[Nately]

Hello,

 

Can anyone help in the removing of adns.com virus from my PC I have windows xp 2000 and it is appearing when I use AOL as my browser.  It appears as a blank white window and keeps popping up.  I have used Norton and adw cleaner to no avail.  Any help would be appreciated.  Thank you.

Edited by Nately, 13 August 2014 - 04:42 AM.

[Advertisements]

Hello User and

My nickname is Ruggie and I will be assisting you in cleaning your computer.
Please be aware I am currently in training and all my work will be checked by an instructor so there may be a slight delay between posts. The added benefit to this is that you will have 2 sets of eyes looking at your problem so you can be assured you will get the best possible help.

• Malware removal can be a long process and will at times get complicated with multiple steps to perform to ensure that your system is no longer infected.
• When we start the process, the list of instructions must be followed closely, it will be difficult at times but it is important that you stay with me until your computer is declared clean.

Before going any further, I recommend that you print out (or save to a file) these guidelines and also the instructions when I post them, as part of the repair process may involve going into safe mode and therefore you will not have internet access.

 

The following guidelines are important but the ones highlighted in RED are of the highest importance and must not be skipped.

Please be aware, the fixes we perform are specific to this machine, at this moment in time. They must not be used on another computer or unsupervised at another time. This can render your computer unbootable.

If at all possible, Make backups of all your important files, whilst we will do our best to ensure that no files are lost or damaged, sometimes things can go wrong.

I will do everything in my power to ensure that this clean is successful, but occasionally failure hits us all. In this event, please have your original installation disks to hand and be prepared to have to format and reinstall your computer.

Refrain from using any tool that hasn't been instructed as it could alter the process that we are working through and cause further problems. Also only use the tools I instruct in the manner provided as they are very powerful and if not used properly can cause even more problems. It is best if you can avoid using the computer at all, apart from to perform the cleaning steps to ensure that any infections aren't spread.

Please stick with me until the end. malware removal is difficult and time consuming. We have to analyse hundreds of lines in log files. This takes time which we give freely so I ask that you do us the courtesy of seeing it through.

Only paste the contents of log files into your reply, DO NOT attach any log files unless requested to do so.

If you have any questions or get stuck, stop and ask....I am here to help you make this go as smoothly as possible.

If you do not reply within 3 days, your topic will be closed. It can be reopened if you ask. But if you plan on being gone for a longer period, just let me know and I will hold it open for you.

Ready? Now lets get to work

 

OTL Scan

OTL

• Please download OTL from http://oldtimer.geekstogo.com/OTL.exe and save it to your desktop.
• Double Click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in:
  

  
  /md5start
  user32.dll
  /md5stop
   

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open a notepad window containing OTL.Txt. This is saved in the same location as OTL.

 

Please copy (Edit->Select All, Edit->Copy) the contents of this file, and paste it into your reply.
 
There will also be another file opened at the same time called additions.txt. Please also paste the content of this file.

[ruggie_uk]

Hello User and

My nickname is Ruggie and I will be assisting you in cleaning your computer.
Please be aware I am currently in training and all my work will be checked by an instructor so there may be a slight delay between posts. The added benefit to this is that you will have 2 sets of eyes looking at your problem so you can be assured you will get the best possible help.

• Malware removal can be a long process and will at times get complicated with multiple steps to perform to ensure that your system is no longer infected.
• When we start the process, the list of instructions must be followed closely, it will be difficult at times but it is important that you stay with me until your computer is declared clean.

Before going any further, I recommend that you print out (or save to a file) these guidelines and also the instructions when I post them, as part of the repair process may involve going into safe mode and therefore you will not have internet access.

 

The following guidelines are important but the ones highlighted in RED are of the highest importance and must not be skipped.

Please be aware, the fixes we perform are specific to this machine, at this moment in time. They must not be used on another computer or unsupervised at another time. This can render your computer unbootable.

If at all possible, Make backups of all your important files, whilst we will do our best to ensure that no files are lost or damaged, sometimes things can go wrong.

