[jp17315]

This is my mother in laws computer that has lots of security warning especially when going to her bank sites.

 

Here is the OTL log:

 

OTL logfile created on: 4/27/2014 4:58:15 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\djokrall\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 0.77 Gb Available Physical Memory | 41.27% Memory free

3.99 Gb Paging File | 2.73 Gb Available in Paging File | 68.55% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 456.48 Gb Total Space | 353.89 Gb Free Space | 77.53% Space Free | Partition Type: NTFS

Drive D: | 9.28 Gb Total Space | 1.00 Gb Free Space | 10.75% Space Free | Partition Type: NTFS

 

Computer Name: DJOKRALL-PC | User Name: djokrall | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/04/27 16:58:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\djokrall\Downloads\OTL (2).exe

PRC - [2014/03/30 20:30:08 | 002,484,504 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

PRC - [2014/03/30 20:30:08 | 001,444,120 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

PRC - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe

PRC - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\NisSrv.exe

PRC - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe

PRC - [2014/03/11 10:13:14 | 000,951,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsSvc.exe

PRC - [2014/01/23 19:12:52 | 000,083,232 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsTray.exe

PRC - [2014/01/23 19:12:50 | 003,690,784 | ---- | M] (Sendori) -- C:\Program Files\PureLeads\plsapp.exe

PRC - [2014/01/23 19:12:50 | 000,024,352 | ---- | M] (sendori) -- C:\Program Files\PureLeads\PureLeads.Service.exe

PRC - [2014/01/15 10:00:12 | 035,256,640 | ---- | M] (SlimWare Utilities, Inc.) -- C:\Program Files\DriverUpdate\DriverUpdate.exe

PRC - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2013/09/11 14:36:49 | 000,620,480 | ---- | M] (Oberon Media ) -- C:\Program Files\GamesBar\update\SearchEngineProtection.exe

PRC - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2012/05/09 15:25:58 | 000,152,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\EMET\EMET_notifier.exe

PRC - [2010/04/29 10:38:54 | 001,652,736 | R--- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe

PRC - [2009/04/11 03:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/07/03 12:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe

PRC - [2007/04/18 11:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

PRC - [2007/02/15 07:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/02/13 12:49:39 | 012,434,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2b605fc7deda872727d1ed37710420e\System.Windows.Forms.ni.dll

MOD - [2014/02/13 12:49:25 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8e6265a54260bddfc05951e764f5bc48\System.Drawing.ni.dll

MOD - [2014/02/13 12:46:53 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\957628d9dd7b3bf370a56dca7835a997\System.ni.dll

MOD - [2014/02/13 12:46:24 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\694a37a84dee2cd2609a1dfab27c0433\mscorlib.ni.dll

MOD - [2014/02/03 05:34:56 | 001,125,592 | ---- | M] () -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll

MOD - [2012/06/27 15:09:06 | 000,557,056 | ---- | M] () -- C:\Program Files\Trusteer\Rapport\bin\js32.dll

 

 

========== Services (SafeList) ==========

 

SRV - [2014/04/11 06:57:43 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/03/30 20:30:08 | 001,444,120 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)

SRV - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice)

SRV - [2014/03/12 16:23:32 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) [Auto | Running] -- C:\Program Files\PureLeads\PureLeadsSvc.exe -- (PlsvcV1)

SRV - [2014/01/23 19:12:50 | 003,690,784 | ---- | M] (Sendori) [Auto | Running] -- C:\Program Files\PureLeads\plsapp.exe -- (plsapp)

SRV - [2014/01/23 19:12:50 | 000,024,352 | ---- | M] (sendori) [Auto | Running] -- C:\Program Files\PureLeads\PureLeads.Service.exe -- (PlsvcV2)

SRV - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013/09/05 20:41:08 | 000,240,736 | ---- | M] (WildTangent) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppIntegrationService.exe -- (GamesAppIntegrationService)

SRV - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)

SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIM)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsld9375e4a.sys -- (MpKsld9375e4a)

DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsl6f98b91e.sys -- (MpKsl6f98b91e)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - [2014/04/27 16:53:50 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SWDUMon.sys -- (SWDUMon)

DRV - [2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2014/03/30 20:30:22 | 000,228,888 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)

DRV - [2014/03/30 20:30:22 | 000,156,024 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI)

DRV - [2014/03/30 20:30:22 | 000,107,256 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RapportKELL.sys -- (RapportKELL)

DRV - [2014/03/11 09:52:30 | 000,104,264 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2013/10/28 06:06:50 | 000,340,432 | ---- | M] () [Kernel | System | Running] -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys -- (RapportCerberus_59849)

DRV - [2013/02/06 17:27:50 | 000,208,920 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\keyscrambler.sys -- (KeyScrambler)

DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2008/08/01 20:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008/05/22 15:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008/05/08 09:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)

DRV - [2008/05/08 09:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_DP.sys -- (HSF_DP)

DRV - [2007/10/18 11:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2007/10/12 11:53:10 | 000,013,312 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\nvsmu.sys -- (nvsmu)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ario&pf=desktop

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKLM\..\SearchScopes,DefaultScope = {7FD4EE26-7109-400B-96F3-8F345FA81BFA}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=EIE9HP&PC=UP50

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)

IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.condui...rchTerms}&SSPV=

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://games.yahoo.n...q={searchTerms}

IE - HKCU\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect...mrud=10-01-2014

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...&rlz=1I7RNRM_en

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:49202;https=127.0.0.1:49202

 

========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:3.2.0.20140128092014

FF - prefs.js..extensions.enabledAddons: module%40com.arcadesafari.firefox:1.2

FF - prefs.js..extensions.enabledAddons: %7B1a68cbde-3e4c-4fae-bf49-af5ab9868e53%7D:2.5.121

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\14\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}: C:\Program Files\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/03/12 16:22:49 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\djokrall\AppData\Local\Arcadesafari\[email protected]

 

[2012/09/03 17:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Extensions

[2014/03/13 16:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions

[2014/03/13 16:25:30 | 000,000,000 | ---D | M] (ArcadeFrontier) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53}

[2014/03/12 16:03:04 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2014/03/13 10:40:00 | 000,000,000 | ---D | M] (Arcadesafari) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\[email protected]

[2014/03/12 16:22:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (GameTap) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2014/03/12 16:22:41 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2014/03/12 16:22:45 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2014/03/12 16:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions

[2014/03/12 16:23:35 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

 

========== Chrome  ==========

 

CHR - default_search_provider: Ask.com (Enabled)

CHR - default_search_provider: search_url = http://search.tb.ask...CFRFnOgod40IAiw

CHR - default_search_provider: suggest_url = http://ssmsp.ask.com...&sstype=prefix,

CHR - homepage: http://www.yahoo.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll

CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll

CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll

CHR - plugin: Zylom Plugin (Enabled) = C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - Extension: YouTube = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\

CHR - Extension: Google Search = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\

CHR - Extension: Allin1Convert = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\epikbiglahnndfidencpcjhnefnmooeg\8.22.3.42841_0\

CHR - Extension: Define Ext = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh\1_0\

CHR - Extension: Google Wallet = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: ArcadeFrontier = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\peglehonblabfemopkgmfcpofbchegcl\2.3.2_0\

CHR - Extension: Gmail = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\

 

O1 HOSTS File: ([2012/12/30 16:02:08 | 000,000,724 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SimpleAdblock Class) - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Common Files\Simple Adblock\SimpleAdblock.dll (Simple Adblock)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - No CLSID value found.

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [EMET Notifier] C:\Program Files\EMET\EMET_notifier.exe (Microsoft Corporation)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe (QFX Software Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)

O4 - HKLM..\Run: [PureLeads Tray] C:\Program Files\PureLeads\PureLeadsTray.exe (PureLeads)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [SearchEngineProtection] C:\Program Files\GamesBar\update\SearchEngineProtection.exe (Oberon Media )

O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\plsapp.dll (Sendori)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\plsapp.dll (Sendori)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\plsapp.dll (Sendori)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\plsapp.dll (Sendori)

O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\plsapp.dll (Sendori)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: yahoo.com ([]* in Trusted sites)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38423836-BD19-40F9-9050-4DDC6EF47611}: DhcpNameServer = 75.75.76.76 75.75.75.75

O18 - Protocol\Handler\inbox - No CLSID value found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/02/20 07:23:48 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/04/26 13:52:40 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/13 06:16:47 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2014/04/12 16:52:32 | 000,000,000 | ---D | C] -- C:\Users\djokrall\AppData\Local\SlimWare Utilities Inc

[2014/04/12 16:52:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate

[2014/04/12 16:52:16 | 000,000,000 | ---D | C] -- C:\Program Files\DriverUpdate

[2014/04/12 16:51:56 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers

[2014/03/30 20:30:22 | 000,107,256 | ---- | C] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2014/04/27 16:54:21 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/04/27 16:54:05 | 000,000,400 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job

[2014/04/27 16:54:00 | 000,000,498 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3 Startup Task.job

[2014/04/27 16:53:50 | 000,013,464 | ---- | M] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2014/04/27 16:53:33 | 000,000,476 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version3 Startup Task.job

[2014/04/27 16:35:36 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2014/04/27 16:35:36 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2014/04/27 16:35:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/04/27 16:35:14 | 2010,238,976 | -HS- | M] () -- C:\hiberfil.sys

[2014/04/26 14:53:15 | 000,000,770 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/26 14:24:17 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/04/26 14:24:02 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/04/26 13:25:02 | 000,000,482 | ---- | M] () -- C:\Windows\tasks\Arcadesafari.job

[2014/04/23 18:00:02 | 000,000,450 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job

[2014/04/23 18:00:01 | 000,000,474 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Registration3.job

[2014/04/23 08:38:10 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleFordjokrall.job

[2014/04/12 16:52:18 | 000,001,856 | ---- | M] () -- C:\Users\Public\Desktop\DriverUpdate.lnk

[2014/04/11 08:16:54 | 000,000,426 | ---- | M] () -- C:\AVScanner.ini

[2014/04/10 13:35:16 | 000,001,937 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/04/05 05:00:04 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3.job

[2014/04/03 11:04:16 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif

[2014/03/30 20:30:22 | 000,107,256 | ---- | M] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2014/04/26 14:53:15 | 000,000,770 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 13:30:27 | 000,000,426 | ---- | C] () -- C:\AVScanner.ini

[2014/04/12 16:53:45 | 000,000,400 | ---- | C] () -- C:\Windows\tasks\DriverUpdate Startup.job

[2014/04/12 16:52:38 | 000,013,464 | ---- | C] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2014/04/12 16:52:18 | 000,001,856 | ---- | C] () -- C:\Users\Public\Desktop\DriverUpdate.lnk

[2012/12/30 17:44:35 | 000,187,047 | ---- | C] () -- C:\Windows\hpwins23.dat

[2012/12/30 17:12:48 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\RAExpertHistory.xml

[2012/12/30 17:10:53 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\rahistory.xml

[2012/04/03 14:01:19 | 000,006,144 | ---- | C] () -- C:\Users\djokrall\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/02/19 20:07:05 | 000,103,720 | ---- | C] () -- C:\Users\djokrall\GoToAssistDownloadHelper.exe

[2011/02/19 17:26:21 | 000,000,680 | ---- | C] () -- C:\Users\djokrall\AppData\Local\d3d9caps.dat

 

========== ZeroAccess Check ==========

 

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 03:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 03:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

========== LOP Check ==========

 

[2013/09/07 06:44:02 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\24x7 Help

[2014/01/10 11:14:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\78-com.novelgames.flashgames.bouncing

[2013/07/21 15:10:19 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Activeris

[2014/03/28 07:54:33 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Arkadium

[2012/05/13 17:19:43 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Auslogics

[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\DriverCure

[2012/08/25 16:05:58 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\FreeBurner

[2011/07/02 10:46:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\funkitron

[2013/09/05 14:51:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Gaijin Ent

[2012/06/03 18:56:57 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\GameCards

[2012/06/03 13:15:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\MusicNet

[2012/06/23 19:04:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Nuance

[2013/09/11 14:42:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Oberon Media

[2013/11/17 11:20:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice

[2011/12/20 17:15:05 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice.org

[2012/05/27 11:00:02 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\ParetoLogic

[2012/06/01 07:15:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PC Cleaners

[2012/06/01 07:15:46 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PCPro

[2012/11/26 23:28:42 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\QFX Software

[2011/05/08 15:02:28 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Sammsoft

[2011/02/19 17:17:07 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Snapfish

[2012/06/26 07:12:34 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedMaxPc

[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedyPC Software

[2012/10/27 13:05:01 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Systweak

[2011/04/18 15:45:00 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Tific

[2012/08/12 11:02:31 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Triplay

[2011/12/28 17:36:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WeatherBug

[2012/06/03 19:01:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WildTangent

[2011/02/27 18:27:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WinBatch

[2012/05/17 14:01:03 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Zeon

 

========== Purity Check ==========

 

 

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 656 bytes -> C:\Users\djokrall\Documents\justin romero.eml:OECustomProperty

@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:ABE30DDB

@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B623B5B8

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A64A7256

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:5095D8B1

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4E85037E

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C46995DA

@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:D4E0D1F1

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34

@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

 

< End of report >

 

 

OTL Extras logfile created on: 4/27/2014 4:58:15 PM - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\djokrall\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 0.77 Gb Available Physical Memory | 41.27% Memory free

3.99 Gb Paging File | 2.73 Gb Available in Paging File | 68.55% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 456.48 Gb Total Space | 353.89 Gb Free Space | 77.53% Space Free | Partition Type: NTFS

Drive D: | 9.28 Gb Total Space | 1.00 Gb Free Space | 10.75% Space Free | Partition Type: NTFS

 

Computer Name: DJOKRALL-PC | User Name: djokrall | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 0

"InternetSettingsDisableNotify" = 0

"AutoUpdateDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)

 

 

========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{00BFAE0B-4D9C-463D-B75B-3E6E66CE5EDA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{0CED0BA4-DAE1-4B07-ACE7-78F58A080CE5}" = lport=139 | protocol=6 | dir=in | app=system | 

"{113BDBF9-B83C-44F1-A6F9-092F5D9D8556}" = rport=139 | protocol=6 | dir=out | app=system | 

"{2ADB7D85-75D5-4F22-8B0B-C4197BFE6CC0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{3AE48F1C-87C6-4381-9D72-23BE223B3644}" = lport=445 | protocol=6 | dir=in | app=system | 

"{450BF8E5-4875-4D68-B275-8D727C71D49C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5F88808E-D4B6-4E4F-8738-B5A78EF15DBF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{66624CB7-0CC9-48BD-92D4-8B13BB4DC782}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{978F3DF2-3A4A-4D33-85F1-8386640873BE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{A34D9C78-9B44-4C65-AE83-7AA81BAFCF14}" = rport=137 | protocol=17 | dir=out | app=system | 

"{AD355CF4-5DA6-4050-B0A7-67749356851B}" = lport=137 | protocol=17 | dir=in | app=system | 

"{CDB13DA3-F96E-4AE8-AC8E-5FEB8FF0A812}" = lport=138 | protocol=17 | dir=in | app=system | 

"{D0EEF441-A08E-49BD-99B2-515D3596B80C}" = rport=445 | protocol=6 | dir=out | app=system | 

"{DB8D9B4C-89C8-4B17-8334-E4AB52CD978A}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{DEC9CD65-BAE3-4CE9-AAE5-D5A609D40168}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{F1B4CDC7-0ED5-406F-B49D-76316A53BC72}" = rport=138 | protocol=17 | dir=out | app=system | 

"{F556DA70-BA14-456A-8875-A61F95F8A285}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{FB1676C0-073D-4226-A09A-00F0691523A3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 | 

 

========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0E44847C-D600-4C4D-8E54-9B6B5759FA8B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe | 

"{64369748-96EC-4E54-9846-6351D9AB5F66}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe | 

"{65FA3848-AF2F-43F3-A44F-C7045FD14912}" = protocol=58 | dir=out | [email protected],-28546 | 

"{678F1FF6-38C5-4828-A8E0-480105E24A56}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe | 

"{8DB1C72C-F16F-4130-A3A2-EDA7F47F551A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{AF75A240-FB5B-4DD8-A9C9-12E188C4557D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposfx08.exe | 

