Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Malware/adware infection

Started by saoirse , Jul 19 2014 03:51 PM

Please log in to reply

#16
zep516

Posted 20 July 2014 - 06:57 PM

Trusted Helper

Malware Removal
8,093 posts

You right click on the OTL Icon on the desktop first, then choose "Run as administrator"

A Quick scan will be fine.

Joe

#17
saoirse

Posted 20 July 2014 - 07:37 PM

Member

Topic Starter
Member
27 posts

!OTL logfile created on: 7/20/2014 9:16:40 PM - Run 4

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nancy\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17207)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.96 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 27.66% Memory free

7.92 Gb Paging File | 4.10 Gb Available in Paging File | 51.81% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 218.20 Gb Total Space | 148.76 Gb Free Space | 68.18% Space Free | Partition Type: NTFS

Unable to calculate disk information.

Computer Name: NANCY-PC | User Name: Nancy | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/07/20 20:44:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Nancy\Downloads\OTL (2).exe

PRC - [2014/06/20 03:57:10 | 000,230,792 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

PRC - [2014/05/12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

PRC - [2014/05/12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

PRC - [2014/05/12 07:24:34 | 006,970,168 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

PRC - [2012/04/04 01:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

PRC - [2009/11/17 10:44:54 | 000,040,960 | ---- | M] () -- C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe

PRC - [2009/06/09 12:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) -- C:\Program Files\Dell\DellDock\DockLogin.exe

PRC - [2009/06/04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

========== Modules (No Company Name) ==========

MOD - [2014/07/15 05:24:48 | 000,353,096 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppgooglenaclpluginchrome.dll

MOD - [2014/07/15 05:24:46 | 014,664,008 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

MOD - [2014/07/15 05:24:44 | 008,537,928 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll

MOD - [2014/07/15 05:24:38 | 000,718,664 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\libglesv2.dll

MOD - [2014/07/15 05:24:36 | 000,126,280 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\libegl.dll

MOD - [2014/07/15 05:24:35 | 001,732,936 | ---- | M] () -- C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll

========== Services (SafeList) ==========

SRV:64bit: - [2014/06/18 20:24:12 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2013/05/27 01:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2012/10/07 10:01:37 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)

SRV:64bit: - [2009/07/16 21:06:22 | 000,033,280 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc)

SRV:64bit: - [2009/06/29 00:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\stacsv64.exe -- (STacSV)

SRV:64bit: - [2009/06/09 12:11:14 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)

SRV - [2014/05/12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2014/05/12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2013/03/21 23:36:46 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/04/04 01:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/02/28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2009/11/17 10:44:54 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe -- (DeviceManager)

SRV - [2009/06/29 00:44:38 | 000,240,128 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe -- (STacSV)

SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2009/06/04 21:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/07/20 19:50:31 | 000,122,584 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)

DRV:64bit: - [2014/05/12 07:26:10 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)

DRV:64bit: - [2014/05/12 07:25:56 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011/07/22 12:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)

DRV:64bit: - [2011/07/12 17:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)

DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2009/08/27 13:18:30 | 000,118,016 | ---- | M] (TCT International Mobile Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qcusbser.sys -- (qcusbser)

DRV:64bit: - [2009/07/16 21:06:20 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)

DRV:64bit: - [2009/07/16 21:06:18 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)

DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009/07/09 05:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)

DRV:64bit: - [2009/06/29 00:44:38 | 000,487,424 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)

DRV:64bit: - [2009/06/15 15:06:42 | 000,172,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009/06/04 06:54:36 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2009/06/02 23:16:56 | 007,333,472 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2009/05/19 23:10:00 | 000,393,728 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)

DRV:64bit: - [2009/05/08 04:15:18 | 000,215,552 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)

DRV:64bit: - [2009/02/05 07:54:10 | 000,225,328 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

DRV:64bit: - [2006/11/01 14:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)

DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE:64bit: - HKLM\..\SearchScopes\{654610C7-59C4-42ED-8FD5-12544AEBA3AF}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKLM\..\SearchScopes,DefaultScope =

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{39172B5C-E3CD-4F23-8AAF-7616C32FCDF7}: "URL" = http://www.bing.com/...rc=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://[email protected]/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\SearchScopes,DefaultScope =

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://n.porta.net/google.com"

FF - prefs.js..network.proxy.backup.ftp: ""

FF - prefs.js..network.proxy.backup.ftp_port: ""

FF - prefs.js..network.proxy.backup.socks: ""

FF - prefs.js..network.proxy.backup.socks_port: ""

FF - prefs.js..network.proxy.backup.ssl: ""

