\tmp\U\*.* /s >

< %systemroot%\*. /mp /s >

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2013/09/22 00:59:54 | 000,757,400 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2013/09/22 00:59:54 | 000,757,400 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --make-default-browser [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --hide-icons [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files\Google\Chrome\Application\chrome.exe" --show-icons [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files\Google\Chrome\Application\chrome.exe" [2013/10/08 14:02:45 | 000,844,752 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\system32\ie4uinit.exe" -hide [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\system32\ie4uinit.exe" -show [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\system32\ie4uinit.exe" -reinstall [2013/05/29 18:03:08 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2013/09/22 00:59:54 | 000,757,400 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2013/09/22 00:59:54 | 000,757,400 | ---- | M] (Microsoft Corporation)

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %ProgramFiles%\WINDOWS NT\*.* /s >
[2010/06/28 04:54:38 | 000,339,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\WINDOWS NT\Accessories\wordpad.exe
[2006/11/02 02:41:31 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files\WINDOWS NT\Accessories\en-US\wordpad.exe.mui
[2009/04/10 20:28:24 | 000,324,608 | ---- | M] (Microsoft Corporation) -- C:\Program Files\WINDOWS NT\TableTextService\TableTextService.dll
[2006/09/19 01:43:31 | 000,016,212 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceAmharic.txt
[2009/02/18 08:39:57 | 001,272,752 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceArray.txt
[2009/02/18 08:39:57 | 000,980,032 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceDaYi.txt
[2009/02/18 08:39:58 | 001,665,878 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt
[2009/02/18 08:39:58 | 001,445,430 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt
[2009/02/18 08:40:01 | 001,810,352 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt
[2006/09/19 01:43:34 | 000,044,968 | ---- | M] () -- C:\Program Files\WINDOWS NT\TableTextService\TableTextServiceYi.txt
[2009/04/10 20:23:33 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Program Files\WINDOWS NT\TableTextService\en-US\TableTextService.dll.mui

< %systemroot%\system32\drivers\*.sys /lockedfiles >

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:373E1720

< End of report >





OTL Extras logfile created on: 01/11/2013 11:46:35 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: dd/MM/yyyy

2.87 Gb Total Physical Memory | 1.86 Gb Available Physical Memory | 64.91% Memory free
7.27 Gb Paging File | 6.24 Gb Available in Paging File | 85.80% Paging File free
Paging file location(s): c:\pagefile.sys 4600 6600 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144.21 Gb Total Space | 95.62 Gb Free Space | 66.30% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 4.72 Gb Free Space | 97.83% Space Free | Partition Type: FAT32