"{AF8CC225-E283-4425-96BF-E7DE7D831FA7}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe | 

"{BFE88044-A4CB-42E7-BA1F-27896A30F652}" = protocol=1 | dir=in | [email protected],-28543 | 

"{D641F7CC-F077-4D91-A7A9-D9EE730A7B46}" = protocol=58 | dir=in | [email protected],-28545 | 

"{E028817D-5FFD-4953-9F13-E2DEA8E563A5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpofxm08.exe | 

"{F6F21DF0-A695-44FB-9097-0BC861F0098F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpzwiz01.exe | 

"{F992896C-FD83-47E1-AACF-DA2D32F97FE4}" = protocol=1 | dir=out | [email protected],-28544 | 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{029B5901-1F27-4347-9923-E8ACC8F54E15}" = Snapfish Picture Mover

"{03A7C57A-B2C8-409b-92E5-524A0DFD0DD3}" = Status

"{087A66B8-1F0F-4a8d-A649-0CFE276AA7C0}" = WebReg

"{0A17C91C-A455-3E89-B8B7-44E192F79635}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)

"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5

"{0E19A83E-F53B-40CF-8C91-96F32D955E6A}" = LightScribe System Software  1.10.23.1

"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1

"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works

"{1BCE2581-B7CA-4BB4-BDFB-D113506AA38B}" = HP Easy Setup - Frontend

"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe

"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget

"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check

"{26A24AE4-039D-4CA4-87B4-2F83217017F0}" = Java 7 Update 17

"{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 45

"{2A329FB6-389D-4396-A974-29656D6864AE}" = MarketResearch

"{2B353DA2-A8FD-4238-B207-62A1921158D7}" = DriverUpdate

"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm

"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App

"{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler

"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE

"{36A345C9-0691-45A1-AEEF-29ECEC8B5014}" = Microsoft Security Client

"{38DAE5F5-EC70-4aa5-801B-D11CA0A33B41}" = BPDSoftware

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{47F460DA-D1BE-4D85-8DF2-AA1F31D3445F}" = OpenOffice 4.0.1

"{4903D172-DCCB-392F-93A3-34CA9D47FE3D}" = Microsoft .NET Framework 4.5.1

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout

"{4D304678-738E-42a0-931A-2B022F49DEB8}" = TrayApp

"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport

"{5115C036-C0D5-4E1B-81C9-542CA967478A}" = muvee autoProducer 6.1

"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries

"{57F60D52-630B-43C5-BD20-176F5CD4EED6}" = bpd_scan

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check

"{66FD219C-C348-1FF2-9A8C-1FAFA44F09A9}" = Bouncing Balls

"{676981B7-A2D9-49D0-9F4C-03018F131DA9}" = DocProc

"{6A1ACC15-7632-45ba-A3AB-0250EBD4B7DD}" = 6500_E709a

"{6CC080F1-2E00-41D5-BE47-A3BC784E9DFB}" = BPDSoftware_Ini

"{6EED4269-588D-45b8-A80C-26A9CA62EE4E}" = HPSSupply

"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App for HP

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{73A43E42-3658-4DD9-8551-FACDA3632538}" = HP Advisor

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7F2B6338-4C07-49A0-BDF0-AD92E3124A7E}" = Compaq Demo

"{800E784D-53E3-4948-B491-9E7FA5EACBDC}" = SmartWebPrinting

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111174417}" = Hotel Solitaire

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112241997}" = Jewel Quest 2

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11994487}" = Vesuvia

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-510005507}" = Mahjongg Dimensions Deluxe - Tiles in Time

"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert

"{87A9A9A9-FAB7-4224-9328-0FA2058C0FD5}" = Network

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8E1CB0F1-67BF-4052-AA23-FA22E94804C1}" = InstallIQ Updater

"{8F018A9E-56DE-4A79-A5EF-25F413F1D538}" = WeatherBug

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{9129B46A-51F0-431b-9838-DF7272F3204E}" = ProductContext

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1

"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)

"{9603DE6D-4567-4b78-B941-849322373DE2}" = SolutionCenter

"{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9CCCFD9C-248F-47FE-9496-1680E3E5C163}" = Scan

"{9D1B99B7-DAD8-440d-B4FB-1915332FBCC2}" = HPProductAssistant

"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback

"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9A75A7F-4785-430D-8013-77BC1FD13A4C}" = Simple Adblock

"{AC13BA3A-336B-45a4-B3FE-2D3058A7B533}" = Toolbox

"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.06)

"{B92C2C6C-F70E-497B-88A7-1FEF9888272B}" = Adobe AIR

"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5

"{C29C1940-CB85-4F3B-906C-33FEE0E67103}" = DocMgr

"{C8D47273-7A1A-4614-A3D8-263632D8A5ED}" = HP Customer Experience Enhancements

"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{DE13432E-F0C1-4842-A5BA-CC997DA72A70}" = 6500_E709_eDocs

"{DE7A5DDF-47B3-42FF-A082-E158DEA37392}" = EMET

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics DiskDefrag

"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01

"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax

"{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F185B35D-38E5-4D88-B275-15C8C7FC4357}" = 6500_E709_Help

"{F648FD09-7CEA-4257-BC68-A8389189FD51}" = GPBaseService2

"{F769B78E-FF0E-4db5-95E2-9F4C8D6352FE}" = DeviceDiscovery

"{FA0F0A01-4631-4161-A6C2-948BF694382E}" = HP Officejet 6500 E709 Series

"78-com.novelgames.flashgames.bouncing" = Bouncing Balls

"AC3Filter_is1" = AC3Filter 1.63b

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 12 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 12.0

"amg-alohasolitaire" = Aloha Solitaire

"amg-texttwist2" = TextTwist 2

"am-jewelquestrsolitaire" = Jewel Quest® Solitaire

"am-supergamehousesolitairevolume2" = Super GameHouse Solitaire Volume 2

"am-supermahjong" = Super Mahjong

"am-supertexttwist" = Super TextTwist

"CCleaner" = CCleaner

"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP

"FileHippo.com" = FileHippo.com Update Checker

"Game Discovery" = Game Discovery

"Google Chrome" = Google Chrome

"HP Document Manager" = HP Document Manager 2.0

"HP Imaging Device Functions" = HP Imaging Device Functions 12.0

"HP Photosmart Essential" = HP Photosmart Essential 2.5

"HP Smart Web Printing" = HP Smart Web Printing

"HP Solution Center & Imaging Support Tools" = HP Solution Center 12.0

"HPExtendedCapabilities" = HP Customer Participation Program 12.0

"HPOCR" = OCR Software by I.R.I.S. 12.0

"KeyScrambler" = KeyScrambler

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft Security Client" = Microsoft Security Essentials

"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)

"Mozilla Firefox 27.0.1 (x86 en-US)" = Mozilla Firefox 27.0.1 (x86 en-US)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"NVIDIA Drivers" = NVIDIA Drivers

"Online Games Manager" = Online Games Manager v1.30

"OsdMaestro" = HP On-Screen Cap/Num/Scroll Lock Indicator

"PureLeads" = PureLeads

"Rapport_msi" = Trusteer Endpoint Protection

"Setup Support for Weatherbug" = Setup Support for Weatherbug 1.0

"Shop for HP Supplies" = Shop for HP Supplies

"SpywareBlaster_is1" = SpywareBlaster 5.0

"The Weather Channel App" = The Weather Channel App

"Web Games Player Plugin" = Web Games Player Plugin

"WildTangent hp Master Uninstall" = HP Games

"WTA-90b3d5f5-12fc-424f-9370-5ce50351366f" = SpiderMania Solitaire

"WTA-a2a18a32-089b-455c-a853-f0ade69e01a3" = Gold Rush Deluxe

"WTA-cc7e864a-a0b7-423f-a85c-9a7d861e7e79" = Bejeweled 3

"Yahoo! Companion" = Yahoo! Toolbar

"Yahoo! Software Update" = Yahoo! Software Update

"YInstHelper" = Yahoo! Install Manager

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Arcadesafari" = Arcadesafari

"GamesManager" = Games Manager

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 3/14/2013 6:40:19 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/14/2013 11:25:24 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/15/2013 6:12:13 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/16/2013 5:25:04 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/17/2013 5:25:17 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/17/2013 3:50:10 PM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/17/2013 3:56:33 PM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/18/2013 5:25:49 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/19/2013 3:06:18 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 3/20/2013 5:34:03 AM | Computer Name = djokrall-PC | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 4/25/2014 12:46:58 PM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 4/26/2014 5:23:02 AM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 4/26/2014 9:29:59 AM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7031

Description = 

 

Error - 4/26/2014 11:11:54 AM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7011

Description = 

 

Error - 4/26/2014 1:22:36 PM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7011

Description = 

 

Error - 4/26/2014 1:32:36 PM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7031

Description = 

 

Error - 4/26/2014 2:44:15 PM | Computer Name = djokrall-PC | Source = EventLog | ID = 6008

Description =The previous system shutdown at 2:43:08 PM on 4/26/2014 was unexpected.

 

Error - 4/26/2014 2:44:45 PM | Computer Name = djokrall-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 4/26/2014 3:07:38 PM | Computer Name = djokrall-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 4/27/2014 4:35:29 PM | Computer Name = djokrall-PC | Source = EventLog | ID = 6008

Description = The previous system shutdown at 3:07:38 PM on 4/26/2014 was unexpected.

 

 

< End of report >

 

Thanks!!!

 

[Advertisements]

Hello jp17315, Welcome to the forums!
.  My name is godawgs and I will be assisting you with your Virus / Malware issues.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic  to find out how to do that.

Please do not run any tools unless instructed to do so.

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• If I ask a Question just answer it, don't run anything unless directed to.

Please read every post completely before doing anything.

• Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
• Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.

• I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes  )
• Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.

IMPORTANT:Change your browser(s) to download any tools to the desktop.
Follow the directions here
For FireFox check the dot beside "Always ask me where to save files."
For Chrome, check the box beside "Ask where to save each file before downloading"
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Automatic Driver Updating Programs

The computer has the Driver Updater program from SlimWare Utilities installed on it. I believe this is a HP computer. In general, when you buy a computer from a manufacturer you should update the hardware drivers from the manufacturer's web site. Computer manufacturer's often times alter alter driver files to work on their systems. The Driver update programs look for updates on the hardware (audio card, vider card, hard disk, CD/DVD drives etc;) manufacturer's sites and may not be compatible with the computer.
I would recommend uninstalling the DriverUpdate.

There are some malicious programs that need to be uninstalled.


Step-1.

Malicious program uninstalls and Optional Removals

1. Please click the Start Orb , click Control Panel. Under the Programs or Programs and Features heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

InstallIQ Updater
Java 7 Update 17
PureLeads
Arcadesafari
DriverUpdate

3. Right click each program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Users\djokrall\AppData\Local\SlimWare Utilities Inc
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate
C:\Program Files\DriverUpdate
2. Close Windows Explorer.

Step-2.

OTL Fix

Please close all open windows and browsers
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
PRC - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsSvc.exe
PRC - [2014/01/23 19:12:52 | 000,083,232 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsTray.exe
PRC - [2014/01/23 19:12:50 | 003,690,784 | ---- | M] (Sendori) -- C:\Program Files\PureLeads\plsapp.exe
PRC - [2014/01/23 19:12:50 | 000,024,352 | ---- | M] (sendori) -- C:\Program Files\PureLeads\PureLeads.Service.exe
PRC - [2013/09/11 14:36:49 | 000,620,480 | ---- | M] (Oberon Media ) -- C:\Program Files\GamesBar\update\SearchEngineProtection.exe
SRV - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) [Auto | Running] -- C:\Program Files\PureLeads\PureLeadsSvc.exe -- (PlsvcV1)
DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsld9375e4a.sys -- (MpKsld9375e4a)
DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsl6f98b91e.sys -- (MpKsl6f98b91e)
IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.condui...rchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect...mrud=10-01-2014
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:49202;https=127.0.0.1:49202
FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:3.2.0.20140128092014
FF - prefs.js..extensions.enabledAddons: module%40com.arcadesafari.firefox:1.2
FF - prefs.js..extensions.enabledAddons: %7B1a68cbde-3e4c-4fae-bf49-af5ab9868e53%7D:2.5.121
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}: C:\Program Files\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\djokrall\AppData\Local\Arcadesafari\[email protected]
[2014/03/13 16:25:30 | 000,000,000 | ---D | M] (ArcadeFrontier) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53}
[2014/03/13 10:40:00 | 000,000,000 | ---D | M] (Arcadesafari) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\[email protected]
[2014/03/12 16:22:41 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2014/03/12 16:22:45 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - No CLSID value found.
O4 - HKCU..\Run: [SearchEngineProtection] C:\Program Files\GamesBar\update\SearchEngineProtection.exe (Oberon Media )
[2014/04/27 16:54:05 | 000,000,400 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2014/04/27 16:54:00 | 000,000,498 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3 Startup Task.job
[2014/04/27 16:53:33 | 000,000,476 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version3 Startup Task.job
[2014/04/26 13:25:02 | 000,000,482 | ---- | M] () -- C:\Windows\tasks\Arcadesafari.job
[2014/04/23 18:00:02 | 000,000,450 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2014/04/23 18:00:01 | 000,000,474 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Registration3.job
[2014/04/05 05:00:04 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3.job
[2013/07/21 15:10:19 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Activeris
[2012/05/27 11:00:02 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\ParetoLogic
[2012/06/01 07:15:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PC Cleaners
[2012/06/01 07:15:46 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PCPro
[2012/06/26 07:12:34 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedMaxPc
[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedyPC Software

:REG
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = -
 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = -

:FILES
ipconfig /flushdns /c
netsh advfirewall reset /c
netsh advfirewall set allprofiles state ON /c
C:\Program Files\PureLeads
C:\Program Files\GamesBar
C:\Program Files\Coupons.com CouponBar
C:\Users\djokrall\AppData\Local\Arcadesafari
C:\Users\djokrall\AppData\Roaming\Activeris
C:\Users\djokrall\AppData\Roaming\ParetoLogic
C:\Users\djokrall\AppData\Roaming\PC Cleaners
C:\Users\djokrall\AppData\Roaming\PCPro
C:\Users\djokrall\AppData\Roaming\SpeedMaxPc
C:\Users\djokrall\AppData\Roaming\SpeedyPC Software

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open on your desktop. To do that:

• Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).

Step-3.

Run aswMBR
Download aswMBR.exe to your desktop.

• Right click the aswMBR.exe file and click Run as Administrator. If you get a UAC window, allow the file to run.
• If it asks you if you want to download the latest virus definitions, click "No"
  
• Be sure the A/V Scan: is set to QuickScan
• Click the "Scan" button to start the scan
  
• On completion of the scan click save log. Save it to your desktop and post in your next reply.
  

NOTE: When you run aswMBR, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename the executable (aswMBR.exe) to iexplore.exe and try it again.

Step-4.

AdwCleaner by Xplode
Download AdwCleaner. Click here and then click the Download Now @ BleepingComputer button. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above the progress bar you will see Pending. Please uncheck elements you don't want to remove. Do Not delete anything at this time.
• Click the Report button to get the log.
• Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[R0].txt.
• Click the X in the upper right corner of the program or click the File menu and click Exit to close the program.

NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Step-5.

OTL Custom Scan

1. Please copy the text in the Quote box below, (Do Not copy the word Quote), and paste it in the box in OTL. To do that:

• Highlight everything inside the quote box, (except the word Quote), right click the mouse and click Copy.

createrestorepoint
netsvcs
baseservices
%SYSTEMDRIVE%\*.exe
rpcss.dll
/md5start
explorer.exe
winlogon.exe
Userinit.exe
/md5stop
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir "%systemdrive%\*" /S /A:L /C

1. Re-open on the desktop. To do that:

• Vista / 7 Users: Right click on the icon and click Run as Administrator)

Make sure all other windows are closed.

• You will see a console like the one below:
  
  
• Click the box beside Scan All Users at the top of the console.<---Very Important
• Make sure the Output box at the top is set to Standard Output.
• Check the boxes beside LOP Check and Purity Check.
• Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
• Click the button. Do not change any settings unless otherwise told to do so.
• Let the scan run uninterrupted.
• When the scan completes, it will open OTL.Txt. This file is also saved in the same location as OTL (it should be on your desktop).
• Please copy the contents of this file and paste it into your reply. To do that:
• On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
• Right click inside the forum post window then click Paste. This will paste the contents of the OTL.txt file in the in the post window.