FF - prefs.js..network.proxy.backup.ssl_port: ""

FF - prefs.js..network.proxy.ftp: ""

FF - prefs.js..network.proxy.ftp_port: 8799

FF - prefs.js..network.proxy.http: ""

FF - prefs.js..network.proxy.http_port: ""

FF - prefs.js..network.proxy.share_proxy_settings: ""

FF - prefs.js..network.proxy.socks: ""

FF - prefs.js..network.proxy.socks_port: ""

FF - prefs.js..network.proxy.ssl: ""

FF - prefs.js..network.proxy.ssl_port: ""

FF - prefs.js..network.proxy.type: ""

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.60.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.60.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1: C:\Users\Nancy\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll ( )

FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Nancy\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Nancy\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Nancy\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

[2011/04/13 21:16:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nancy\AppData\Roaming\Mozilla\Extensions

File not found (No name found) -- C:\USERS\NANCY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z7WJSRL3.DEFAULT\EXTENSIONS\D55CD0D7-9F24-4660-95B3-188599E8E4F8@6B2FAF04-E86F-4BCF-A878-632814ACF518.COM

File not found (No name found) -- C:\USERS\NANCY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z7WJSRL3.DEFAULT\EXTENSIONS\FF806580-6DB3-4C09-BA06-D6CAF0E99172@8453CB25-7FEF-4ED5-8934-B08BE5605617.COM

========== Chrome ==========

CHR - default_search_provider: (Enabled)

CHR - default_search_provider: search_url =

CHR - default_search_provider: suggest_url =

CHR - homepage: http://n.porta.net/google.com

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Nancy\AppData\Local\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\gcswf32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Nancy\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java™ Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

CHR - plugin: Windows LiveÂ™ Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Nancy\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll

CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\Nancy\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\

CHR - Extension: Google Wallet = C:\Users\Nancy\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

O1 HOSTS File: ([2014/07/20 07:48:23 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O1364bit: - gopher Prefix: missing

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Plugin Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.60.2)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.60.2)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C7D6DB35-8CBE-489D-8859-83FAEEA40232}: DhcpNameServer = 75.75.75.75 75.75.76.76

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E68395D3-ECB1-4278-BEB2-79E8C06FD09F}: NameServer = 200.105.225.2,200.105.225.4

O18:64bit: - Protocol\Handler\cozi - No CLSID value found

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\cozi {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll (Cozi Group, Inc.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/07/20 15:56:16 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014/07/20 15:55:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

[2014/07/20 15:55:36 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys

[2014/07/20 15:55:36 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys

[2014/07/20 15:55:36 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014/07/20 15:55:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware

[2014/07/20 15:55:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2014/07/20 07:45:36 | 000,000,000 | ---D | C] -- C:\_OTL

[2014/07/19 19:58:52 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{F8404204-7BA7-4F64-AEBC-CE551CA1F707}

[2014/07/19 07:57:59 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{3E5A0AD6-99F2-407C-B1A9-54C106B9993B}

[2014/07/18 19:57:07 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{021E84F5-B9E5-41C8-8897-05D8FB2D5A39}

[2014/07/18 07:56:53 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{1BFE49DB-DE26-443E-AA78-88A99AEAD380}

[2014/07/17 19:56:40 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{06E5E672-B0E5-476D-A619-41E4DA0F03ED}

[2014/07/17 07:55:49 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{70497B6D-7C38-46C1-9453-91EEC9119FF9}

[2014/07/16 19:54:57 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{14D48415-6278-48DF-A604-1B12AFFB5750}

[2014/07/16 07:54:44 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{41D2BE0B-D136-449A-8FBB-E87FD47676EB}

[2014/07/15 17:52:40 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{0CFB824D-E472-40FD-817E-3F3562A5B097}

[2014/07/15 05:51:35 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{ACAE3AC8-D84F-466D-B951-816A5F1922F2}

[2014/07/14 17:47:35 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{14635022-2528-49AC-9E21-33846984615D}

[2014/07/14 17:45:41 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{97BB7E00-D51C-4CAC-8BCB-4302D6455535}

[2014/07/14 16:08:24 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\SysWow64\sqlite3.dll

[2014/07/14 16:07:31 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/07/12 16:34:29 | 000,000,000 | -HSD | C] -- C:\Users\Nancy\AppData\Local\EmieUserList

[2014/07/12 16:34:29 | 000,000,000 | -HSD | C] -- C:\Users\Nancy\AppData\Local\EmieSiteList

[2014/07/12 12:43:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2014/07/12 12:42:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