I will do everything in my power to ensure that this clean is successful, but occasionally failure hits us all. In this event, please have your original installation disks to hand and be prepared to have to format and reinstall your computer.

Refrain from using any tool that hasn't been instructed as it could alter the process that we are working through and cause further problems. Also only use the tools I instruct in the manner provided as they are very powerful and if not used properly can cause even more problems. It is best if you can avoid using the computer at all, apart from to perform the cleaning steps to ensure that any infections aren't spread.

Please stick with me until the end. malware removal is difficult and time consuming. We have to analyse hundreds of lines in log files. This takes time which we give freely so I ask that you do us the courtesy of seeing it through.

Only paste the contents of log files into your reply, DO NOT attach any log files unless requested to do so.

If you have any questions or get stuck, stop and ask....I am here to help you make this go as smoothly as possible.

If you do not reply within 3 days, your topic will be closed. It can be reopened if you ask. But if you plan on being gone for a longer period, just let me know and I will hold it open for you.

Ready? Now lets get to work

 

OTL Scan

OTL

• Please download OTL from http://oldtimer.geekstogo.com/OTL.exe and save it to your desktop.
• Double Click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in:
  

  
  /md5start
  user32.dll
  /md5stop
   

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open a notepad window containing OTL.Txt. This is saved in the same location as OTL.

 

Please copy (Edit->Select All, Edit->Copy) the contents of this file, and paste it into your reply.
 
There will also be another file opened at the same time called additions.txt. Please also paste the content of this file.

[ruggie_uk]

I do apologise Nately, the extra file will be called extras.txt and not additions.txt.

[Dakeyras]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Dakeyras]

Topic re-opened per OP's request.

[Nately]

Thank you for responding to my post, your attention is very much appreciated.  Apologies for the delay but below is the information you requested and I look forward to hearing from you further.

 

 

OTL logfile created on: 25/08/2014 09:24:45 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Raymond Sleet\My Documents\Downloads

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

767.35 Mb Total Physical Memory | 460.47 Mb Available Physical Memory | 60.01% Memory free

1.83 Gb Paging File | 1.36 Gb Available in Paging File | 74.37% Paging File free

Paging file location(s): C:\pagefile.sys 1152 2224 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 28.00 Gb Total Space | 5.60 Gb Free Space | 20.02% Space Free | Partition Type: NTFS

Drive D: | 27.93 Gb Total Space | 27.91 Gb Free Space | 99.92% Space Free | Partition Type: NTFS

 

Computer Name: GLOBAL | User Name: Raymond Sleet | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014/08/25 09:09:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Raymond Sleet\My Documents\Downloads\OTL (1).exe

PRC - [2014/08/11 14:51:00 | 003,244,048 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgidsagent.exe

PRC - [2014/08/11 14:49:02 | 000,846,864 | ---- | M] (AVG Technologies CZ, s.r.o.) -- c:\Program Files\AVG\AVG2014\avgrsx.exe

PRC - [2014/08/11 14:45:50 | 000,643,088 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgcsrvx.exe

PRC - [2014/08/11 14:42:36 | 000,838,160 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgnsx.exe

PRC - [2014/08/11 14:42:34 | 005,187,088 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgui.exe

PRC - [2014/08/11 14:41:40 | 000,657,936 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgemcx.exe

PRC - [2014/08/11 14:36:28 | 000,289,328 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2014\avgwdsvc.exe

PRC - [2013/07/17 18:49:50 | 000,182,184 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe

PRC - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe

PRC - [2012/09/06 21:11:30 | 001,327,104 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\ControlCenter4\BrCcUxSys.exe

PRC - [2012/09/06 21:06:14 | 000,393,216 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\ControlCenter4\BrCtrlCntr.exe

PRC - [2012/06/06 15:31:56 | 003,076,096 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\Brother\BrStMonW.exe

PRC - [2012/06/05 15:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\BrYNSvc.exe

PRC - [2011/10/07 10:40:42 | 001,387,288 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe

PRC - [2011/09/27 20:05:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe

PRC - [2010/03/09 00:42:02 | 000,029,984 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PaperPort\pptd40nt.exe