Things For Your Next Post:
Please post the logs in the order requested. Please don't attach the logs unless I request it.
1. Let me know if you uninstalled Driver Update as there will likely be some residual files that we will need to take care of.
2. The OTL fixes log
3. The aswMBR log
4. The AdwCleaner[R0].txt log
5. The new OTL.txt log

[godawgs]

Hello jp17315, Welcome to the forums!
.  My name is godawgs and I will be assisting you with your Virus / Malware issues.
I will start working on your Malware issues. This may, or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for this issue on this machine!

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.
If you have not, please adhere to the guidelines below and then carefully follow all future instructions:

You must reply to posts within four days. If you haven't replied within that time, the topic will be closed! If you need additional time to complete things, just let me know.
If you're not sure, or if something unexpected happens, Do NOT continue! Stop and ask!

This board can notify you when a new reply is added to a topic. Please read this topic  to find out how to do that.

Please do not run any tools unless instructed to do so.

• We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask, nothing extra. Do Not run things twice unless instructed.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• If I ask a Question just answer it, don't run anything unless directed to.

Please read every post completely before doing anything.

• Pay special attention to the NOTE: lines, or anything in red. These entries identify an individual issue or important step in the cleanup process.
• Please make sure you are saving and printing the instructions out prior to each fix, this way you will have them on hand just in case you are unable to access this site. Some of the steps I will be asking you to do may require you to boot into Safe Mode and this process will be much easier for you to perform if the instructions are printed out for you to follow.
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post unless directed otherwise.

Logs from malware diagnostic or removal programs (OTL is one of them) can take some time to analyze.

• I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes  )
• Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Lastly, Please be aware that removing Malware is a hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. Some infections are so severe that we might encounter situations where the only recourse is to re-format and re-install your operating system. Don't worry, this only happens in severe cases, but, sadly, it does happen.
In light of this be prepared to back up your data. Have means of backing up your data available.

IMPORTANT:Change your browser(s) to download any tools to the desktop.
Follow the directions here
For FireFox check the dot beside "Always ask me where to save files."
For Chrome, check the box beside "Ask where to save each file before downloading"
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Automatic Driver Updating Programs

The computer has the Driver Updater program from SlimWare Utilities installed on it. I believe this is a HP computer. In general, when you buy a computer from a manufacturer you should update the hardware drivers from the manufacturer's web site. Computer manufacturer's often times alter alter driver files to work on their systems. The Driver update programs look for updates on the hardware (audio card, vider card, hard disk, CD/DVD drives etc;) manufacturer's sites and may not be compatible with the computer.
I would recommend uninstalling the DriverUpdate.

There are some malicious programs that need to be uninstalled.


Step-1.

Malicious program uninstalls and Optional Removals

1. Please click the Start Orb , click Control Panel. Under the Programs or Programs and Features heading click Uninstall a program
2. In the list of programs installed, locate the following program(s):

InstallIQ Updater
Java 7 Update 17
PureLeads
Arcadesafari
DriverUpdate

3. Right click each program and click Uninstall
4. After the programs have been uninstalled, close the Installed Programs window and the Control Panel.
5. Reboot the computer.

Delete the folders associated with the uninstalled programs.(Only do this if you uninstalled the program)

1. Using Windows Explorer (to get there right-click your Start button and click "Explore"), please delete the following folders(s) (if present):

C:\Users\djokrall\AppData\Local\SlimWare Utilities Inc
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate
C:\Program Files\DriverUpdate
2. Close Windows Explorer.

Step-2.

OTL Fix

Please close all open windows and browsers
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
PRC - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsSvc.exe
PRC - [2014/01/23 19:12:52 | 000,083,232 | ---- | M] (PureLeads) -- C:\Program Files\PureLeads\PureLeadsTray.exe
PRC - [2014/01/23 19:12:50 | 003,690,784 | ---- | M] (Sendori) -- C:\Program Files\PureLeads\plsapp.exe
PRC - [2014/01/23 19:12:50 | 000,024,352 | ---- | M] (sendori) -- C:\Program Files\PureLeads\PureLeads.Service.exe
PRC - [2013/09/11 14:36:49 | 000,620,480 | ---- | M] (Oberon Media ) -- C:\Program Files\GamesBar\update\SearchEngineProtection.exe
SRV - [2014/01/23 19:12:52 | 000,091,936 | ---- | M] (PureLeads) [Auto | Running] -- C:\Program Files\PureLeads\PureLeadsSvc.exe -- (PlsvcV1)
DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsld9375e4a.sys -- (MpKsld9375e4a)
DRV - File not found [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsl6f98b91e.sys -- (MpKsl6f98b91e)
IE - HKCU\..\SearchScopes,DefaultScope = {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://search.condui...rchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}: "URL" = http://slirsredirect...mrud=10-01-2014
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:49202;https=127.0.0.1:49202
FF - prefs.js..extensions.enabledAddons: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:3.2.0.20140128092014
FF - prefs.js..extensions.enabledAddons: module%40com.arcadesafari.firefox:1.2
FF - prefs.js..extensions.enabledAddons: %7B1a68cbde-3e4c-4fae-bf49-af5ab9868e53%7D:2.5.121
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}: C:\Program Files\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\djokrall\AppData\Local\Arcadesafari\[email protected]
[2014/03/13 16:25:30 | 000,000,000 | ---D | M] (ArcadeFrontier) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53}
[2014/03/13 10:40:00 | 000,000,000 | ---D | M] (Arcadesafari) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\[email protected]
[2014/03/12 16:22:41 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2014/03/12 16:22:45 | 000,000,000 | ---D | M] (Define Ext) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - No CLSID value found.
O4 - HKCU..\Run: [SearchEngineProtection] C:\Program Files\GamesBar\update\SearchEngineProtection.exe (Oberon Media )
[2014/04/27 16:54:05 | 000,000,400 | ---- | M] () -- C:\Windows\tasks\DriverUpdate Startup.job
[2014/04/27 16:54:00 | 000,000,498 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3 Startup Task.job
[2014/04/27 16:53:33 | 000,000,476 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version3 Startup Task.job
[2014/04/26 13:25:02 | 000,000,482 | ---- | M] () -- C:\Windows\tasks\Arcadesafari.job
[2014/04/23 18:00:02 | 000,000,450 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration3.job
[2014/04/23 18:00:01 | 000,000,474 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Registration3.job
[2014/04/05 05:00:04 | 000,000,446 | ---- | M] () -- C:\Windows\tasks\SpeedyPC Update Version3.job
[2013/07/21 15:10:19 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Activeris
[2012/05/27 11:00:02 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\ParetoLogic
[2012/06/01 07:15:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PC Cleaners
[2012/06/01 07:15:46 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\PCPro
[2012/06/26 07:12:34 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedMaxPc
[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\SpeedyPC Software

:REG
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = -
 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = -

:FILES
ipconfig /flushdns /c
netsh advfirewall reset /c
netsh advfirewall set allprofiles state ON /c
C:\Program Files\PureLeads
C:\Program Files\GamesBar
C:\Program Files\Coupons.com CouponBar
C:\Users\djokrall\AppData\Local\Arcadesafari
C:\Users\djokrall\AppData\Roaming\Activeris
C:\Users\djokrall\AppData\Roaming\ParetoLogic
C:\Users\djokrall\AppData\Roaming\PC Cleaners
C:\Users\djokrall\AppData\Roaming\PCPro
C:\Users\djokrall\AppData\Roaming\SpeedMaxPc
C:\Users\djokrall\AppData\Roaming\SpeedyPC Software

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open on your desktop. To do that:

• Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).

Step-3.

Run aswMBR
Download aswMBR.exe to your desktop.

• Right click the aswMBR.exe file and click Run as Administrator. If you get a UAC window, allow the file to run.
• If it asks you if you want to download the latest virus definitions, click "No"
  
• Be sure the A/V Scan: is set to QuickScan
• Click the "Scan" button to start the scan
  
• On completion of the scan click save log. Save it to your desktop and post in your next reply.
  

NOTE: When you run aswMBR, if it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename the executable (aswMBR.exe) to iexplore.exe and try it again.

Step-4.

AdwCleaner by Xplode
Download AdwCleaner. Click here and then click the Download Now @ BleepingComputer button. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above the progress bar you will see Pending. Please uncheck elements you don't want to remove. Do Not delete anything at this time.
• Click the Report button to get the log.
• Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[R0].txt.
• Click the X in the upper right corner of the program or click the File menu and click Exit to close the program.

NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Step-5.

OTL Custom Scan

1. Please copy the text in the Quote box below, (Do Not copy the word Quote), and paste it in the box in OTL. To do that:

• Highlight everything inside the quote box, (except the word Quote), right click the mouse and click Copy.

createrestorepoint
netsvcs
baseservices
%SYSTEMDRIVE%\*.exe
rpcss.dll
/md5start
explorer.exe
winlogon.exe
Userinit.exe
/md5stop
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir "%systemdrive%\*" /S /A:L /C

1. Re-open on the desktop. To do that:

• Vista / 7 Users: Right click on the icon and click Run as Administrator)

Make sure all other windows are closed.

• You will see a console like the one below:
  
  
• Click the box beside Scan All Users at the top of the console.<---Very Important
• Make sure the Output box at the top is set to Standard Output.
• Check the boxes beside LOP Check and Purity Check.
• Place the mouse pointer inside the box, right click and click Paste. This will put the above script inside OTL
• Click the button. Do not change any settings unless otherwise told to do so.
• Let the scan run uninterrupted.
• When the scan completes, it will open OTL.Txt. This file is also saved in the same location as OTL (it should be on your desktop).
• Please copy the contents of this file and paste it into your reply. To do that:
• On the OTL.txt file Menu Bar click Edit then click Select All. This will highlight the contents of the file. Then click Copy.
• Right click inside the forum post window then click Paste. This will paste the contents of the OTL.txt file in the in the post window.

Things For Your Next Post:
Please post the logs in the order requested. Please don't attach the logs unless I request it.
1. Let me know if you uninstalled Driver Update as there will likely be some residual files that we will need to take care of.
2. The OTL fixes log
3. The aswMBR log
4. The AdwCleaner[R0].txt log
5. The new OTL.txt log

[jp17315]

Thanks godawgs!! I just got home for work so I will tackle this shortly!!

[jp17315]

When I ran aswMBr it did not give my a quick scan option. I just clicked on scan.

 

I did uninstall driver update.

 

Heres the log files:

 

OTL fixes log

 

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== OTL ==========

No active process named PureLeadsSvc.exe was found!

No active process named PureLeadsTray.exe was found!

No active process named plsapp.exe was found!

No active process named PureLeads.Service.exe was found!

No active process named SearchEngineProtection.exe was found!

Error: No service named PlsvcV1 was found to stop!

Service\Driver key PlsvcV1 not found.

File C:\Program Files\PureLeads\PureLeadsSvc.exe not found.

Error: No service named MpKsld9375e4a was found to stop!

Service\Driver key MpKsld9375e4a not found.

File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsld9375e4a.sys not found.

Error: No service named MpKsl6f98b91e was found to stop!

Service\Driver key MpKsl6f98b91e not found.

File c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FED3A416-B9C5-49C5-8278-20B1FC91F16B}\MpKsl6f98b91e.sys not found.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{443789B7-F39C-4b5c-9287-DA72D38F4FE6}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

Prefs.js: %7B635abd67-4fe9-1b23-4f01-e679fa7484c1%7D:3.2.0.20140128092014 removed from extensions.enabledAddons

Prefs.js: module%40com.arcadesafari.firefox:1.2 removed from extensions.enabledAddons

Prefs.js: %7B1a68cbde-3e4c-4fae-bf49-af5ab9868e53%7D:2.5.121 removed from extensions.enabledAddons

Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\ not found.

File C:\Program Files\Coupons.com CouponBar\firefox\{1C43BAF1-00C2-40A8-A09E-F84CFD79546D}\Coupons.com.xpi not found.

Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected] not found.

File C:\Users\djokrall\AppData\Local\Arcadesafari\[email protected] not found.

C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53}\chrome folder moved successfully.

C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{1a68cbde-3e4c-4fae-bf49-af5ab9868e53} folder moved successfully.

Folder C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\[email protected]\ not found.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected] folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\windows folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\window folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\utils folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\traits folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\tabs folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\system folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\l10n folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\events folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\event folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\dom folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\content folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\addon folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\api-utils folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\addon-kit folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\tests folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\lib folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\data folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\a folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\resources folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\locale folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\preferences folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\defaults folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\tmp folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\text-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\props folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn\prop-base folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected]\.svn folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\[email protected] folder moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30CEEEA2-3742-40E4-85DD-812BF1CBB83D} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30CEEEA2-3742-40E4-85DD-812BF1CBB83D}\ not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SearchEngineProtection deleted successfully.

C:\Program Files\GamesBar\update\SearchEngineProtection.exe moved successfully.

File C:\Windows\tasks\DriverUpdate Startup.job not found.

C:\WINDOWS\Tasks\SpeedyPC Update Version3 Startup Task.job moved successfully.

C:\WINDOWS\Tasks\ParetoLogic Update Version3 Startup Task.job moved successfully.

File C:\Windows\tasks\Arcadesafari.job not found.

C:\WINDOWS\Tasks\ParetoLogic Registration3.job moved successfully.

C:\WINDOWS\Tasks\SpeedyPC Registration3.job moved successfully.

C:\WINDOWS\Tasks\SpeedyPC Update Version3.job moved successfully.

C:\Users\djokrall\AppData\Roaming\Activeris folder moved successfully.

C:\Users\djokrall\AppData\Roaming\ParetoLogic\RegCure Pro folder moved successfully.

C:\Users\djokrall\AppData\Roaming\ParetoLogic folder moved successfully.

C:\Users\djokrall\AppData\Roaming\PC Cleaners folder moved successfully.

C:\Users\djokrall\AppData\Roaming\PCPro\phone folder moved successfully.

C:\Users\djokrall\AppData\Roaming\PCPro folder moved successfully.

C:\Users\djokrall\AppData\Roaming\SpeedMaxPc\SpeedMaxPc folder moved successfully.

C:\Users\djokrall\AppData\Roaming\SpeedyPC Software\SpeedyPC Pro folder moved successfully.

C:\Users\djokrall\AppData\Roaming\SpeedyPC Software folder moved successfully.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\DisableMonitoring deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\DisableMonitoring deleted successfully.

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\djokrall\Desktop\cmd.bat deleted successfully.

C:\Users\djokrall\Desktop\cmd.txt deleted successfully.

< netsh advfirewall reset /c >

Ok.

C:\Users\djokrall\Desktop\cmd.bat deleted successfully.

C:\Users\djokrall\Desktop\cmd.txt deleted successfully.

< netsh advfirewall set allprofiles state ON /c >

Ok.

C:\Users\djokrall\Desktop\cmd.bat deleted successfully.

C:\Users\djokrall\Desktop\cmd.txt deleted successfully.

File\Folder C:\Program Files\PureLeads not found.

C:\Program Files\GamesBar\update folder moved successfully.

C:\Program Files\GamesBar folder moved successfully.

File\Folder C:\Program Files\Coupons.com CouponBar not found.

File\Folder C:\Users\djokrall\AppData\Local\Arcadesafari not found.

File\Folder C:\Users\djokrall\AppData\Roaming\Activeris not found.

File\Folder C:\Users\djokrall\AppData\Roaming\ParetoLogic not found.

File\Folder C:\Users\djokrall\AppData\Roaming\PC Cleaners not found.

File\Folder C:\Users\djokrall\AppData\Roaming\PCPro not found.

C:\Users\djokrall\AppData\Roaming\SpeedMaxPc folder moved successfully.

File\Folder C:\Users\djokrall\AppData\Roaming\SpeedyPC Software not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 57472 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: djokrall

->Temp folder emptied: 3640599 bytes

->Temporary Internet Files folder emptied: 9955008 bytes

->Java cache emptied: 2686798 bytes

->FireFox cache emptied: 2535465 bytes

->Google Chrome cache emptied: 56906878 bytes

->Flash cache emptied: 58158 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 25423282 bytes

RecycleBin emptied: 4822890 bytes

 

Total Files Cleaned = 101.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 04282014_225524

 

Files\Folders moved on Reboot...