[2014/07/11 14:20:25 | 000,000,000 | ---D | C] -- C:\SUPERDelete

[2014/07/10 19:09:13 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{05E5D35C-7B8D-48C7-B52C-A428539C7A17}

[2014/07/10 07:08:49 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{CFCE6609-4768-4F01-AC5A-DF77150AADE0}

[2014/07/08 14:24:56 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{2C9E13A0-9D44-42E0-A81C-A0421C116BCD}

[2014/06/28 13:36:44 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{61570072-25A5-41C3-9FA0-434CE421A929}

[2014/06/28 01:35:49 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{8B33D582-E07B-4A9A-978D-031A00EEDEBE}

[2014/06/27 13:34:55 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{2655DFB9-37EC-4295-8355-9C15FB553E24}

[2014/06/27 01:34:40 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{1EE06C26-D863-40D0-81A2-6B0ABBD5CF8F}

[2014/06/26 13:34:22 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{58032922-04C9-4A07-B3B0-C4FBE1F2513F}

[2014/06/26 00:21:54 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{8E973783-C14F-4D92-A06C-EEC1049AB08D}

[2014/06/25 12:20:57 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{9E418645-FB8F-4EEE-B2C4-3D0780B7E2CA}

[2014/06/25 00:20:43 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{82157E21-23DA-4BED-89F4-0A87F6CEF6AB}

[2014/06/24 12:20:31 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{56F5B925-9031-49FC-9C27-53D8D2E7EAC4}

[2014/06/24 00:20:19 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{5C66800E-287F-410A-B550-FF0ADF215D6A}

[2014/06/23 12:20:05 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{B3492C91-A5BF-4F2D-BA5E-653E9159B260}

[2014/06/23 00:19:54 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{60CFDA94-5449-4C51-A38A-B91496470C36}

[2014/06/22 12:19:01 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{8118CE06-E440-438F-B652-6B0A08A3517C}

[2014/06/22 00:18:49 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{36B38102-EA43-4F00-B8B9-A2222F43886E}

[2014/06/21 12:17:39 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{BE4B2671-1567-4FE6-B356-CF3FCA2377C9}

[2014/06/21 00:17:23 | 000,000,000 | ---D | C] -- C:\Users\Nancy\AppData\Local\{D5BDC102-3DA9-4E64-9CC6-945D5D4AD178}

========== Files - Modified Within 30 Days ==========

[2014/07/20 21:02:01 | 000,000,896 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/07/20 20:40:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014/07/20 20:25:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2222092012-326958857-3758879047-1000UA.job

[2014/07/20 19:50:31 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys

[2014/07/20 19:21:02 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2222092012-326958857-3758879047-1000Core.job

[2014/07/20 19:21:01 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2222092012-326958857-3758879047-1000UA.job

[2014/07/20 17:25:00 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2222092012-326958857-3758879047-1000Core.job

[2014/07/20 16:44:20 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014/07/20 16:44:20 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014/07/20 16:37:21 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/07/20 16:37:14 | 000,000,344 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job

[2014/07/20 16:36:54 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2014/07/20 16:36:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/07/20 16:36:40 | 3190,050,816 | -HS- | M] () -- C:\hiberfil.sys

[2014/07/20 15:55:40 | 000,001,064 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014/07/20 07:48:23 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts

[2014/07/18 14:31:06 | 000,002,328 | ---- | M] () -- C:\Users\Nancy\Desktop\Google Chrome.lnk

[2014/07/10 03:24:27 | 000,343,552 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2014/07/08 14:20:35 | 000,782,510 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014/07/08 14:20:35 | 000,662,650 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014/07/08 14:20:35 | 000,122,486 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

========== Files Created - No Company Name ==========

[2014/07/20 15:55:40 | 000,001,064 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014/05/24 22:20:15 | 000,022,754 | ---- | C] () -- C:\Users\Nancy\moonlight.jpg

[2014/02/26 04:09:05 | 000,775,124 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2012/09/27 20:17:33 | 000,060,864 | ---- | C] () -- C:\Users\Nancy\g2mdlhlpx.exe

[2012/01/24 08:15:54 | 000,000,000 | ---- | C] () -- C:\Users\Nancy\AppData\Local\{95DF6620-02EA-4FA1-AA70-06981FCB299F}

[2011/08/27 10:57:26 | 000,008,704 | ---- | C] () -- C:\Users\Nancy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/06/22 10:48:59 | 000,000,400 | ---- | C] () -- C:\Users\Nancy\AppData\Roaming\wklnhst.dat