Computer Name: ROSCO-PC | User Name: T | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- "%1" %*
.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
.cmd [@ = cmdfile] -- "%1" %*
.com [@ = comfile] -- "%1" %*
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.exe [@ = exefile] -- "%1" %*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] -- C:\Windows\System32\mshta.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
.inf [@ = inffile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.pif [@ = piffile] -- "%1" %*
.reg [@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)
.scr [@ = scrfile] -- "%1" /S
.txt [@ = txtfile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] -- "%1" %*
batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %*
cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- C:\Windows\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] -- regedit.exe "%1" (Microsoft Corporation)
regfile [merge] -- Reg Error: Key error.
regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-598869867-4264938955-1491418867-1000]
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0392F4CD-8F1C-446A-B01E-80C1776A2E99}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{06FDD7FF-F702-44D9-A047-7DA40B592BB0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{1186D64E-F21C-483A-B8F4-912F0C8161BF}" = lport=137 | protocol=17 | dir=in | app=system |
"{175D4CBF-B3B2-44F0-A03C-40AD3553BD3E}" = lport=445 | protocol=6 | dir=in | app=system |
"{19B84BE8-D1E5-4C49-84CF-04771AEF43C4}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{1BB6D9FE-0B82-47ED-9549-052E918B4F96}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{247664C8-6FD4-4E61-9E78-BD241665EAA5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{2E2615DF-1C10-4BF9-B32B-A3A05D8CDAED}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{37341C6D-7F74-41A7-9155-2B8892AEAED5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{3759143D-E2E8-453A-B4F0-5524E2B66B6E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{38A9AA8D-134C-47C0-88EF-C0BB525CACE8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{47F63127-B691-47BB-9EA8-6C64F05987C3}" = rport=445 | protocol=6 | dir=out | app=system |
"{62082A64-68E3-4BA5-B725-F3DEE8CAA160}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{66108294-CC47-45C8-9E27-48424C228102}" = lport=139 | protocol=6 | dir=in | app=system |
"{80E6BE8B-E78F-48A2-8834-84FC22B32872}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{8279608E-88DA-4078-A6F8-BEEDA7E282FD}" = rport=139 | protocol=6 | dir=out | app=system |
"{8884BDB7-1058-4100-8971-4E46B2F03DB9}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9A4FEA26-08AB-45DB-A64E-2A50FF03A0CE}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{C02122B6-0C59-48F1-8750-394443538CB3}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D552871B-5043-4A64-8C13-A7FCDFBE04E9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{E26DBCB4-78A4-4381-A320-E957009A2030}" = lport=138 | protocol=17 | dir=in | app=system |
"{E8CA52D6-3B71-41F2-A5B8-E6101E607E00}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EE8AF40B-0C9D-4D86-81C6-AD7790D6FAAC}" = rport=138 | protocol=17 | dir=out | app=system |
"{F0737BBA-0BE4-4BE1-ACA2-D958A01D43D5}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{FC49B697-EA8B-4169-BE59-115832AE2173}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05130E3F-4755-4914-9187-C235BC7A80D6}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{1105D7D7-BFB6-4499-94A7-453284097F7E}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{1202830A-EAC0-471E-B01A-9D08794F516F}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{132E1DBE-555B-4119-9B77-150042EBADC3}" = protocol=17 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{1A09B301-B825-4E1F-831A-F6391D58AE5A}" = protocol=17 | dir=in | app=c:\program files\windows defender\msascui.exe |
"{1D00346C-7B89-496A-858B-448D6885FF8B}" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{2A47AD38-16AD-4285-8275-BC27540A10B0}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{2AEF56CA-4D1E-456A-A412-26F8B0300C5F}" = protocol=58 | dir=out | [email protected],-28546 |
"{2D3751A0-1EA2-4AE3-B74D-352636AFD47A}" = protocol=6 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{2DEEE9FD-581C-4927-B506-7A0B20139EEC}" = protocol=6 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"{31C50A7E-C75F-489C-B76C-41BDAEA68795}" = protocol=58 | dir=in | [email protected],-28545 |
"{3287ABA2-694A-4179-B033-5A853EB7DF07}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{3550DDDC-0B98-41BD-B588-9431EA9C7DBC}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{3EA65A5E-F888-463D-BB7B-E3A406F1C861}" = protocol=1 | dir=in | [email protected],-28543 |
"{42512F4C-EA0C-4C46-8673-5FE3FF4552A5}" = protocol=6 | dir=out | app=system |
"{436F3600-65B2-428B-94C8-D7152EDCD936}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\remotecrashsender.exe |
"{466A79B3-9CA2-4930-81E2-583504AB479F}" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"{467FA57E-8124-4579-B9C6-2FED32D163B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4D570EFF-67A9-4CDB-BF15-7E6142C70B4B}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{69E4E3A9-0B14-4421-A85E-C6C160D7F0FD}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6F940A9C-04B5-4DD9-8801-0F75F81CD6CC}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{71B15798-129E-4CCF-8325-662B37BDB16F}" = protocol=17 | dir=in | app=c:\program files\pogo games\webupdater.exe |
"{85E9FE8A-777E-4137-B0D5-32C8574D9EC0}" = protocol=17 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{8D004390-737E-47D8-84CB-D64450C151C7}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8D92C2DA-ABA6-48E7-BB24-FCE61AD82460}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{8DDA6B4C-6386-4BD7-B578-58F4CCA9D47A}" = protocol=17 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{94C8223F-87DB-44E8-9528-85FECF03A86D}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\launcher.exe |
"{954A32B5-EE72-439E-9498-719797D6EB32}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.x64.exe |
"{9C9059CE-4F8A-422A-AEDD-67C5D1379A12}" = protocol=1 | dir=out | [email protected],-28544 |
"{B6FD0C87-305A-4ACA-B9C3-09B237FE0C4F}" = protocol=6 | dir=in | app=c:\program files\pogo games\pogodgc.exe |
"{BFEB8555-0562-4A9E-B341-B13B2F79CABA}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"{C1B972E1-0A80-4AC6-A4F9-AE4988DE0F6F}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{C621E957-0B48-4DF4-AF96-D4EEC6E4D0C6}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{E0F7E863-AB7B-4321-83A2-1CCF3A8A875A}" = protocol=17 | dir=in | app=c:\program files\google\chrome\application\chrome.exe |
"{E9003816-0813-467F-B7DD-50C4012C0B11}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{EC15F3D0-D29D-44D7-8E72-FA014BB2C6BE}" = protocol=6 | dir=out | app=c:\users\t\appdata\local\warframe\downloaded\public\tools\launcher.exe |
"{F79C82CD-21DA-49FF-B3C0-7EF0C230A274}" = protocol=6 | dir=in | app=c:\program files\pogo games\webupdater.exe |
"{F9EA74DA-FF3E-45B0-ACAE-6A9B4ED51C82}" = protocol=6 | dir=in | app=c:\program files\windows defender\msascui.exe |
"{FA3ED778-BA60-4C3F-9074-4294E0EB7452}" = protocol=17 | dir=in | app=c:\users\t\appdata\local\warframe\downloaded\public\warframe.exe |
"TCP Query User{63489769-A7A8-401C-B6B4-64CE8577A00F}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"TCP Query User{75496244-83C8-4B2F-B290-DAE7C671C991}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"UDP Query User{89A40A6F-8718-439A-A1D8-6296653928B9}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |
"UDP Query User{B9A1BCF9-8E5D-439D-9031-7174813779F0}C:\users\rosco\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\rosco\appdata\roaming\spotify\spotify.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E08BAC8-845B-4327-8CDB-4B0F8C9857A5}_is1" = FLV Media Player version 1.3
"{11E568E0-3244-4BCB-875E-F334269DFDCB}" = iTunes
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 45
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D24F198-A2CB-46B5-BB16-41B69C644B6C}" = Microsoft Security Client
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.9
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{53C63F43-B827-42D9-8886-4698D91EA33B}" = System Requirements Lab for Intel
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97FFE5B0-D264-45A7-A7E0-758C7B488F73}" = Warframe
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Graphics Media Accelerator Driver
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Acrobat Reader 3.01" = Adobe Acrobat Reader 3.01
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Belarc Advisor" = Belarc Advisor 8.2
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"F5E2C08F5DFFC049AF4EA7617C2ADBBCB8CA8D78" = Windows Driver Package - Intel (NETw5v32) net (05/14/2009 12.4.1.11)
"Google Chrome" = Google Chrome
"Jewel Match: Winter Wonderland" = Jewel Match: Winter Wonderland
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"PogoDGC" = Pogo Games
"VLC media player" = VLC media player 2.0.6
"WinLiveSuite" = Windows Live Essentials