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\JIQFN1ZF\;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=300x250;tile=5;ord=364423214356126840[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\JIQFN1ZF\ount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=undefined;sub1=games.yahoo.net;sub2=%252Fpage%252Fhome_download[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\JIQFN1ZF\p;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=728x90;tile=4;ord=364423214356126840[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\BK9QQ5Q5\ed;kvcount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=sku870291;sub1=games.yahoo.net;sub2=%252Fpage%252Fproduct[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\BK9QQ5Q5\ed;kvcount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=sku870291;sub1=games.yahoo.net;sub2=%252Fpage%252Fproduct[2].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\9BRXO9K7\;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=300x250;tile=5;ord=244072508459164600[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\9BRXO9K7\ount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=undefined;sub1=games.yahoo.net;sub2=%252Fpage%252Fhome_download[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\9BRXO9K7\p;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=728x90;tile=4;ord=244072508459164600[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\2Z5KGSXB\;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=300x250;tile=5;ord=876504490056491300[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\2Z5KGSXB\ount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=undefined;sub1=games.yahoo.net;sub2=%252Fpage%252Fhome_download[1].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\2Z5KGSXB\ount=undefined;kvzip=undefined;kvllog=undefined;kvlord=undefined;kvwidget=undefined;key=undefined;sub1=games.yahoo.net;sub2=%252Fpage%252Fhome_download[2].htm not found!

File\Folder C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(27)\Content.IE5\2Z5KGSXB\p;!category=pop;CRM=AC34;CRM=MAG;A1=VN999;u=542b0e74-1cb4-ef59-ee44-b7076aefc6e7;pos=btf;tag=adi;mtype=standard;sz=728x90;tile=4;ord=876504490056491300[1].htm not found!

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

aswMBR log

 

aswMBR version 0.9.9.1771 Copyright© 2011 AVAST Software

Run date: 2014-04-28 23:03:20

-----------------------------

23:03:20.058    OS Version: Windows 6.0.6002 Service Pack 2

23:03:20.058    Number of processors: 2 586 0xF0D

23:03:20.058    ComputerName: DJOKRALL-PC  UserName: djokrall

23:03:22.542    Initialize success

23:03:46.516    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3

23:03:46.532    Disk 0 Vendor: Hitachi_HDP725050GLA360 GM4OA57A Size: 476940MB BusType: 3

23:03:46.641    Disk 0 MBR read successfully

23:03:46.641    Disk 0 MBR scan

23:03:46.657    Disk 0 unknown MBR code

23:03:46.657    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       467435 MB offset 63

23:03:46.704    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS         9501 MB offset 957307680

23:03:46.704    Disk 0 scanning sectors +976767120

23:03:46.735    Disk 0 scanning C:\Windows\system32\drivers

23:04:03.598    Service scanning

23:04:11.820    Service MpKsl713ce8c8 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1D54C51D-2BF1-4405-8890-28FBB138DB00}\MpKsl713ce8c8.sys **LOCKED** 32

23:04:21.351    Modules scanning

23:04:55.422    Disk 0 trace - called modules:

23:04:55.468    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 

23:04:55.468    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86c344a0]

23:04:55.484    3 CLASSPNP.SYS[897a18b3] -> nt!IofCallDriver -> [0x869ecb20]

23:04:55.484    5 acpi.sys[8069f6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0x86a06b98]

23:04:55.500    Scan finished successfully

23:06:23.195    Disk 0 MBR has been saved successfully to "C:\Users\djokrall\Desktop\MBR.dat"

23:06:23.226    The log file has been saved successfully to "C:\Users\djokrall\Desktop\aswMBR.txt"

 

Adwcleaner [RO] txt log

 

# AdwCleaner v3.205 - Report created 28/04/2014 at 23:13:38

# Updated 28/04/2014 by Xplode

# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)

# Username : djokrall - DJOKRALL-PC

# Running from : C:\Users\djokrall\Desktop\AdwCleaner.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

File Found : C:\END

File Found : C:\Program Files\Mozilla Firefox\browser\nsprotector.js

File Found : C:\Windows\System32\Tasks\paretologic registration3

File Found : C:\Windows\System32\Tasks\paretologic update version3

File Found : C:\Windows\System32\Tasks\PC Optimizer Pro Updates

File Found : C:\Windows\Tasks\paretologic update version3.job

Folder Found : C:\Program Files\Common Files\ParetoLogic

Folder Found : C:\Program Files\Common Files\speedypc software

Folder Found : C:\Program Files\Conduit

Folder Found : C:\Program Files\Free Ride Games

Folder Found : C:\Program Files\Mozilla Firefox\Extensions\[email protected]

Folder Found : C:\Program Files\Optimizer Pro

Folder Found : C:\Program Files\PCFixSpeed

Folder Found : C:\Program Files\Playbryte

Folder Found : C:\Users\djokrall\AppData\Local\BrowserSafeguard

Folder Found : C:\Users\djokrall\AppData\Local\Conduit

Folder Found : C:\Users\djokrall\AppData\Local\DefineExt

Folder Found : C:\Users\djokrall\AppData\Local\emaze

Folder Found : C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh

Folder Found : C:\Users\djokrall\AppData\Local\iac

Folder Found : C:\Users\djokrall\AppData\Local\mapsgalaxy_39

Folder Found : C:\Users\djokrall\AppData\Local\NativeMessaging

Folder Found : C:\Users\djokrall\AppData\Local\PackageAware

Folder Found : C:\Users\djokrall\AppData\Local\SearchProtect

Folder Found : C:\Users\djokrall\AppData\Local\visi_coupon

Folder Found : C:\Users\djokrall\AppData\LocalLow\Conduit

Folder Found : C:\Users\djokrall\AppData\LocalLow\DataMngr

Folder Found : C:\Users\djokrall\AppData\LocalLow\iac

Folder Found : C:\Users\djokrall\AppData\LocalLow\Inbox Toolbar

Folder Found : C:\Users\djokrall\AppData\LocalLow\iWon_5k

Folder Found : C:\Users\djokrall\AppData\LocalLow\mapsgalaxy_39

Folder Found : C:\Users\djokrall\AppData\LocalLow\PriceGong

Folder Found : C:\Users\djokrall\AppData\Roaming\24x7 help

Folder Found : C:\Users\djokrall\AppData\Roaming\DriverCure

Folder Found : C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

Folder Found : C:\Users\djokrall\AppData\Roaming\Systweak

Folder Found : C:\Users\djokrall\Documents\Optimizer Pro

Folder Found : C:\Users\Public\Documents\iWin

Folder Found : C:\Windows\system32\AI_RecycleBin

 

***** [ Shortcuts ] *****

 

Shortcut Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Help.lnk ( /showurl hxxp://toolbar.inbox.com/faq.aspx )

Shortcut Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Inbox.com.lnk ( /showurl hxxp://www.inbox.com/homepage.aspx?tbid=80975&iwk=298&lng=en )

 

***** [ Registry ] *****

 

Key Found : HKCU\Software\APN PIP

Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Found : HKCU\Software\AppDataLow\Software\BringMeSports_1c

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Found : HKCU\Software\AppDataLow\Software\MapsGalaxy_39

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\AppDataLow\Software\WeatherBlink

Key Found : HKCU\Software\AppDataLow\Toolbar

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Google\Chrome\Extensions\hgiifhjbblnglipdbpdgagphlcbililb

Key Found : HKCU\Software\Imesh

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Smart PC Cleaner_is1

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6633A945-D022-4853-937D-B3B9BB3964F8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82C7004A-078E-468C-9C0F-2243618FF7CB}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\ParetoLogic

Key Found : HKCU\Software\pc optimizer pro

Key Found : HKCU\Software\SpeedMaxPC

Key Found : HKCU\Software\speedypc software

Key Found : HKCU\Software\visualbee

Key Found : HKCU\Software\wecarereminder

Key Found : HKCU\Software\YahooPartnerToolbar

Key Found : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Found : HKLM\Software\AVG SafeGuard toolbar

Key Found : HKLM\Software\BringMeSports_1c

Key Found : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Key Found : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Classes\driverscanner

Key Found : HKLM\SOFTWARE\Classes\inbox.appserver

Key Found : HKLM\SOFTWARE\Classes\inbox.ibx404

Key Found : HKLM\SOFTWARE\Classes\Interface\{DB507187-9746-458C-97DA-C458131EEDE7}

Key Found : HKLM\SOFTWARE\Classes\protocols\handler\inbox

Key Found : HKLM\SOFTWARE\Classes\speedupmypc

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3307519

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4084D718-3644-4504-B828-BB054729E39C}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\firstsearch

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\hgiifhjbblnglipdbpdgagphlcbililb

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{656917E9-783E-4B89-9723-1B33FAA9D455}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7C21E27B-2D49-4037-8729-F9F6BA8B4B8F}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FD36E492-E2D9-401D-B023-04DE3FDE2CA5}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{656917E9-783E-4B89-9723-1B33FAA9D455}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C21E27B-2D49-4037-8729-F9F6BA8B4B8F}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AAFBE964-BDC5-44BC-A005-827A13850A21}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD36E492-E2D9-401D-B023-04DE3FDE2CA5}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

Key Found : HKLM\Software\ParetoLogic

Key Found : HKLM\Software\PIP

Key Found : HKLM\Software\SearchProtect

Key Found : HKLM\Software\SpeedMaxPC

Key Found : HKLM\Software\speedypc software

Key Found : HKLM\Software\systweak

Key Found : HKLM\Software\TelevisionFanaticEI

Key Found : HKLM\Software\Trymedia Systems

Key Found : HKLM\Software\Uniblue

Key Found : HKLM\Software\Uniblue\DriverScanner

Key Found : HKLM\Software\visualbee

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v9.0.8112.16545

 

 

-\\ Mozilla Firefox v27.0.1 (en-US)

 

[ File : C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\prefs.js ]

 

 

-\\ Google Chrome v34.0.1847.116

 

[ File : C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

Found [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=PGL&o=102946&locale=en_US&apn_uid=737b82f2-b5bb-4847-87eb-d26bdcbd30fa&apn_ptnrs=6J&apn_sauid=652BDDC0-3E1F-40A3-A85B-9BE019499DC9&apn_dtid=YYYYYYYYUS&q={searchTerms}

Found [Search Provider] : hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=421&sr=0&q={searchTerms}

Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3323224&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPADA42CFD-0A5F-48B9-B5F4-8429B2581822&q={searchTerms}&SSPV=

Found [Search Provider] : hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={SearchTerms}&s_it=games-ie&tb_uuid=91F10ACB1C6246479CAC2A5F8C8031F8&tb_oid=10-01-2014&tb_mrud=10-01-2014

Found [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}

Found [Search Provider] : hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80975&iwk=298&lng=en

Found [Search Provider] : hxxp://search.tb.ask.com/search/GGmain.jhtml?searchfor={searchTerms}&st=kwd&ptb=0DEF6CC2-AA1D-49B7-BC4B-AC2772B0687D&n=780bd8c6&ind=2014042310&p2=^Y6^xdm003^YYA^us&si=COzLuKDj9r0CFRFnOgod40IAiw

Found [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

Found [Extension] : bopakagnckmlgajfccecajhnimjiiedh

Found [Extension] : flpcjncodpafbgdpnkljologafpionhb

Found [Extension] : gjkpcnacdgdlpfejlgflolpaigoicibh

Found [Extension] : hgiifhjbblnglipdbpdgagphlcbililb

 

*************************

 

AdwCleaner[R0].txt - [11146 octets] - [28/04/2014 23:13:38]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [11207 octets] ##########

 

New OTL txt log

 

OTL logfile created on: 4/28/2014 11:18:36 PM - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\djokrall\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 0.80 Gb Available Physical Memory | 42.57% Memory free

3.98 Gb Paging File | 2.68 Gb Available in Paging File | 67.34% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 456.48 Gb Total Space | 356.62 Gb Free Space | 78.12% Space Free | Partition Type: NTFS

Drive D: | 9.28 Gb Total Space | 0.90 Gb Free Space | 9.73% Space Free | Partition Type: NTFS

 

Computer Name: DJOKRALL-PC | User Name: djokrall | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/04/28 22:48:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

PRC - [2014/04/14 00:00:58 | 002,484,504 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

PRC - [2014/04/14 00:00:58 | 001,444,120 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

PRC - [2014/04/01 21:58:05 | 000,841,032 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe

PRC - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe

PRC - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\NisSrv.exe

PRC - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe

PRC - [2014/03/11 10:13:14 | 000,951,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2012/05/09 15:25:58 | 000,152,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\EMET\EMET_notifier.exe

PRC - [2010/04/29 10:38:54 | 001,652,736 | R--- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe

PRC - [2009/04/11 03:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/07/03 12:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe

PRC - [2007/04/18 11:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

PRC - [2007/02/15 07:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/04/01 21:58:03 | 000,390,472 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppgooglenaclpluginchrome.dll

MOD - [2014/04/01 21:58:02 | 013,691,720 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll

MOD - [2014/04/01 21:57:59 | 004,081,480 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll

MOD - [2014/04/01 21:57:52 | 001,647,432 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll

MOD - [2014/04/01 21:57:49 | 000,065,352 | ---- | M] () -- C:\Program Files\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll

MOD - [2014/03/23 17:04:20 | 000,557,056 | ---- | M] () -- C:\Program Files\Trusteer\Rapport\bin\js32.dll

MOD - [2014/02/13 12:49:39 | 012,434,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2b605fc7deda872727d1ed37710420e\System.Windows.Forms.ni.dll

MOD - [2014/02/13 12:49:25 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8e6265a54260bddfc05951e764f5bc48\System.Drawing.ni.dll

MOD - [2014/02/13 12:46:53 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\957628d9dd7b3bf370a56dca7835a997\System.ni.dll

MOD - [2014/02/13 12:46:24 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\694a37a84dee2cd2609a1dfab27c0433\mscorlib.ni.dll

MOD - [2014/02/10 13:44:24 | 004,592,128 | ---- | M] () -- C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libGLESv2.dll

MOD - [2014/02/10 13:44:24 | 000,112,128 | ---- | M] () -- C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libEGL.dll

MOD - [2014/02/03 05:34:56 | 001,125,592 | ---- | M] () -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll

 

 

========== Services (SafeList) ==========

 

SRV - [2014/04/28 22:24:39 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/04/14 00:00:58 | 001,444,120 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)

SRV - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice)

SRV - [2014/03/12 16:23:32 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013/09/05 20:41:08 | 000,240,736 | ---- | M] (WildTangent) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppIntegrationService.exe -- (GamesAppIntegrationService)

SRV - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)

SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIM)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\djokrall\AppData\Local\Temp\aswMBR.sys -- (aswMBR)

DRV - [2014/04/28 23:00:21 | 000,039,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1D54C51D-2BF1-4405-8890-28FBB138DB00}\MpKsl713ce8c8.sys -- (MpKsl713ce8c8)

DRV - [2014/04/28 21:40:04 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SWDUMon.sys -- (SWDUMon)

DRV - [2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2014/04/14 00:01:06 | 000,228,888 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)

DRV - [2014/04/14 00:01:06 | 000,156,024 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI)

DRV - [2014/04/14 00:01:06 | 000,107,256 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RapportKELL.sys -- (RapportKELL)

DRV - [2014/03/11 09:52:30 | 000,104,264 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2013/10/28 06:06:50 | 000,340,432 | ---- | M] () [Kernel | System | Running] -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys -- (RapportCerberus_59849)

DRV - [2013/02/06 17:27:50 | 000,208,920 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\keyscrambler.sys -- (KeyScrambler)

DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2008/08/01 20:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008/05/22 15:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008/05/08 09:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)

DRV - [2008/05/08 09:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_DP.sys -- (HSF_DP)

DRV - [2007/10/18 11:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2007/10/12 11:53:10 | 000,013,312 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\nvsmu.sys -- (nvsmu)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ario&pf=desktop

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKLM\..\SearchScopes,DefaultScope = {7FD4EE26-7109-400B-96F3-8F345FA81BFA}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=EIE9HP&PC=UP50

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}: "URL" = http://games.yahoo.n...q={searchTerms}

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...&rlz=1I7RNRM_en

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

 

========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\14\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/03/12 16:22:49 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

 