PRC - [2010/03/09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe

PRC - [2010/03/05 20:11:30 | 000,636,192 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe

PRC - [2009/05/05 16:06:06 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe

PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/05/25 18:16:08 | 000,042,032 | ---- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\1348676577\ee\aolsoftware.exe

PRC - [2006/10/23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\acs\AOLacsd.exe

PRC - [2004/09/10 07:32:48 | 000,053,248 | ---- | M] (Brother Industries, Ltd.) -- C:\WINDOWS\system32\BrmfBAgS.exe

PRC - [2004/07/28 19:31:36 | 000,026,112 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\realplay.exe

PRC - [2002/08/02 14:46:00 | 000,032,768 | ---- | M] (Lucent Technologies) -- C:\WINDOWS\LTSMMSG.exe

PRC - [2002/07/03 17:17:00 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\system32\ezSP_Px.exe

PRC - [2002/06/27 13:53:02 | 000,040,960 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Action Setup\VAServ.exe

PRC - [2000/07/13 21:00:00 | 000,073,784 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Microsoft Works\msworks.exe

PRC - [2000/07/13 21:00:00 | 000,061,494 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Microsoft Works\WksWP.exe

PRC - [2000/07/13 21:00:00 | 000,057,401 | ---- | M] (Microsoft® Corporation) -- C:\Program Files\Microsoft Works\wkgdcach.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2011/10/07 10:41:16 | 000,879,896 | ---- | M] () -- C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll

MOD - [2009/02/27 16:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files\Brother\BrUtilities\BrLogAPI.dll

 

 

========== Services (SafeList) ==========

 

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)

SRV - File not found [Auto | Stopped] --  -- (AOLService)

SRV - [2014/08/11 14:51:00 | 003,244,048 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2014\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2014/08/11 14:36:28 | 000,289,328 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2014\avgwdsvc.exe -- (avgwd)

SRV - [2014/08/10 07:13:42 | 000,262,320 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013/07/17 18:49:50 | 000,182,184 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)

SRV - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2012/06/05 15:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files\Browny02\BrYNSvc.exe -- (BrYNSvc)

SRV - [2011/09/27 20:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)

SRV - [2010/03/09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP)

SRV - [2006/10/23 13:50:35 | 000,046,640 | R--- | M] (AOL LLC) [On_Demand | Stopped] -- C:\Program Files\Common Files\AOL\acs\AOLacsd.exe -- (AOL ACS)

SRV - [2004/09/10 07:32:48 | 000,053,248 | ---- | M] (Brother Industries, Ltd.) [Auto | Running] -- C:\WINDOWS\system32\BrmfBAgS.exe -- (brmfbags)

SRV - [2002/07/12 13:18:36 | 000,065,536 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PPPoEWin)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)

DRV - File not found [Kernel | System | Stopped] --  -- (Changer)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (adiusbaw)

DRV - File not found [Kernel | Auto | Stopped] --  -- (ADILOADER)

DRV - [2014/08/25 06:21:35 | 000,039,464 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{12D0C85B-DF0C-433A-9030-50FF4FAA86B7}\MpKsl38297774.sys -- (MpKsl38297774)

DRV - [2014/06/30 12:43:12 | 000,121,624 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgdiskx.sys -- (Avgdiskx)

DRV - [2014/06/17 16:22:02 | 000,188,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)

DRV - [2014/06/17 16:21:22 | 000,197,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)

DRV - [2014/06/17 16:18:00 | 000,241,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avglogx.sys -- (Avglogx)

DRV - [2014/06/17 16:17:58 | 000,147,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)

DRV - [2014/06/17 16:17:56 | 000,190,232 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverlx.sys -- (AVGIDSDriverl)

DRV - [2014/06/17 16:06:24 | 000,098,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)

DRV - [2014/06/17 16:06:22 | 000,027,416 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)

DRV - [2014/06/17 16:06:20 | 000,021,272 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)

DRV - [2014/04/19 07:30:53 | 000,013,464 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)