< End of report >

Edited by JustTrevor, 02 November 2013 - 03:56 AM.

[JustTrevor]

Specy thing.

Attached Files

•  speccy.txt   250.34KB   95 downloads

[RKinner]

Speccy says your hard drive is on the way out:

07 Seek Error Rate 081 (060) Data 0008BA1BAD
C3 Hardware ECC Recovered 061 (057) Data 000125DEC0
C7 UltraDMA CRC Error Count 200 (200) Data 000000000A

Make sure you back up any data you don't want to lose. Consider buying a new drive and cloning the old one before it fails completely.

Speccy also thinks your laptop is a bit warm. It's not critical yet but make sure you run it on a hard surface and keep the air vents clear. A laptop cooler tray would be a good idea. You can get Speedfan:

http://www.almico.com/sfdownload.php

Download, save and Install it (Win 7 or Vista right click and Run As Admin.) then run it.

It will tell you your temps. If they seem hot (over 50) then check Automatic Fan Speed.
Leave it running and see if the temps drop.
Also prop up the back of the laptop with a book (don't block the vents). Propping it up in the back lets the heat rise to the heatsink which should make it cool a bit better.

VEW failed because you forgot to right click and Run As Admin. What it does is show me what errors you are getting during a reboot. Sometimes malware will damage critical services and these will show up in the logs. Mostly what I am seeing is a lot of adware.

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.

Uninstall

Adobe Acrobat Reader 3.01 This is terribly out of date and dangerous to have. You should go to Adobe.com and download the latest version of Reader which is 11.something. Wait a second after you click on Reader then uncheck the foistware (Optional Software) then download and install.

Your Microsoft Security Essentials has some sort of problem and really isn't much of an anti-virus. I would uninstall it and install the free version of Avast which is what I use on all of my PCs:

http://www.avast.com/index
Click on Download then choose the free version. (Uncheck the Chrome and Google Toolbar foistware). Decline the offer for a free trial or special offer and stick to the Basic version)
Uninstall Microsoft Security Essentials
See: http://support.micro....com/kb/2435760 if you have trouble uninstalling it
Reboot and install the free Avast by right clicking and Run As Admin.
When you register they will try and talk you in to the paid version but be firm.

Stick with Avast for a while and see how you like it. Some people object to the voice notification of updates. To turn it off, click on the Avast ball then on Settings then on Appearance. Then on Sounds and uncheck Automatic Updates OK. (It will still update it just won't tell you about in a loud voice in the middle of the night.)

They have also started using their info popup to try and get you to upgrade so I go into Settings, Appearance, Popups and change the first two to 1 second.

[JustTrevor]

Speccy says your hard drive is on the way out:


Make sure you back up any data you don't want to lose. Consider buying a new drive and cloning the old one before it fails completely.