[2012/09/03 17:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Extensions

[2014/04/28 22:56:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions

[2014/03/12 16:03:04 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2014/04/28 22:56:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (GameTap) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]

[2014/03/12 16:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions

[2014/03/12 16:23:35 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{1A68CBDE-3E4C-4FAE-BF49-AF5AB9868E53}

 

========== Chrome  ==========

 

CHR - default_search_provider: Ask.com (Enabled)

CHR - default_search_provider: search_url = http://search.tb.ask...CFRFnOgod40IAiw

CHR - default_search_provider: suggest_url = http://ssmsp.ask.com...&sstype=prefix,

CHR - homepage: http://www.yahoo.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll

CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll

CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll

CHR - plugin: Zylom Plugin (Enabled) = C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - Extension: YouTube = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\

CHR - Extension: Google Search = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\

CHR - Extension: Allin1Convert = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\epikbiglahnndfidencpcjhnefnmooeg\8.22.3.42841_0\

CHR - Extension: Define Ext = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh\1_0\

CHR - Extension: Google Wallet = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: ArcadeFrontier = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\peglehonblabfemopkgmfcpofbchegcl\2.3.2_0\

CHR - Extension: Gmail = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\

 

O1 HOSTS File: ([2012/12/30 16:02:08 | 000,000,724 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SimpleAdblock Class) - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Common Files\Simple Adblock\SimpleAdblock.dll (Simple Adblock)

O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [EMET Notifier] C:\Program Files\EMET\EMET_notifier.exe (Microsoft Corporation)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe (QFX Software Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-646951214-2927039730-2231423905-1000..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)

O13 - gopher Prefix: missing

O15 - HKU\S-1-5-21-646951214-2927039730-2231423905-1000\..Trusted Domains: yahoo.com ([]* in Trusted sites)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38423836-BD19-40F9-9050-4DDC6EF47611}: DhcpNameServer = 75.75.76.76 75.75.75.75

O18 - Protocol\Handler\inbox - No CLSID value found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/02/20 07:23:48 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/04/28 23:14:20 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\System32\sqlite3.dll

[2014/04/28 23:13:34 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/04/28 22:55:24 | 000,000,000 | ---D | C] -- C:\_OTL

[2014/04/28 22:50:41 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\djokrall\Desktop\aswmbr (1).exe

[2014/04/28 22:48:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

[2014/04/28 22:23:51 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2014/04/28 22:16:33 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe

[2014/04/28 22:16:33 | 000,174,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe

[2014/04/28 22:16:33 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll

[2014/04/26 13:52:40 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/14 00:01:06 | 000,107,256 | ---- | C] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[2014/04/13 06:16:47 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2014/04/12 16:51:56 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers

[2014/04/09 11:05:46 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2014/04/09 11:05:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2014/04/09 11:05:43 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2014/04/09 11:05:42 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2014/04/09 11:05:42 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2014/04/09 11:05:40 | 001,806,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2014/04/09 11:05:40 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2014/04/09 11:05:36 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2014/04/01 10:58:53 | 000,796,072 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll

[2014/04/01 10:58:52 | 000,873,384 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll

[2014/04/01 10:58:52 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe

 

========== Files - Modified Within 30 Days ==========

 

[2014/04/28 23:24:49 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/04/28 23:24:46 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2014/04/28 23:24:46 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2014/04/28 23:24:05 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/04/28 23:08:01 | 001,310,621 | ---- | M] () -- C:\Users\djokrall\Desktop\AdwCleaner.exe

[2014/04/28 23:06:23 | 000,000,512 | ---- | M] () -- C:\Users\djokrall\Desktop\MBR.dat

[2014/04/28 22:58:59 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/04/28 22:58:51 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2014/04/28 22:58:51 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2014/04/28 22:58:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/04/28 22:58:27 | 2010,243,072 | -HS- | M] () -- C:\hiberfil.sys

[2014/04/28 22:50:47 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\djokrall\Desktop\aswmbr (1).exe

[2014/04/28 22:48:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

[2014/04/28 21:40:04 | 000,013,464 | ---- | M] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2014/04/28 21:38:02 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleFordjokrall.job

[2014/04/26 14:53:15 | 000,000,770 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/14 00:01:06 | 000,107,256 | ---- | M] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[2014/04/11 08:16:54 | 000,000,426 | ---- | M] () -- C:\AVScanner.ini

[2014/04/10 13:35:16 | 000,001,937 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/04/03 11:04:16 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif

 

========== Files Created - No Company Name ==========

 

[2014/04/28 23:07:53 | 001,310,621 | ---- | C] () -- C:\Users\djokrall\Desktop\AdwCleaner.exe

[2014/04/28 23:06:23 | 000,000,512 | ---- | C] () -- C:\Users\djokrall\Desktop\MBR.dat

[2014/04/26 14:53:15 | 000,000,770 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 13:30:27 | 000,000,426 | ---- | C] () -- C:\AVScanner.ini

[2014/04/12 16:52:38 | 000,013,464 | ---- | C] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2012/12/30 17:44:35 | 000,187,047 | ---- | C] () -- C:\Windows\hpwins23.dat

[2012/12/30 17:12:48 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\RAExpertHistory.xml

[2012/12/30 17:10:53 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\rahistory.xml

[2012/04/03 14:01:19 | 000,006,144 | ---- | C] () -- C:\Users\djokrall\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/02/19 20:07:05 | 000,103,720 | ---- | C] () -- C:\Users\djokrall\GoToAssistDownloadHelper.exe

[2011/02/19 17:26:21 | 000,000,680 | ---- | C] () -- C:\Users\djokrall\AppData\Local\d3d9caps.dat

 

========== ZeroAccess Check ==========

 

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 03:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 03:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

========== LOP Check ==========

 

[2013/09/07 06:44:02 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\24x7 Help

[2014/01/10 11:14:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\78-com.novelgames.flashgames.bouncing

[2014/03/28 07:54:33 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Arkadium

[2012/05/13 17:19:43 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Auslogics

[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\DriverCure

[2012/08/25 16:05:58 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\FreeBurner

[2011/07/02 10:46:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\funkitron

[2013/09/05 14:51:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Gaijin Ent

[2012/06/03 18:56:57 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\GameCards

[2012/06/03 13:15:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\MusicNet

[2012/06/23 19:04:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Nuance

[2013/09/11 14:42:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Oberon Media

[2013/11/17 11:20:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice

[2011/12/20 17:15:05 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice.org

[2012/11/26 23:28:42 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\QFX Software

[2011/05/08 15:02:28 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Sammsoft

[2011/02/19 17:17:07 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Snapfish

[2012/10/27 13:05:01 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Systweak

[2011/04/18 15:45:00 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Tific

[2012/08/12 11:02:31 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Triplay

[2011/12/28 17:36:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WeatherBug

[2012/06/03 19:01:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WildTangent

[2011/02/27 18:27:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WinBatch

[2012/05/17 14:01:03 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Zeon

 

========== Purity Check ==========

 

 

 

========== Custom Scans ==========

 

========== Base Services ==========

SRV - [2006/11/02 05:46:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\aelupsvc.dll -- (AeLookupSvc)

SRV - [2008/01/20 22:24:17 | 000,033,280 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\appinfo.dll -- (Appinfo)

SRV - [2008/01/20 22:24:14 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\alg.exe -- (ALG)

SRV - [2009/04/11 03:28:24 | 000,758,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\qmgr.dll -- (BITS)

SRV - [2009/04/11 03:28:20 | 000,334,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\BFE.DLL -- (BFE)

SRV - [2011/11/16 10:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\lsass.exe -- (KeyIso)

SRV - [2009/04/11 03:28:20 | 000,268,800 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\es.dll -- (EventSystem)

SRV - [2008/01/20 22:24:36 | 000,081,920 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\browser.dll -- (Browser)

SRV - [2013/07/08 00:16:55 | 000,133,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\cryptsvc.dll -- (CryptSvc)

SRV - [2009/04/11 03:28:26 | 000,550,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\rpcss.dll -- (DcomLaunch)

SRV - [2009/04/11 03:28:20 | 000,204,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\dhcpcsvc.dll -- (Dhcp)

SRV - [2011/03/02 11:44:27 | 000,086,528 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\dnsrslvr.dll -- (Dnscache)

SRV - [2008/01/20 22:25:01 | 000,057,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\eapsvc.dll -- (EapHost)

SRV - [2009/04/11 03:28:20 | 000,026,112 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\hidserv.dll -- (hidserv)

SRV - [2008/01/20 22:24:09 | 000,288,256 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\System32\ipnathlp.dll -- (SharedAccess)

SRV - [2009/04/11 03:28:22 | 000,364,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\IPSECSVC.DLL -- (PolicyAgent)

SRV - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2009/04/11 03:28:26 | 000,311,808 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\swprv.dll -- (swprv)

SRV - [2008/01/20 22:24:54 | 000,045,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\mmcss.dll -- (MMCSS)

SRV - [2008/01/20 22:24:11 | 000,274,432 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\netman.dll -- (Netman)

SRV - [2008/01/20 22:24:23 | 000,237,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\netprofm.dll -- (netprofm)

SRV - [2008/01/20 22:23:44 | 000,168,448 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\nlasvc.dll -- (NlaSvc)

SRV - [2008/01/20 22:24:47 | 000,018,432 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\nsisvc.dll -- (nsi)

SRV - [2009/04/11 03:28:26 | 000,222,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\umpnpmgr.dll -- (PlugPlay)

SRV - [2010/08/17 10:11:37 | 000,128,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\spoolsv.exe -- (Spooler)

SRV - [2011/11/16 10:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\lsass.exe -- (ProtectedStorage)

SRV - [2009/04/11 03:28:20 | 000,564,224 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\emdmgmt.dll -- (EMDMgmt)

SRV - [2008/01/20 22:24:19 | 000,090,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\rasauto.dll -- (RasAuto)

SRV - [2009/04/11 03:28:26 | 000,262,144 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\rasmans.dll -- (RasMan)

SRV - [2009/04/11 03:28:26 | 000,550,400 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\rpcss.dll -- (RpcSs)

SRV - [2008/01/20 22:24:35 | 000,019,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\seclogon.dll -- (seclogon)

SRV - [2011/11/16 10:12:25 | 000,009,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\lsass.exe -- (SamSs)

SRV - [2009/04/11 03:28:28 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wscsvc.dll -- (wscsvc)

SRV - [2010/09/06 12:20:29 | 000,125,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\srvsvc.dll -- (LanmanServer)

SRV - [2009/07/10 07:47:42 | 000,247,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\shsvcs.dll -- (ShellHWDetection)

SRV - [2009/04/11 03:27:50 | 003,408,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\SLsvc.exe -- (slsvc)

SRV - [2010/11/04 14:55:12 | 000,601,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\schedsvc.dll -- (Schedule)

SRV - [2009/04/11 03:28:26 | 000,242,688 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\tapisrv.dll -- (TapiSrv)

SRV - [2009/07/10 07:47:42 | 000,247,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\shsvcs.dll -- (Themes)

SRV - [2009/04/11 03:28:24 | 000,153,088 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\profsvc.dll -- (ProfSvc)

SRV - [2009/04/11 03:28:12 | 001,055,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\VSSVC.exe -- (VSS)

SRV - [2009/04/11 03:28:20 | 000,315,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\audiosrv.dll -- (Audiosrv)

SRV - [2009/04/11 03:28:20 | 000,315,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\audiosrv.dll -- (AudioEndpointBuilder)

SRV - [2008/01/20 22:23:27 | 000,104,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\sdrsvc.dll -- (SDRSVC)

SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009/04/11 03:28:26 | 001,017,856 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wevtsvc.dll -- (Eventlog)

SRV - [2009/04/11 03:28:22 | 000,407,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\MPSSVC.dll -- (MpsSvc)

SRV - [2009/04/11 03:28:26 | 000,453,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wiaservc.dll -- (stisvc)

SRV - [2009/04/11 03:27:46 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\msiexec.exe -- (msiserver)

SRV - [2009/04/11 03:28:26 | 000,162,304 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wbem\WMIsvc.dll -- (Winmgmt)

SRV - [2012/06/02 18:19:17 | 001,933,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wuaueng.dll -- (wuauserv)

SRV - [2009/04/11 03:28:20 | 000,175,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\dot3svc.dll -- (dot3svc)

SRV - [2009/07/11 15:01:42 | 000,513,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\wlansvc.dll -- (Wlansvc)

SRV - [2009/06/10 07:42:23 | 000,160,256 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\wkssvc.dll -- (LanmanWorkstation)

 

< %SYSTEMDRIVE%\*.exe >

 

< rpcss.dll >

[2006/11/02 09:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT

[2006/11/02 09:01:49 | 000,032,600 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012/05/27 10:59:45 | 000,000,424 | ---- | C] () -- C:\Windows\Tasks\ParetoLogic Update Version3.job

[2012/05/30 11:40:12 | 000,000,886 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

[2012/05/30 11:40:14 | 000,000,890 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

[2012/12/01 18:31:35 | 000,000,830 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

[2014/01/31 14:50:47 | 000,000,334 | ---- | C] () -- C:\Windows\Tasks\HPCeeScheduleFordjokrall.job

 

< MD5 for: EXPLORER.EXE  >

[2008/10/29 02:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008/10/29 23:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2009/04/11 03:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\WINDOWS\explorer.exe

[2009/04/11 03:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008/10/27 22:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2008/01/20 22:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\WINDOWS\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 

< MD5 for: USERINIT.EXE  >

[2008/01/20 22:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\WINDOWS\System32\userinit.exe

[2008/01/20 22:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\WINDOWS\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

 

< MD5 for: WINLOGON.EXE  >

[2009/04/11 03:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\WINDOWS\System32\winlogon.exe

[2009/04/11 03:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2008/01/20 22:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\WINDOWS\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 

< c:\program files (x86)\Google\Desktop >

 

< c:\program files\Google\Desktop >

 

< dir "%systemdrive%\*" /S /A:L /C >

 Volume in drive C is COMPAQ

 Volume Serial Number is 20DA-66B2

 Directory of C:\

02/19/2011  05:04 PM    <JUNCTION>     Documents and Settings [C:\Users]

               0 File(s)              0 bytes

 Directory of C:\ProgramData

02/19/2011  05:04 PM    <JUNCTION>     Application Data [C:\ProgramData]

02/19/2011  05:04 PM    <JUNCTION>     Desktop [C:\Users\Public\Desktop]

02/19/2011  05:04 PM    <JUNCTION>     Documents [C:\Users\Public\Documents]

02/19/2011  05:04 PM    <JUNCTION>     Favorites [C:\Users\Public\Favorites]

02/19/2011  05:04 PM    <JUNCTION>     Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

02/19/2011  05:04 PM    <JUNCTION>     Templates [C:\ProgramData\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users

02/19/2011  05:04 PM    <SYMLINKD>     All Users [C:\ProgramData]

02/19/2011  05:04 PM    <JUNCTION>     Default User [C:\Users\Default]

               0 File(s)              0 bytes

 Directory of C:\Users\All Users

02/19/2011  05:04 PM    <JUNCTION>     Application Data [C:\ProgramData]

02/19/2011  05:04 PM    <JUNCTION>     Desktop [C:\Users\Public\Desktop]

02/19/2011  05:04 PM    <JUNCTION>     Documents [C:\Users\Public\Documents]

02/19/2011  05:04 PM    <JUNCTION>     Favorites [C:\Users\Public\Favorites]

02/19/2011  05:04 PM    <JUNCTION>     Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]

02/19/2011  05:04 PM    <JUNCTION>     Templates [C:\ProgramData\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\Default

02/19/2011  05:04 PM    <JUNCTION>     Application Data [C:\Users\Default\AppData\Roaming]

02/19/2011  05:04 PM    <JUNCTION>     Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]

02/19/2011  05:04 PM    <JUNCTION>     Local Settings [C:\Users\Default\AppData\Local]

02/19/2011  05:04 PM    <JUNCTION>     My Documents [C:\Users\Default\Documents]

02/19/2011  05:04 PM    <JUNCTION>     NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

02/19/2011  05:04 PM    <JUNCTION>     PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

02/19/2011  05:04 PM    <JUNCTION>     Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]

02/19/2011  05:04 PM    <JUNCTION>     SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]

02/19/2011  05:04 PM    <JUNCTION>     Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]