DRV - [2013/04/11 09:13:06 | 000,013,560 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\gfibto.sys -- (gfibto)

DRV - [2011/09/02 07:31:28 | 000,081,304 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)

DRV - [2011/09/02 07:30:58 | 000,065,048 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)

DRV - [2011/09/02 07:30:58 | 000,022,040 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV - [2011/09/02 07:30:58 | 000,012,184 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)

DRV - [2010/08/12 13:15:20 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd)

DRV - [2008/04/13 19:36:41 | 000,063,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mf.sys -- (mf)

DRV - [2006/12/29 13:00:17 | 000,028,352 | ---- | M] (MusicMatch, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\MxlW2k.sys -- (MxlW2k)

DRV - [2004/08/23 15:40:04 | 000,011,089 | ---- | M] (Mobile Action Technology Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\MaVc2K.sys -- (MaVctrl)

DRV - [2004/07/28 19:31:44 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)

DRV - [2003/01/10 22:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw)

DRV - [2002/08/02 14:46:00 | 000,816,043 | ---- | M] (Lucent Technologies) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltsm.sys -- (LucentSoftModem)

DRV - [2002/07/22 11:11:00 | 000,209,280 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce)

DRV - [2002/07/22 11:11:00 | 000,013,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax)

DRV - [2002/07/03 17:50:36 | 000,031,586 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SonyWBMS.sys -- (SONYWBMS)

DRV - [2002/06/13 11:37:16 | 000,045,568 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)

DRV - [2002/02/26 10:40:24 | 000,058,224 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)

DRV - [2002/02/06 13:52:00 | 000,013,342 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nv_agp.SYS -- (nv_agp)

DRV - [2001/08/17 14:12:24 | 000,003,168 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrParImg.sys -- (brparimg)

DRV - [2001/08/17 14:12:18 | 000,039,552 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrParwdm.sys -- (BrParWdm)

DRV - [2001/08/17 14:12:12 | 000,002,944 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BrFilt.sys -- (brfilt)

DRV - [2001/08/09 16:25:22 | 000,022,608 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wandrv.sys -- (wandrv)

DRV - [2000/12/06 00:18:02 | 000,003,952 | R--- | M] (Sony Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\DMICall.sys -- (DMICall)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP62

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?...=OIE8HP&PC=UP62

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKLM\..\URLSearchHook: {4a6e1b85-1193-4a2a-aab8-7417f275f18a} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP62

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://uk.search.ya...278&fr=sp_tr_ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\SearchScopes,DefaultScope = {A06F5ED7-4B90-4E62-9AD7-09DE472E063F}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC

IE - HKCU\..\SearchScopes\{A06F5ED7-4B90-4E62-9AD7-09DE472E063F}: "URL" = https://uk.search.ya...p={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

 

========== FireFox ==========

 

FF - prefs.js..browser.search.defaulturl: "http://aolbroadband....romesbox-en-uk"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.aol.co.uk"

FF - prefs.js..browser.startup.homepage: "http://www.aol.co.uk"

FF - prefs.js..network.proxy.no_proxies_on: "localhost"

FF - prefs.js..browser.search.defaultenginename: "Yahoo!"

FF - prefs.js..browser.search.selectedEngine: "Yahoo!"

FF - prefs.js..keyword.URL: "https://uk.search.ya...type=711278&p="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

 

 

[2010/01/16 16:01:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Extensions

[2014/08/05 11:43:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions

[2011/10/10 10:56:16 | 000,000,000 | ---D | M] (AOL Broadband Toolbar) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\{796503e4-19fe-48a3-82da-5c1fe0a13e3f}

[2014/08/05 11:43:35 | 000,000,000 | ---D | M] (Amazon Shopping Assistant by Spigot) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]

[2014/08/05 11:43:39 | 000,000,000 | ---D | M] (Ebay Shopping Assistant by Spigot) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]

[2014/08/05 11:43:24 | 000,000,000 | ---D | M] (Slick Savings) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]

[2011/10/11 17:41:07 | 000,002,309 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\searchplugins\aol-search.xml

[2014/08/05 11:41:53 | 000,000,795 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\searchplugins\yahoo_ff.xml

 

========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: 

CHR - plugin: Error reading preferences file

CHR - Extension: AdBlock = C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.12_0\

CHR - Extension: Google Wallet = C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\

 

O1 HOSTS File: ([2008/12/26 13:21:42 | 000,000,021 | ---- | M]) - C:\WINDOWS\Help\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {210A34B7-A8CB-4A43-8392-7EBCF86276B6} - No CLSID value found.