[2010/06/12 00:10:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010/06/05 18:36:42 | 000,002,154 | ---- | C] () -- C:\Users\Nancy\AppData\Roaming\install.dat

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2014/03/24 22:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2014/03/24 22:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 08:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013/06/06 23:38:31 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\Canon

[2011/03/05 00:33:27 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\FrostWire

[2011/05/13 17:35:28 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\IObit

[2011/11/24 13:18:57 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\Mikrotik

[2013/03/31 14:55:39 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\mjusbsp

[2011/08/22 15:32:31 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\ooVoo Details

[2010/06/20 17:14:20 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\OurPictures

[2010/06/22 10:52:06 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\Template

[2013/09/30 20:11:42 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\webex

[2011/06/03 09:59:40 | 000,000,000 | ---D | M] -- C:\Users\Nancy\AppData\Roaming\Windows Live Writer

========== Purity Check ==========

< End of report >

#18
zep516

Posted 20 July 2014 - 10:29 PM

Trusted Helper

Malware Removal
8,093 posts

Hello,

We need to do another fix to delete some files using OTL just like the great job you did before

Double click on the to open the program. On Vista/Win7/Win8 right click select Run As Administrator to start the program. If prompted by UAC, please allow it.

Under the Custom Scans/Fixes box at the bottom, paste in the following

:COMMANDS
[CREATERESTOREPOINT]

:OTL
[2014/07/20 16:44:20 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/07/20 16:44:20 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
FF - prefs.js..network.proxy.ftp_port: 8799
File not found (No name found) -- C:\USERS\NANCY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z7WJSRL3.DEFAULT\EXTENSIONS\D55CD0D7-9F24-4660-95B3-188599E8E4F8@6B2FAF04-E86F-4BCF-A878-632814ACF518.COM
File not found (No name found) -- C:\USERS\NANCY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z7WJSRL3.DEFAULT\EXTENSIONS\FF806580-6DB3-4C09-BA06-D6CAF0E99172@8453CB25-7FEF-4ED5-8934-B08BE5605617.COM
 
:Files

:Commands

[emptytemp]

Make sure all other windows are closed.
Click the Run Fix button at the top
Let the program run uninterrupted. The computer should reboot when the scan is done. If not, please reboot the computer.
Post the log that is found in C:\_OTL\Moved Files in your next reply.
Open OTL again and click the Quick Scan button.

In review run OTL fix.
1-Post the OTL Fix Log, it should pop up in front of you after reboot or it's here-->C:\_OTL\Moved Files
2-Then do a quick scan, and post that log.

After that is done above and you posted the log reports:

Next

I want to run another scan. This needs to be downloaded to the desktop, not the downloads folder. If it ends up in the downloads folder drag it to the desktop

Please download Farbar Recovery Scan Tool and save it to your Desktop

Note: You need to run the version compatible with your system 64Bit for you. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce a log called FRST.txt in the same directory (Desktop) the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Take your time and post those 2 logs above:
1- FRST.txt
2- Addition.txt

Thanks
Joe

#19
saoirse

Posted 21 July 2014 - 07:06 AM

Member

Topic Starter
Member
27 posts

All processes killed

========== COMMANDS ==========

Restore point Set: OTL Restore Point

========== OTL ==========

C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 moved successfully.

C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 moved successfully.

Prefs.js: 8799 removed from network.proxy.ftp_port

========== FILES ==========

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Nancy

->Temp folder emptied: 12107868 bytes

->Temporary Internet Files folder emptied: 401185 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Google Chrome cache emptied: 351138791 bytes

->Flash cache emptied: 0 bytes

User: Public

User: TEMP

User: TEST

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 2078 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 347.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 07212014_085128

#20
saoirse

Posted 21 July 2014 - 07:08 AM

Member

Topic Starter
Member
27 posts

When I rebooted this time, a window popped up saying that unauthorized changes were made to WINDOWS. Should I use their fix for it?

#21
saoirse

Posted 21 July 2014 - 07:25 AM

Member

Topic Starter
Member
27 posts

OTL logfile created on: 7/21/2014 9:11:23 AM - Run 5

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nancy\Downloads

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17207)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.96 Gb Total Physical Memory | 2.37 Gb Available Physical Memory | 59.75% Memory free

7.92 Gb Paging File | 5.94 Gb Available in Paging File | 75.02% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 218.20 Gb Total Space | 148.19 Gb Free Space | 67.91% Space Free | Partition Type: NTFS

Unable to calculate disk information.

Computer Name: NANCY-PC | User Name: Nancy | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/07/19 16:36:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Nancy\Downloads\OTL.exe