02/19/2011  05:04 PM    <JUNCTION>     Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\Default\AppData\Local

02/19/2011  05:04 PM    <JUNCTION>     Application Data [C:\Users\Default\AppData\Local]

02/19/2011  05:04 PM    <JUNCTION>     History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]

02/19/2011  05:04 PM    <JUNCTION>     Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]

               0 File(s)              0 bytes

 Directory of C:\Users\Default\Documents

02/19/2011  05:04 PM    <JUNCTION>     My Music [C:\Users\Default\Music]

02/19/2011  05:04 PM    <JUNCTION>     My Pictures [C:\Users\Default\Pictures]

02/19/2011  05:04 PM    <JUNCTION>     My Videos [C:\Users\Default\Videos]

               0 File(s)              0 bytes

 Directory of C:\Users\djokrall

02/19/2011  05:08 PM    <JUNCTION>     Application Data [C:\Users\djokrall\AppData\Roaming]

02/19/2011  05:08 PM    <JUNCTION>     Cookies [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Cookies]

02/19/2011  05:08 PM    <JUNCTION>     Local Settings [C:\Users\djokrall\AppData\Local]

02/19/2011  05:08 PM    <JUNCTION>     My Documents [C:\Users\djokrall\Documents]

02/19/2011  05:08 PM    <JUNCTION>     NetHood [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Network Shortcuts]

02/19/2011  05:08 PM    <JUNCTION>     PrintHood [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]

02/19/2011  05:08 PM    <JUNCTION>     Recent [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Recent]

02/19/2011  05:08 PM    <JUNCTION>     SendTo [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\SendTo]

02/19/2011  05:08 PM    <JUNCTION>     Start Menu [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Start Menu]

02/19/2011  05:08 PM    <JUNCTION>     Templates [C:\Users\djokrall\AppData\Roaming\Microsoft\Windows\Templates]

               0 File(s)              0 bytes

 Directory of C:\Users\djokrall\AppData\Local

02/19/2011  05:08 PM    <JUNCTION>     Application Data [C:\Users\djokrall\AppData\Local]

02/19/2011  05:08 PM    <JUNCTION>     History [C:\Users\djokrall\AppData\Local\Microsoft\Windows\History]

02/19/2011  05:08 PM    <JUNCTION>     Temporary Internet Files [C:\Users\djokrall\AppData\Local\Microsoft\Windows\Temporary Internet Files]

               0 File(s)              0 bytes

 Directory of C:\Users\djokrall\Documents

02/19/2011  05:08 PM    <JUNCTION>     My Music [C:\Users\djokrall\Music]

02/19/2011  05:08 PM    <JUNCTION>     My Pictures [C:\Users\djokrall\Pictures]

02/19/2011  05:08 PM    <JUNCTION>     My Videos [C:\Users\djokrall\Videos]

               0 File(s)              0 bytes

 Directory of C:\Users\Public\Documents

02/19/2011  05:04 PM    <JUNCTION>     My Music [C:\Users\Public\Music]

02/19/2011  05:04 PM    <JUNCTION>     My Pictures [C:\Users\Public\Pictures]

02/19/2011  05:04 PM    <JUNCTION>     My Videos [C:\Users\Public\Videos]

               0 File(s)              0 bytes

     Total Files Listed:

               0 File(s)              0 bytes

              50 Dir(s)  381,938,143,232 bytes free

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 656 bytes -> C:\Users\djokrall\Documents\justin romero.eml:OECustomProperty

@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:ABE30DDB

@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B623B5B8

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A64A7256

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:5095D8B1

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4E85037E

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C46995DA

@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:D4E0D1F1

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34

@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

 

< End of report >

 

Thanks for your help!!

 

[godawgs]

You are welcome. Thanks for the logs. The aswMBR scan shows tha the Master Boot record is clean 
Let's keep killing things.

Step-1.

Windows Defender shows that it is loading at startup. You have the Microsoft Security Essentials antivirus installed. MSE should have disabled Windows Defender. I wan you to check Windows Defender and see if it is running.

• Open Windows Defender by clicking the Start button , clicking All Programs, and then clicking Windows Defender.
  NOTE: If you get a pop up message telling you that Windows Defender is turned, stop here and let me know.
  IF the Windows Defender program opens up, continue with the instructions below:
• Click Tools, and then click Options.
• Under Administrator options, clear the Use Windows Defender check box, and then click Save.
• If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

 

Step-2.
Let's remove some Chrome extensions:

Open the Chrome browser:

• Click the tools menu icon
• Click Tools.
• Select Extensions. A page like the one shown below will open:
  
• Look for any of the following items:
  Allin1Convert
  Define Ext
  ArcadeFrontier
• If there is a check mark in the box next to it/them, click the box to uncheck it/them. Then click the trash can icon next to the box.
• A confirmation dialog will appear, click Remove

IF you can't find them using the above, try this:

• Launch your Google Chrome browser.
• In the address bar type the following:
  
  chrome:extensions
• The Extension list will appear.
• Look for the following extensions:
  Allin1Convert
  Define Ext
  ArcadeFrontier
• Click on the recycle bin icon near it (uninstall it).
• Restart your browser.

 

Step-3.

Re-run AdwCleaner

Close all open windows and browsers.
Right click the AdwCleaner icon, click Run as administrator and accept the UAC prompt to run AdwCleaner.

• Click the Scan button and wait for the scan to complete.
• When the Scan has finished the Scan button will be grayed out and the Clean button will be activated.
• Click the Clean button.
• Everything checked will be deleted.
• When the program has finished cleaning a report appears.
• Once done it will ask to reboot, allow this
  
  
• On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[S0].txt

 

Step-4.
Scan with JRT:

Please download Junkware Removal Tool to your desktop.
NOTE: Temporarily shut down your protection software now to avoid potential conflicts, how to do so can be read here.

• Right click the JRT icon http://imageshack.us.../thisisujrt.gif[/img and click Run as Administrator to run the application.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

NOTE: Reboot the machine and ensure that all security software is now enabled.
 
 
Step-5.

OTL Fix

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{1A68CBDE-3E4C-4FAE-BF49-AF5AB9868E53}
[2012/04/28 07:22:49 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\DriverCure

:FILES
C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\epikbiglahnndfidencpcjhnefnmooeg\8.22.3.42841_0
C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh\1_0
C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\peglehonblabfemopkgmfcpofbchegcl\2.3.2_0

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open on your desktop. To do that:

• Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).
10. Run OTL again and click the QuickScan button. Post the log it produces in your next reply.

 

 

Things For Your Next Post:
Please post the logs in the order requested. Please don't attach the logs unless I request it.
1. Let me know how the computer is running now
2. Let me know if Windows Defender was already off.
3. Let me know how uninstalling the Chrome extensions went.
4. The AdwCleaner[S0].txt log
5. The JRT.txt log
6. The new OTL.txt log
 

[jp17315]

Computer is running much better so far!

Windows defender was off

Deleted the 2 chrome extensions - All in 1 convert and Arcade Frontier. Define Ext was not listed.

 

Adwcleaner

 

# AdwCleaner v3.205 - Report created 29/04/2014 at 23:03:50

# Updated 28/04/2014 by Xplode

# Operating System : Windows Vista ™ Home Premium Service Pack 2 (32 bits)

# Username : djokrall - DJOKRALL-PC

# Running from : C:\Users\djokrall\Desktop\AdwCleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\Program Files\Free Ride Games

Folder Deleted : C:\Program Files\Optimizer Pro

Folder Deleted : C:\Program Files\PCFixSpeed

Folder Deleted : C:\Program Files\Playbryte

Folder Deleted : C:\Program Files\Common Files\ParetoLogic

Folder Deleted : C:\Program Files\Common Files\speedypc software

Folder Deleted : C:\Windows\system32\AI_RecycleBin

Folder Deleted : C:\Users\djokrall\AppData\Local\BrowserSafeguard

Folder Deleted : C:\Users\djokrall\AppData\Local\Conduit

Folder Deleted : C:\Users\djokrall\AppData\Local\DefineExt

Folder Deleted : C:\Users\djokrall\AppData\Local\emaze

Folder Deleted : C:\Users\djokrall\AppData\Local\iac

Folder Deleted : C:\Users\djokrall\AppData\Local\mapsgalaxy_39

Folder Deleted : C:\Users\djokrall\AppData\Local\NativeMessaging

Folder Deleted : C:\Users\djokrall\AppData\Local\PackageAware

Folder Deleted : C:\Users\djokrall\AppData\Local\SearchProtect

Folder Deleted : C:\Users\djokrall\AppData\Local\visi_coupon

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\DataMngr

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\iac

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\Inbox Toolbar

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\iWon_5k

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\mapsgalaxy_39

Folder Deleted : C:\Users\djokrall\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\djokrall\AppData\Roaming\24x7 help

Folder Deleted : C:\Users\djokrall\AppData\Roaming\DriverCure

Folder Deleted : C:\Users\djokrall\AppData\Roaming\Systweak

Folder Deleted : C:\Users\djokrall\Documents\Optimizer Pro

Folder Deleted : C:\Users\Public\Documents\iWin

Folder Deleted : C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

Folder Deleted : C:\Program Files\Mozilla Firefox\Extensions\[email protected]

Folder Deleted : C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh

File Deleted : C:\END

File Deleted : C:\Program Files\Mozilla Firefox\browser\nsprotector.js

File Deleted : C:\Windows\System32\Tasks\paretologic registration3

File Deleted : C:\Windows\Tasks\paretologic update version3.job

File Deleted : C:\Windows\System32\Tasks\paretologic update version3

File Deleted : C:\Windows\System32\Tasks\PC Optimizer Pro Updates

 

***** [ Shortcuts ] *****

 

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Help.lnk

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inbox Toolbar\Inbox.com.lnk

 

***** [ Registry ] *****

 

Key Deleted : HKCU\Software\Google\Chrome\Extensions\hgiifhjbblnglipdbpdgagphlcbililb

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\hgiifhjbblnglipdbpdgagphlcbililb

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{656917E9-783E-4B89-9723-1B33FAA9D455}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{656917E9-783E-4B89-9723-1B33FAA9D455}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FD36E492-E2D9-401D-B023-04DE3FDE2CA5}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AAFBE964-BDC5-44BC-A005-827A13850A21}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD36E492-E2D9-401D-B023-04DE3FDE2CA5}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7C21E27B-2D49-4037-8729-F9F6BA8B4B8F}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C21E27B-2D49-4037-8729-F9F6BA8B4B8F}

Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr

Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1

Key Deleted : HKLM\SOFTWARE\Classes\driverscanner

Key Deleted : HKLM\SOFTWARE\Classes\inbox.appserver

Key Deleted : HKLM\SOFTWARE\Classes\inbox.ibx404

Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\inbox

Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3307519

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DB507187-9746-458C-97DA-C458131EEDE7}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4084D718-3644-4504-B828-BB054729E39C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6633A945-D022-4853-937D-B3B9BB3964F8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82C7004A-078E-468C-9C0F-2243618FF7CB}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Imesh

Key Deleted : HKCU\Software\ParetoLogic

Key Deleted : HKCU\Software\pc optimizer pro

Key Deleted : HKCU\Software\SpeedMaxPC

Key Deleted : HKCU\Software\speedypc software

Key Deleted : HKCU\Software\visualbee

Key Deleted : HKCU\Software\wecarereminder

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKCU\Software\AppDataLow\Toolbar

Key Deleted : HKCU\Software\AppDataLow\Software\BringMeSports_1c

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\MapsGalaxy_39

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\AppDataLow\Software\WeatherBlink

Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\Software\AVG SafeGuard toolbar

Key Deleted : HKLM\Software\BringMeSports_1c

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\firstsearch

Key Deleted : HKLM\Software\ParetoLogic

Key Deleted : HKLM\Software\PIP

Key Deleted : HKLM\Software\SearchProtect

Key Deleted : HKLM\Software\SpeedMaxPC

Key Deleted : HKLM\Software\speedypc software

Key Deleted : HKLM\Software\systweak

Key Deleted : HKLM\Software\TelevisionFanaticEI

Key Deleted : HKLM\Software\Trymedia Systems

Key Deleted : HKLM\Software\Uniblue

Key Deleted : HKLM\Software\visualbee

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyPC Backup

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Smart PC Cleaner_is1

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v9.0.8112.16545

 

 

-\\ Mozilla Firefox v27.0.1 (en-US)

 

[ File : C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\prefs.js ]

 

 

-\\ Google Chrome v34.0.1847.116

 

[ File : C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

Deleted [Search Provider] : hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=PGL&o=102946&locale=en_US&apn_uid=737b82f2-b5bb-4847-87eb-d26bdcbd30fa&apn_ptnrs=6J&apn_sauid=652BDDC0-3E1F-40A3-A85B-9BE019499DC9&apn_dtid=YYYYYYYYUS&q={searchTerms}

Deleted [Search Provider] : hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=421&sr=0&q={searchTerms}

Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3323224&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPADA42CFD-0A5F-48B9-B5F4-8429B2581822&q={searchTerms}&SSPV=

Deleted [Search Provider] : hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={SearchTerms}&s_it=games-ie&tb_uuid=91F10ACB1C6246479CAC2A5F8C8031F8&tb_oid=10-01-2014&tb_mrud=10-01-2014

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}

Deleted [Search Provider] : hxxp://www2.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80975&iwk=298&lng=en

Deleted [Search Provider] : hxxp://search.tb.ask.com/search/GGmain.jhtml?searchfor={searchTerms}&st=kwd&ptb=0DEF6CC2-AA1D-49B7-BC4B-AC2772B0687D&n=780bd8c6&ind=2014042310&p2=^Y6^xdm003^YYA^us&si=COzLuKDj9r0CFRFnOgod40IAiw

Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl

Deleted [Extension] : bopakagnckmlgajfccecajhnimjiiedh

Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb

Deleted [Extension] : gjkpcnacdgdlpfejlgflolpaigoicibh

Deleted [Extension] : hgiifhjbblnglipdbpdgagphlcbililb

 

*************************

 

AdwCleaner[R0].txt - [11288 octets] - [28/04/2014 23:13:38]

AdwCleaner[R1].txt - [11349 octets] - [29/04/2014 23:01:05]

AdwCleaner[S0].txt - [11401 octets] - [29/04/2014 23:03:50]

 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11462 octets] ##########

 

JRT

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows Vista ™ Home Premium x86

Ran by djokrall on Wed 04/30/2014 at  0:41:35.17

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

~~~ Services

 

 

 

~~~ Registry Values

 

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-646951214-2927039730-2231423905-1000\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL

 

 

 

~~~ Registry Keys

 

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.pseudotransparentplugin

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.pseudotransparentplugin.1

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.radio

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.radio.1

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.settingsplugin

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.settingsplugin.1

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.skinlauncher

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.skinlauncher.1

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.skinlaunchersettings

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\mapsgalaxy_39.skinlaunchersettings.1

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\theseaapp

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-646951214-2927039730-2231423905-1000\Software\web assistant

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4623A8C4-150D-4983-8982-68C01E7D6541}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{36377DD7-B3EB-42f5-986F-680BAF59BA9D}

 

 

 

~~~ Files

 

 

 

~~~ Folders

 

Successfully deleted: [Folder] "C:\ProgramData\conduit"

Successfully deleted: [Folder] "C:\ProgramData\drivergenius"

Successfully deleted: [Folder] "C:\ProgramData\free ride games"

Successfully deleted: [Folder] "C:\ProgramData\pc optimizer pro"

Successfully deleted: [Folder] "C:\ProgramData\pc1data"

Successfully deleted: [Folder] "C:\ProgramData\pcfixspeed"

Successfully deleted: [Folder] "C:\ProgramData\speedmaxpc"

Successfully deleted: [Folder] "C:\ProgramData\speedypc software"

Successfully deleted: [Folder] "C:\ProgramData\trymedia"

Successfully deleted: [Folder] "C:\ProgramData\visualbee"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\couponalert_2pei"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\recipehub_2j"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\recipehub_2jei"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\retrogamer_2z"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\surfcanyon"

Successfully deleted: [Folder] "C:\Users\djokrall\appdata\locallow\weatherblink"

Successfully deleted: [Folder] "C:\Users\djokrall\Local Settings\Application Data\cre"

Successfully deleted: [Folder] "C:\Users\djokrall\Local Settings\Application Data\weatherblink"

Successfully deleted: [Folder] "C:\Program Files\couponalert_2pei"

Successfully deleted: [Folder] "C:\Program Files\epicplay"

Successfully deleted: [Folder] "C:\Program Files\gamingwonderlandei"

Successfully deleted: [Folder] "C:\Program Files\recipehub_2jei"

Successfully deleted: [Folder] "C:\Program Files\weatherblink"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\24x7 help"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\inbox toolbar"

 

 

 