Speccy also thinks your laptop is a bit warm. It's not critical yet but make sure you run it on a hard surface and keep the air vents clear. A laptop cooler tray would be a good idea. Mostly what I am seeing is a lot of adware.

Download the attached fixlist.txt to the same location as FRST
Run FRST and press Fix
A fix log will be generated please post that.

Well thats unfortunate that its failing. There anyway to know how long before it fails?

I do keep the laptop propped up on some sort of metal rack thing (I think its a paper tray) and I just turn it upside to get elevation, since it has decent sized holes for air. Maybe its the location of my desk. I'll try moving it to see, if not I do live in a sorta hot area.


I think I did the FRST thing correctly;

Spoiler

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 31-10-2013
Ran by T at 2013-11-02 14:15:35 Run:1
Running from C:\Users\T\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - DefaultScope value is missing.
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
CHR RestoreOnStartup: ""
CHR DefaultSearchURL: (Ask Search) - http://www.search.as...q={searchTerms}
CHR DefaultSuggestURL: (Ask Search) - http://ss.websearch....q={searchTerms}
CHR Plugin: (Java™ Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S3 GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS [x]
S3 ProcObsrv; \??\C:\Program Files\Glary Utilities 3\ProcObsrv.sys [x]
S3 SetupNTGLM7X; \??\E:\NTGLM7X.sys [x]
C:\Users\Administrator\jagex_cl_oldschool_LIVE.dat
C:\Users\Administrator\jagex_cl_runescape_LIVE.dat
C:\Users\Administrator\random.dat
C:\Users\Rosco\AppData\Local\Temp\APNSetup.exe
C:\Users\Rosco\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\T\AppData\Local\Temp\Quarantine.exe
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {482740D4-A66F-4B74-9684-091455FEAAD4} - System32\Tasks\GlaryInitialize => C:\Program Files\Glary Utilities\initialize.exe
Task: {9D3D6944-CFE1-4EDD-9F36-9A22149925AE} - System32\Tasks\VisualBeeRecovery => C:\Users\Rosco\AppData\Local\VisualBeeExe\VisualBeeRecovery.exe


*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
CHR RestoreOnStartup: "" ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: (Ask Search) - http://www.search.as...q={searchTerms} ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSuggestURL: (Ask Search) - http://ss.websearch....q={searchTerms} ==> The Chrome "Settings" can be used to fix the entry.
C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll => Moved successfully.
C:\Windows\system32\npDeployJava1.dll not found.
c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll not found.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
GMSIPCI => Service deleted successfully.
ProcObsrv => Service deleted successfully.
SetupNTGLM7X => Service deleted successfully.
C:\Users\Administrator\jagex_cl_oldschool_LIVE.dat => Moved successfully.
C:\Users\Administrator\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\Administrator\random.dat => Moved successfully.
"C:\Users\Rosco\AppData\Local\Temp\APNSetup.exe" => File/Directory not found.
"C:\Users\Rosco\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe" => File/Directory not found.
"C:\Users\T\AppData\Local\Temp\Quarantine.exe" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} => Key deleted successfully.
C:\Windows\System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Shell\CrawlStartPages => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{482740D4-A66F-4B74-9684-091455FEAAD4} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{482740D4-A66F-4B74-9684-091455FEAAD4} => Key deleted successfully.
C:\Windows\System32\Tasks\GlaryInitialize => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GlaryInitialize => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{9D3D6944-CFE1-4EDD-9F36-9A22149925AE} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9D3D6944-CFE1-4EDD-9F36-9A22149925AE} => Key deleted successfully.
C:\Windows\System32\Tasks\VisualBeeRecovery => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\VisualBeeRecovery => Key deleted successfully.

==== End of Fixlog ====

So is the harddrive failing the main reason for the symptoms? or is it more so the adware/malware?

[RKinner]

We've removed about all the adware that I can see so if it's still having slow periods then I'd say it was the hard drive.

If you have installed Avast then one night I would let it run a boot-time scan:
First mute the speakers so it won't wake you up when Windows loads.
Click on the Orange ball. Click on Scans. Change Quickscan to Boot-time Scan. Click on Settings. Where it says Heuristic Sensitivity click on the last rectangle so that all of them are orange and it says High. Check both boxes. Then change When a threat is found ... to: Move to Chest. OK. Now click on Start. Close the Avast window and then reboot. The scan will start. It will tell you where it will save the report. Usually it's
C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location. When Windows loads Click on the Orange Ball then Maintenance then Scan Logs. Click on the Boot-time scan log and then View Results. IF it found anything then open the saved Report and copy and paste the text into a reply so I can see it.

[RKinner]

I have my doubts about Pogo Games and VisualBee but I don't know they are bad so left them.