~~~ Event Viewer Logs were cleared

 

New OTL

 

OTL logfile created on: 4/30/2014 1:24:47 AM - Run 3

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\djokrall\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

1.87 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 55.11% Memory free

3.98 Gb Paging File | 3.15 Gb Available in Paging File | 79.21% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 456.48 Gb Total Space | 354.64 Gb Free Space | 77.69% Space Free | Partition Type: NTFS

Drive D: | 9.28 Gb Total Space | 0.91 Gb Free Space | 9.77% Space Free | Partition Type: NTFS

 

Computer Name: DJOKRALL-PC | User Name: djokrall | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/04/28 22:48:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

PRC - [2014/04/14 00:00:58 | 002,484,504 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

PRC - [2014/04/14 00:00:58 | 001,444,120 | ---- | M] (Trusteer Ltd.) -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

PRC - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Online Games Manager\ogmservice.exe

PRC - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\NisSrv.exe

PRC - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe

PRC - [2014/03/11 10:13:14 | 000,951,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012/09/23 21:43:40 | 000,040,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 11.0\Reader\reader_sl.exe

PRC - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe

PRC - [2012/05/09 15:25:58 | 000,152,152 | ---- | M] (Microsoft Corporation) -- C:\Program Files\EMET\EMET_notifier.exe

PRC - [2010/04/29 10:38:54 | 001,652,736 | R--- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe

PRC - [2009/04/11 03:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

PRC - [2008/07/03 12:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\WINDOWS\RtHDVCpl.exe

PRC - [2007/04/18 11:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

PRC - [2007/02/15 07:59:00 | 000,118,784 | ---- | M] (OsdMaestro) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014/03/23 17:04:20 | 000,557,056 | ---- | M] () -- C:\Program Files\Trusteer\Rapport\bin\js32.dll

MOD - [2014/02/13 12:49:39 | 012,434,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2b605fc7deda872727d1ed37710420e\System.Windows.Forms.ni.dll

MOD - [2014/02/13 12:49:25 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\8e6265a54260bddfc05951e764f5bc48\System.Drawing.ni.dll

MOD - [2014/02/13 12:46:53 | 007,977,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\957628d9dd7b3bf370a56dca7835a997\System.ni.dll

MOD - [2014/02/13 12:46:24 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\694a37a84dee2cd2609a1dfab27c0433\mscorlib.ni.dll

MOD - [2014/02/03 05:34:56 | 001,125,592 | ---- | M] () -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportMS.dll

 

 

========== Services (SafeList) ==========

 

SRV - [2014/04/28 23:24:47 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2014/04/14 00:00:58 | 001,444,120 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)

SRV - [2014/03/27 08:07:18 | 000,581,568 | ---- | M] (RealNetworks, Inc.) [Auto | Running] -- C:\Program Files\Online Games Manager\ogmservice.exe -- (ogmservice)

SRV - [2014/03/12 16:23:32 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2014/03/11 10:13:24 | 000,279,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2014/03/11 10:13:24 | 000,022,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2013/09/05 20:41:08 | 000,240,736 | ---- | M] (WildTangent) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppIntegrationService.exe -- (GamesAppIntegrationService)

SRV - [2012/07/11 14:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)

SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2008/11/09 16:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIMMP)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\SymIM.sys -- (SymIM)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - [2014/04/28 21:40:04 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\SWDUMon.sys -- (SWDUMon)

DRV - [2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2014/04/14 00:01:06 | 000,228,888 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys -- (RapportPG)

DRV - [2014/04/14 00:01:06 | 000,156,024 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys -- (RapportEI)

DRV - [2014/04/14 00:01:06 | 000,107,256 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RapportKELL.sys -- (RapportKELL)

DRV - [2014/03/11 09:52:30 | 000,104,264 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2013/10/28 06:06:50 | 000,340,432 | ---- | M] () [Kernel | System | Running] -- C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_59849.sys -- (RapportCerberus_59849)

DRV - [2013/02/06 17:27:50 | 000,208,920 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\keyscrambler.sys -- (KeyScrambler)

DRV - [2011/07/22 12:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)

DRV - [2011/07/12 17:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2008/08/01 20:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008/05/22 15:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008/05/08 09:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)

DRV - [2008/05/08 09:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\HSX_DP.sys -- (HSF_DP)

DRV - [2007/10/18 11:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2007/10/12 11:53:10 | 000,013,312 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\nvsmu.sys -- (nvsmu)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=EIE9HP&PC=UP50

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...&rlz=1I7RNRM_en

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>

 

========== FireFox ==========

 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: 

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\14\NP_wtapp.dll ()

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/03/12 16:22:49 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2012/12/30 17:52:57 | 000,000,000 | ---D | M]

 

[2012/09/03 17:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Extensions

[2014/04/29 23:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\djokrall\AppData\Roaming\Mozilla\Firefox\Profiles\b1ggofji.default\extensions

[2014/04/29 23:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2014/03/12 16:22:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions

[2014/03/12 16:23:35 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions

[2014/03/12 16:22:40 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{1A68CBDE-3E4C-4FAE-BF49-AF5AB9868E53}

File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{635ABD67-4FE9-1B23-4F01-E679FA7484C1}

 

========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: http://www.yahoo.com/

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll

CHR - plugin: Oberon com adapter (Enabled) = C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll

CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll

CHR - plugin: Zylom Plugin (Enabled) = C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - Extension: YouTube = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_1\

CHR - Extension: Google Search = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\

CHR - Extension: Google Wallet = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

CHR - Extension: Gmail = C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2\

 

O1 HOSTS File: ([2012/12/30 16:02:08 | 000,000,724 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SimpleAdblock Class) - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Common Files\Simple Adblock\SimpleAdblock.dll (Simple Adblock)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [EMET Notifier] C:\Program Files\EMET\EMET_notifier.exe (Microsoft Corporation)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe (QFX Software Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: yahoo.com ([]* in Trusted sites)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.76.76 75.75.75.75

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{38423836-BD19-40F9-9050-4DDC6EF47611}: DhcpNameServer = 75.75.76.76 75.75.75.75

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\img24.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/02/20 07:23:48 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/04/30 00:41:30 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT

[2014/04/29 23:45:57 | 001,016,261 | ---- | C] (Thisisu) -- C:\Users\djokrall\Desktop\JRT.exe

[2014/04/28 23:14:20 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\System32\sqlite3.dll

[2014/04/28 23:13:34 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/04/28 22:55:24 | 000,000,000 | ---D | C] -- C:\_OTL

[2014/04/28 22:50:41 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\djokrall\Desktop\aswmbr (1).exe

[2014/04/28 22:48:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

[2014/04/28 22:23:51 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2014/04/26 13:52:40 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/14 00:01:06 | 000,107,256 | ---- | C] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[2014/04/13 06:16:47 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files

[2014/04/12 16:51:56 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers

 

========== Files - Modified Within 30 Days ==========

 

[2014/04/30 01:24:20 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/04/30 01:24:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/04/30 01:23:29 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/04/30 01:23:17 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2014/04/30 01:23:17 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2014/04/30 01:23:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/04/30 01:23:02 | 2010,259,456 | -HS- | M] () -- C:\hiberfil.sys

[2014/04/29 23:46:17 | 001,016,261 | ---- | M] (Thisisu) -- C:\Users\djokrall\Desktop\JRT.exe

[2014/04/29 23:30:22 | 000,001,937 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2014/04/28 23:08:01 | 001,310,621 | ---- | M] () -- C:\Users\djokrall\Desktop\AdwCleaner.exe

[2014/04/28 23:06:23 | 000,000,512 | ---- | M] () -- C:\Users\djokrall\Desktop\MBR.dat

[2014/04/28 22:50:47 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\djokrall\Desktop\aswmbr (1).exe

[2014/04/28 22:48:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\djokrall\Desktop\OTL (3).exe

[2014/04/28 21:40:04 | 000,013,464 | ---- | M] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2014/04/28 21:38:02 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleFordjokrall.job

[2014/04/26 14:53:15 | 000,000,770 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 14:32:43 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2014/04/14 00:01:06 | 000,107,256 | ---- | M] (Trusteer Ltd.) -- C:\Windows\System32\drivers\RapportKELL.sys

[2014/04/11 08:16:54 | 000,000,426 | ---- | M] () -- C:\AVScanner.ini

[2014/04/03 11:04:16 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif

 

========== Files Created - No Company Name ==========

 

[2014/04/28 23:07:53 | 001,310,621 | ---- | C] () -- C:\Users\djokrall\Desktop\AdwCleaner.exe

[2014/04/28 23:06:23 | 000,000,512 | ---- | C] () -- C:\Users\djokrall\Desktop\MBR.dat

[2014/04/26 14:53:15 | 000,000,770 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2014/04/26 13:30:27 | 000,000,426 | ---- | C] () -- C:\AVScanner.ini

[2014/04/12 16:52:38 | 000,013,464 | ---- | C] () -- C:\Windows\System32\drivers\SWDUMon.sys

[2012/12/30 17:44:35 | 000,187,047 | ---- | C] () -- C:\Windows\hpwins23.dat

[2012/12/30 17:12:48 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\RAExpertHistory.xml

[2012/12/30 17:10:53 | 000,000,176 | ---- | C] () -- C:\Users\djokrall\AppData\Local\rahistory.xml

[2012/04/03 14:01:19 | 000,006,144 | ---- | C] () -- C:\Users\djokrall\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/02/19 20:07:05 | 000,103,720 | ---- | C] () -- C:\Users\djokrall\GoToAssistDownloadHelper.exe

[2011/02/19 17:26:21 | 000,000,680 | ---- | C] () -- C:\Users\djokrall\AppData\Local\d3d9caps.dat

 

========== ZeroAccess Check ==========

 

[2006/11/02 08:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 03:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/04/11 03:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

========== LOP Check ==========

 

[2014/01/10 11:14:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\78-com.novelgames.flashgames.bouncing

[2014/03/28 07:54:33 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Arkadium

[2012/05/13 17:19:43 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Auslogics

[2012/08/25 16:05:58 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\FreeBurner

[2011/07/02 10:46:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\funkitron

[2013/09/05 14:51:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Gaijin Ent

[2012/06/03 18:56:57 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\GameCards

[2012/06/03 13:15:22 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\MusicNet

[2012/06/23 19:04:44 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Nuance

[2013/09/11 14:42:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Oberon Media

[2013/11/17 11:20:20 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice

[2011/12/20 17:15:05 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\OpenOffice.org

[2012/11/26 23:28:42 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\QFX Software

[2011/05/08 15:02:28 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Sammsoft

[2011/02/19 17:17:07 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Snapfish

[2011/04/18 15:45:00 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Tific

[2012/08/12 11:02:31 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Triplay

[2011/12/28 17:36:53 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WeatherBug

[2012/06/03 19:01:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WildTangent

[2011/02/27 18:27:04 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\WinBatch

[2012/05/17 14:01:03 | 000,000,000 | ---D | M] -- C:\Users\djokrall\AppData\Roaming\Zeon

 

========== Purity Check ==========

 

 

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 656 bytes -> C:\Users\djokrall\Documents\justin romero.eml:OECustomProperty

@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:ABE30DDB

@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:7D6E8689

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:B623B5B8

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A64A7256

@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:5095D8B1

@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4E85037E

@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C46995DA

@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:D4E0D1F1

@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34

@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

 

< End of report >

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 04/30/2014 at  0:49:36.65

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

[godawgs]

Computer is running much better so far!

That's what we like to hear! I want to do another OTL fix and stop Windows Defender from loading at startup. Then we will look for ant residual malware files.


Step-1.

OTL Fix

Please close all open windows and browsers
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:OTL
File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{1A68CBDE-3E4C-4FAE-BF49-AF5AB9868E53}
File not found (No name found) -- C:\USERS\DJOKRALL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B1GGOFJI.DEFAULT\EXTENSIONS\{635ABD67-4FE9-1B23-4F01-E679FA7484C1}
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open on your desktop. To do that:

• Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).


Please disable any screen save you have running before completing steps 2 and 3.

Step-2.
Run MalwareBytes
Close all programs and browsers on your computer and disable any screen saver you might have running.

• Right click on the file and click Run As Administrator, then click the Continue button on the UAC window. You will now be at the main program as shown below
   
  
• Click the Update tab and update the program if required.
• Click the Scanner tab, make sure the the Perform full scan option is selected and then click on the Scan button to start scanning your computer.
• MBAM will now start scanning your computer for malware. This process can take quite a while, so I suggest you go and do something else and periodically check on the status of the scan. When MBAM is scanning it will look like the image below.
   
  
• When the scan is finished a message box will appear as shown in the image below.
   
  
• You should click on the OK button to close the message box and continue with the  removal process.
• You will now be back at the main Scanner screen. At this point you should click on the Show Results button.
• A screen displaying all the malware that the program found will be shown as seen in the image below. Please note that the infections found may be different than what is shown in the image.
   
  
• Make sure that everything is checked EXCEPT items in System Restore (see the image below), and click Remove Selected<---Very Important.
   
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.
• Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
  
  
  Step-3.
  
  Run ESET Online Scanner:
  
  Note: Optimized for Internet Explorer but you can use Chrome or Mozilla FireFox for this scan.
  
  Important! You will need to disable your currently installed Anti-Virus program, how to do so can be read here.
  
  Vista / 7 users: You will need to to right-click on either the Internet Explorer or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
  • Please go here then click on:
    
    
    
    

    Note: If using Mozilla Firefox a window will open telling you that you will need to download the ESET Smart Installer. Click on esetsmartinstaller_enu.exe to download the Smart Installer. Save it to the desktop.
    When prompted double click on the icon on the desktop. After successful installation of ESET Smart Installer ESET Online Scanner is launched in a new window.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • A new window will open:
     
    
  • Select the option YES, I accept the Terms of Use then click on:
    
    
  • When prompted allow the Add-On/Active X to install. The following window will open:
    
    
  • Uncheck the box beside Remove Found Threats
  • Check the box Scan archives.
  • 
    
  • Now click on Advanced Settings and select the following:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
  • Now click on:
  • The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically. The scan may take several hours
  Wait for the scan to finish. Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.When The Scan is Complete:
  
  A.
  If No Threats Were Found:
  • Put a checkmark in Uninstall application on close
  • Close the program
  • Report to me that nothing was found
  B.
  If Threats Were Found:
  • Click on list of threats found
  • Click on export to text file and save it to the desktopas ESET SCAN.txt
  • Click on Back
  • Put a checkmark in Uninstall application on close Be sure you have saved the file first
  • Click on Finish
  • Close the program
  Don't forget to enable your Antivirus program and screen saver.
  
  
  Things For Your Next Post:
  Please post the logs in the order requested. Please don't attach the logs unless I request it.
  1. The OTL fixes log
  2. The MalwareBytes log
  3. The ESET scan log (IF it found anything). If it didn't just let me know

[jp17315]

I am having some issues with Malware bytes! I ran it last night and when I clicked on remove selected the program became unresponsive. Clcked the X to close the program and rescanned. same thing happened. I uninstalled and I am in the process of downloading Malwarebytes and scanning again.

[jp17315]

I downloaded Malwarebytes but it doesn't anything like your screen shots and now I can get a log to show up so I can post it. Continuing on with step 3.

[godawgs]

Below are the instructions for MalwareBytes 2.0. See if they help. If you just need to find the logs see To access logs from Malwarebytes Anti-Malware 2.0: below.
 
 
Please download Malwarebytes Anti-Malware Free from here.

• Double click to install the progamme
• When the popup "Completing the Malwarebytes Anti-Malware Setup Wizard" appears, uncheck the box enable free trial of Malwarebytes Anti-Malware Premium

• The MBAM console/dashboard will appear together with an alert to update - click the green button Update Now
• When update is complete select Settings > Detection and Protection and check (tick) Scan for rootkits

• Go back to the Dashboard and click on the green Scan Now button.

• If threats are detected, click the Apply Actions button, MBAM may ask for a reboot. Let it do so.

• On completion of the scan (or after the reboot) select View Detailed Log (to the right on the light green strip)
• Click on the Export button and select Text file and save to the desktop

Copy and paste the log back here.
 
To access logs from Malwarebytes Anti-Malware 2.0:
 
    Open Malwarebytes Anti-Malware 2.0
    Click History > Application Logs
    Double-click the log you would like to open

                Scan Logs record detections from manual scans, including threats detected and the actions taken against them

To save a Scan Log:

    Open the log file you would like to save
    Your default .txt file editor will open
    Click File > Save As
    Choose the desktop to save the log file in, then click Save

[jp17315]

Thanks for the malwarebytes 2.0 instructions they worked like a charm. Heres the logs you requested:

 

OTL FIXES

 

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== OTL ==========

Folder C:\Users\djokrall\AppData\Roaming\DriverCure\ not found.

========== FILES ==========

File\Folder C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\epikbiglahnndfidencpcjhnefnmooeg\8.22.3.42841_0 not found.

File\Folder C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjkpcnacdgdlpfejlgflolpaigoicibh\1_0 not found.

File\Folder C:\Users\djokrall\AppData\Local\Google\Chrome\User Data\Default\Extensions\peglehonblabfemopkgmfcpofbchegcl\2.3.2_0 not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: djokrall

->Temp folder emptied: 2241850 bytes

->Temporary Internet Files folder emptied: 1390523 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 25108928 bytes

->Flash cache emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 44552 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 27.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 04302014_010802

 

Files\Folders moved on Reboot...

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

MBAM - I ran this after the ESET Scan because I ran into issues with MBAM

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 5/3/2014

Scan Time: 12:04:04 AM

Logfile: MBAM.txt

Administrator: Yes

 

Version: 2.00.1.1004

Malware Database: v2014.05.03.01

Rootkit Database: v2014.03.27.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Chameleon: Disabled

 

OS: Windows Vista Service Pack 2

CPU: x86

File System: NTFS

User: djokrall

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 232377

Time Elapsed: 20 min, 3 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Shuriken: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

 

ESET log

 

C:\AdwCleaner\Quarantine\C\Program Files\Conduit\CT3292715\plugins\TBVerifier.dll.vir Win32/Toolbar.Conduit.AC potentially unwanted application

C:\AdwCleaner\Quarantine\C\Program Files\Mozilla Firefox\browser\nsprotector.js.vir Win32/Conduit.SearchProtect.A potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\djokrall\AppData\Local\Conduit\APISupport\APISupport.dll.vir a variant of Win32/Toolbar.Conduit.Z potentially unwanted application

C:\AdwCleaner\Quarantine\C\Users\djokrall\AppData\Local\Conduit\APISupport\MiniSP_1.0.2.60\MiniSP.dll.vir a variant of Win32/Conduit.SearchProtect.H potentially unwanted application

C:\Program Files\Game Discovery\Game Discovery.exe a variant of Win32/Toolbar.CrossRider.E potentially unwanted application

C:\Program Files\Game Discovery\Game DiscoveryGui.exe a variant of Win32/Toolbar.CrossRider.F potentially unwanted application

C:\Program Files\Game Discovery\Uninstall.exe a variant of Win32/Toolbar.CrossRider.E potentially unwanted application

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hk64tbSear.dll Win64/Toolbar.Conduit.B potentially unwanted application

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hktbSear.dll Win32/Toolbar.Conduit.X potentially unwanted application

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\ldrtbSear.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\tbSear.dll a variant of Win32/Toolbar.Conduit.X potentially unwanted application

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll a variant of Win32/PriceGong.A potentially unwanted application

C:\Users\djokrall\Downloads\ccsetup400.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\ccsetup409.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\ccsetup410.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\ccsetup412.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\ccsetup413.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\disk-defrag-setup (1).exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\djokrall\Downloads\disk-defrag-setup (2).exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\djokrall\Downloads\disk-defrag-setup (3).exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\djokrall\Downloads\disk-defrag-setup (4).exe Win32/InstallMonetizer.AQ potentially unwanted application

C:\Users\djokrall\Downloads\disk-defrag-setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\djokrall\Downloads\FoxitReader514.0104_enu_Setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\djokrall\Downloads\PC_Cleaner_Pro_Installer_app3.exe a variant of Win32/PCCleaners potentially unwanted application

C:\Users\djokrall\Downloads\Setup.exe multiple threats

C:\Users\djokrall\Downloads\Shockwave_Installer_Full (4).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\djokrall\Downloads\Shockwave_Installer_Full (5).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\WINDOWS\uninst.exe a variant of Win32/PCCleaners potentially unwanted application

 

Sorry for the delay!

 

[godawgs]

The MBAM scan was clean. A lot of the files that ESET found had already been quarantined by AdwCleaner. And a number of the rest are just unwanted toolbars in setup programs that should be removed anyway. Let's remove the rest of the stuff that ESET found. Then check the services on the computer and check for any programs that need updating.


Step-1.

OTL Fix

Please close all open windows and browsers

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

1. Please copy all of the text in the quote box below (Do Not copy the word Quote. To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:COMMANDS
[createrestorepoint]

:FILES
C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hk64tbSear.dll
C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hktbSear.dll
C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\ldrtbSear.dll
C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\tbSear.dll
C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}
C:\Users\djokrall\Downloads\ccsetup400.exe
C:\Users\djokrall\Downloads\ccsetup409.exe
C:\Users\djokrall\Downloads\ccsetup410.exe
C:\Users\djokrall\Downloads\ccsetup412.exe
C:\Users\djokrall\Downloads\ccsetup413.exe
C:\Users\djokrall\Downloads\disk-defrag-setup (1).exe
C:\Users\djokrall\Downloads\disk-defrag-setup (2).exe
C:\Users\djokrall\Downloads\disk-defrag-setup (3).exe
C:\Users\djokrall\Downloads\disk-defrag-setup (4).exe
C:\Users\djokrall\Downloads\disk-defrag-setup.exe
C:\Users\djokrall\Downloads\FoxitReader514.0104_enu_Setup.exe
C:\Users\djokrall\Downloads\PC_Cleaner_Pro_Installer_app3.exe
C:\Users\djokrall\Downloads\Setup.exe
C:\Users\djokrall\Downloads\Shockwave_Installer_Full (4).exe
C:\Users\djokrall\Downloads\Shockwave_Installer_Full (5).exe

:COMMANDS
[emptytemp]

Warning: This fix is relevant for this system and no other. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

2. Please re-open on your desktop. To do that:

• Vista and 7 users: Right click the icon and click Run as Administrator

3. Place the mouse pointer inside the textbox, right click and click Paste. This will put the above script inside the textbox.
4. Click the button.
5. Let the program run unhindered.
6. OTL may ask to reboot the machine. Please do so if asked.
7. Click the button.
8. A report will open. Copy and Paste that report in your next reply.
9. If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, (where mmddyyyy_hhmmss is the date of the tool run).


Step-2.

Run Farbar Service Scanner

Please download Farbar Service Scanner to the desktop.

• Right click the FSS.exe file, click Run as Administrator and OK any UAC prompts.
  
  
• Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services
• Press "Scan".
• It will create a log (FSS.txt) in the same directory the tool is run.
• Please copy and paste the log to your reply.

Step-3.

Run Security Check

Download Security Check from here or here and save it to the Desktop.

• Right click the SecurityCheck icon and click Run as Administrator to run the application. Allow any UAC warnings.
• Follow the onscreen instructions inside of the black box.
  
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.


Things For Your Next Post:
Please post the logs in the order requested. Please don't attach the logs unless I request it.
1. The OTL fixes log
2. The FSS.txt log
3. The checkup.txt log
4. Let me know if any other issues remain.

[jp17315]

Here are the logs:

 

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== FILES ==========

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hk64tbSear.dll moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\hktbSear.dll moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\ldrtbSear.dll moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\tbSear.dll moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin folder moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12 folder moved successfully.

C:\Users\djokrall\AppData\LocalLow\SearchFlyBar2\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B} folder moved successfully.

C:\Users\djokrall\Downloads\ccsetup400.exe moved successfully.

C:\Users\djokrall\Downloads\ccsetup409.exe moved successfully.

C:\Users\djokrall\Downloads\ccsetup410.exe moved successfully.

C:\Users\djokrall\Downloads\ccsetup412.exe moved successfully.

C:\Users\djokrall\Downloads\ccsetup413.exe moved successfully.

C:\Users\djokrall\Downloads\disk-defrag-setup (1).exe moved successfully.

C:\Users\djokrall\Downloads\disk-defrag-setup (2).exe moved successfully.

C:\Users\djokrall\Downloads\disk-defrag-setup (3).exe moved successfully.

C:\Users\djokrall\Downloads\disk-defrag-setup (4).exe moved successfully.

C:\Users\djokrall\Downloads\disk-defrag-setup.exe moved successfully.

C:\Users\djokrall\Downloads\FoxitReader514.0104_enu_Setup.exe moved successfully.

C:\Users\djokrall\Downloads\PC_Cleaner_Pro_Installer_app3.exe moved successfully.

C:\Users\djokrall\Downloads\Setup.exe moved successfully.

C:\Users\djokrall\Downloads\Shockwave_Installer_Full (4).exe moved successfully.

C:\Users\djokrall\Downloads\Shockwave_Installer_Full (5).exe moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: djokrall

->Temp folder emptied: 856595 bytes

->Temporary Internet Files folder emptied: 2407015 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 14975236 bytes

->Google Chrome cache emptied: 20850303 bytes

->Flash cache emptied: 291 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 89741 bytes

RecycleBin emptied: 6667 bytes

 

Total Files Cleaned = 37.00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 05032014_160545

 

Files\Folders moved on Reboot...

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

Farbar Service Scanner Version: 03-05-2014

Ran by djokrall (administrator) on 03-05-2014 at 16:24:45

Running from "C:\Users\djokrall\Desktop"

Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86)

Boot Mode: Normal

****************************************************************

 

Internet Services:

============

 

Connection Status:

==============

Localhost is accessible.

LAN connected.

Attempt to access Google IP returned error. Google IP is unreachable

Attempt to access Google.com returned error: Google.com is unreachable

Attempt to access Yahoo.com returned error: Yahoo.com is unreachable

 

 

Windows Firewall:

=============

 

Firewall Disabled Policy: 

==================

 

 

System Restore:

============

 

System Restore Disabled Policy: 

========================

 

 

Security Center:

============

 

 

Windows Update:

============

 

Windows Autoupdate Disabled Policy: 

============================

 

 

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is OK.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.

 

 

Windows Defender Disabled Policy: 

==========================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware"=DWORD:1

 

 

Other Services:

==============

 

 

File Check:

========

C:\Windows\system32\nsisvc.dll => MD5 is legit

C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit

C:\Windows\system32\dhcpcsvc.dll => MD5 is legit

C:\Windows\system32\Drivers\afd.sys => MD5 is legit

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit

C:\Windows\system32\Drivers\tcpip.sys

[2013-08-14 06:14] - [2013-07-04 23:20] - 0914880 ____A (Microsoft Corporation) 6D0D344F643E28B31262AC2682109A3C

 

C:\Windows\system32\dnsrslvr.dll => MD5 is legit

C:\Windows\system32\mpssvc.dll => MD5 is legit

C:\Windows\system32\bfe.dll => MD5 is legit

C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit

C:\Windows\system32\SDRSVC.dll => MD5 is legit

C:\Windows\system32\vssvc.exe => MD5 is legit

C:\Windows\system32\wscsvc.dll => MD5 is legit

C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\system32\wuaueng.dll => MD5 is legit

C:\Windows\system32\qmgr.dll => MD5 is legit

C:\Windows\system32\es.dll => MD5 is legit

C:\Windows\system32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\system32\ipnathlp.dll => MD5 is legit

C:\Windows\system32\iphlpsvc.dll => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit

 

 

**** End of log ****

 

 Results of screen317's Security Check version 0.99.82  

 Windows Vista Service Pack 2 x86 (UAC is enabled)  

 Internet Explorer 9  

 Internet Explorer 8  

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Enabled!  

Microsoft Security Essentials   

 Antivirus up to date!  

`````````Anti-malware/Other Utilities Check:````````` 

 SpywareBlaster 5.0    

 SUPERAntiSpyware     

 CCleaner     

 Java 7 Update 45  

 Java version out of Date! 

 Adobe Flash Player 13.0.0.206  

 Adobe Reader XI  

 Mozilla Firefox (29.0) 

 Google Chrome 34.0.1847.116  

 Google Chrome 34.0.1847.131  

````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbam.exe  

 Malwarebytes Anti-Malware mbamscheduler.exe   

 Online Games Manager ogmservice.exe   

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 2 % Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log`````````````````````` 

 

 

[godawgs]

Thanks. How is the computer running now? Do you have any issues remaining? If not, after completing the following we will be ready to clean up the tools we've used.

Step-1.

Hard-Drive Maintenance:

• Click on Start Orb
• Click on All Programs, click the Accessories folder.
• In the Accessories folder right click on Command Prompt and select Run as Administrator.
• Click on Continue at the UAC prompt.
• At the Command Prompt  C:\Windows\System32> type in the following exactly:
  • CD C:\
• Press the Enter key.
• Back at the Command Prompt, type or Copy/Paste the following exactly:
  • DEFRAG C: -F
• Press the Enter key.
• A Analysis report will be displayed and then Windows will start the Defragmentation run automatically.
• This may take some time, when completed the Command Prompt C:\ > will appear.
• Type in EXIT and and hit the Enter key. This will close the Command  window.

 

Step-2.

  JAVA Advice
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software or need it to play games on-line.
In that instance I would recommend that you only use Firefox or Chrome to visit those sites and do the following:

• For Firefox, install the NoScript add-on.
• For Chrome, install the ScriptNo add-on.
  -->IMPORTANT<--: After installing the add-ons you will need to tell them that the site you are visiting is allowed to run Javascript. If you don't, the sites won't work properly. Or not at all. You can go to the NoScript home page here to learn how to use the add-on.
• Disable Java in your browsers until you need it for that software and then enable it. (See How to disable Java in your web browser or How to unplug Java from the browser)

If you still want to update your Java, follow the instructions below:

A.
Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older versions of Java components and update:

Uninstall all versions of Java

• Click the Start Orb, then Control Panel. Under the Programs or Programs and Features section click Uninstall a program. The list of installed programs will populate.
• Remove all older versions of Java. These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE or J2SE
  The versions I see on the computer are:
  • Java 7 Update45
• For Vista/7/8: Right click each program and click Uninstall and follow the on screen instructions for the Java uninstaller.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
  -- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.

B.
Download and Install the latest version of Java Runtime Environment (JRE) Version

• Click here to go to the Java Download page.
• Click the Free Java Download button.
• Click the Agree and Start Free Download button.
• Click Save or Save File on the jxpiinstall.exe download window and save the file to the desktop.
• Close the browser and all open windows.
• On the desktop double click the jxpiinstall.exe file to start the installation. OK any UAC warnings.
• Click the Install button to accept the license terms and to continue with the installation.
  
  
  NOTE: Oracle has partnered with companies that offer various products. The installer may present you with option to install these programs when you install Java.
  
  
• Remove the check mark from the 3rd Party Installations box and click the Next button to continue the installation.
• A few brief dialogs confirm the last steps of the installation process; click Close on the last dialog. This will complete Java installation process.
  
  

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version. It's on the Update tab in Java in the Control Panel.
[Note:] The Java Quick Starter (JQS.exe) adds a service to improve the initial start up time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > You will have to be in Classic View to see Java(It looks like a coffee cup). Double-click on Java click the Advanced Tab click Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.


Things For Your Next Post:
Please post the logs in the order requested. Please don't attach the logs unless I request it.
1. Let me know how the defrag and Java update went
2. Let me know how the computer is running.

[jp17315]

The defrag went well and and I uninstalled java and re installed java...I had to do this based on mother in laws non technical background!

 

Computer is running well...Only thing is when I am in chrome and I click to open a new tab it opens this and I can't figure out how to change it!

 

No webpage was found for the web address: chrome-extension://dhhjmlmdpcpiojiffodbldlkgcnaeogp/components/supertab/html/supertab.html

Error code: ERR_FILE_NOT_FOUND