O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (AOL Broadband Toolbar Loader) - {776a9d06-e178-4aa0-aee4-b4de3a64ad28} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {e6ed7f95-e571-4f81-8757-5eb11252703d} - C:\Program Files\AOL Broadband Toolbar\aolbbtb.dll (AOL LLC.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.

O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2014\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [ControlCenter4] C:\Program Files\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)

O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)

O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1348676577\ee\aolsoftware.exe (AOL LLC)

O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKLM..\Run: [LTSMMSG] C:\WINDOWS\LTSMMSG.exe (Lucent Technologies)

O4 - HKLM..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe (Microsoft® Corporation)

O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize File not found

O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [PPort12reminder] C:\Program Files\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)

O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [ISUSPM] C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VAIO Action Setup (Server).lnk = C:\Program Files\Sony\VAIO Action Setup\VAServ.exe (Sony Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O15 - HKCU\..Trusted Domains:   ([]msn in My Computer)

O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)

O15 - HKCU\..Trusted Domains: paypal ([]https in Trusted sites)

O15 - HKCU\..Trusted Domains: sony-europe.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: sonystyle-europe.com ([]* in Trusted sites)

O15 - HKCU\..Trusted Domains: vaio-link.com ([]* in Trusted sites)

O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.m...ash/swflash.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4362EECC-45AA-4F37-A92E-B0DAF703F8AB}: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)

O24 - Desktop WallPaper: C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2002/08/20 20:41:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (SsiEfr.e)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2014\avgrsx.exe /sync /restart)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 

========== Files/Folders - Created Within 30 Days ==========

 

[2014/08/24 09:34:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Raymond Sleet\Recent

[2014/08/20 11:31:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\My Documents\Turbo Lister

[2014/08/17 18:40:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avg_Update_0614a

[2014/08/16 10:42:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\Application Data\AVG2014

[2014/08/16 10:38:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG

[2014/08/16 10:38:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\Application Data\TuneUp Software

[2014/08/16 10:36:35 | 000,000,000 | -H-D | C] -- C:\$AVG

[2014/08/16 10:36:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG2014

[2014/08/16 10:35:00 | 000,000,000 | ---D | C] -- C:\Program Files\AVG

[2014/08/16 10:29:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Avg2014

[2014/08/12 06:56:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Trusteer

[2014/08/11 12:08:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\NPE

[2014/08/11 12:08:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Norton

[2014/08/05 12:09:26 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\WINDOWS\System32\sqlite3.dll

[2014/08/05 12:08:04 | 000,000,000 | ---D | C] -- C:\AdwCleaner

[2014/08/05 11:37:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Raymond Sleet\My Documents\Downloads

[2006/01/15 16:09:20 | 000,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2014/08/25 09:31:02 | 000,000,900 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2014/08/25 09:14:28 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Ruggie.wps

[2014/08/25 08:53:02 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-809299238-4212676017-31143968-1005UA.job

[2014/08/25 08:45:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2014/08/25 06:29:04 | 000,000,384 | -H-- | M] () -- C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job

[2014/08/25 06:24:02 | 000,000,428 | ---- | M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job

[2014/08/25 06:18:56 | 000,000,896 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2014/08/25 06:18:54 | 000,000,238 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Logon.job

[2014/08/25 06:18:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2014/08/25 06:18:39 | 804,691,968 | -HS- | M] () -- C:\hiberfil.sys

[2014/08/24 19:00:42 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2014/08/23 15:53:02 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-809299238-4212676017-31143968-1005Core.job

[2014/08/22 17:29:03 | 000,000,486 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2014/08/21 19:59:29 | 000,001,738 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk

[2014/08/21 11:58:58 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI

[2014/08/19 20:04:21 | 000,014,336 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Tesco 19.08.14.wps

[2014/08/16 20:13:55 | 000,353,348 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\MyeBaySummary.pdf

[2014/08/16 10:38:50 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2014.lnk

[2014/08/13 12:03:55 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\bbq.wps

[2014/08/11 14:02:51 | 000,000,211 | RHS- | M] () -- C:\boot.ini

[2014/08/10 07:13:41 | 000,699,056 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2014/08/10 07:13:40 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2014/08/08 15:27:46 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Microsoft Windows XP End of Service Notification Monthly.job

[2014/08/07 15:30:11 | 000,011,264 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Window  Report Letter.wps

[2014/08/07 09:33:35 | 000,012,288 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\RBS - SPAM.wps

[2014/08/06 12:20:26 | 000,029,696 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2014/08/06 07:41:11 | 000,465,579 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\2014524GlobalCoins.pdf

[2014/08/02 08:40:00 | 000,015,872 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\British Coins For Date Sorter.wps

[2014/07/30 06:31:52 | 000,477,699 | ---- | M] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Sleetslisting.bmp

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2014/08/25 09:14:26 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Ruggie.wps

[2014/08/21 19:59:29 | 000,001,738 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk

[2014/08/21 19:59:27 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk

[2014/08/19 20:04:20 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Tesco 19.08.14.wps

[2014/08/16 20:13:50 | 000,353,348 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\MyeBaySummary.pdf

[2014/08/16 10:38:50 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2014.lnk

[2014/08/13 12:03:54 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\bbq.wps

[2014/08/07 15:30:10 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Window  Report Letter.wps

[2014/08/07 09:33:35 | 000,012,288 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\RBS - SPAM.wps

[2014/08/06 07:41:04 | 000,465,579 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\2014524GlobalCoins.pdf

[2014/08/02 08:10:24 | 000,015,872 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\British Coins For Date Sorter.wps

[2014/07/30 06:31:46 | 000,477,699 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\My Documents\Sleetslisting.bmp

[2014/03/30 07:39:41 | 000,013,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys

[2013/05/29 19:17:26 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRADM10A.DAT

[2013/05/29 19:17:25 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL

[2013/05/29 19:17:25 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI

[2013/05/24 07:57:44 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dat

[2003/07/31 19:58:29 | 000,029,696 | ---- | C] () -- C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 

========== ZeroAccess Check ==========

 

[2013/10/18 19:42:55 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2012/04/20 20:29:52 | 001,510,400 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\System32\wbem\fastprox.dll -- [2009/02/09 13:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\System32\wbem\wbemess.dll -- [2008/04/14 01:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

========== Custom Scans ==========

 

< MD5 for: USER32.DLL  >

[2005/03/02 19:19:56 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=1800F293BCCC8EDE8A70E12B88D80036 -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2003/09/25 17:49:02 | 000,560,128 | ---- | M] (Microsoft Corporation) MD5=32173306185F603E75C477E117F3BB8D -- C:\WINDOWS\$xpsp1hfm$\KB824141\user32.dll

[2007/03/08 16:48:36 | 000,578,048 | ---- | M] (Microsoft Corporation) MD5=7AA4F6C00405DFC4B70ED4214E7D687B -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008/04/14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008/04/14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll

[2007/03/08 16:36:28 | 000,577,536 | ---- | M] (Microsoft Corporation) MD5=B409909F6E2E8A7067076ED748ABF1E7 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2001/08/18 11:00:00 | 000,561,152 | ---- | M] (Microsoft Corporation) MD5=BE57A5C3ABD240514B98F6BCA872FB21 -- C:\WINDOWS\$NtUninstallKB824141$\user32.dll

[2004/08/04 08:56:46 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=C72661F8552ACE7C5C85E16A3CF505C4 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2005/03/02 19:09:30 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=DE2DB164BBB35DB061AF0997E4499054 -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

 

========== Alternate Data Streams ==========

 

@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1

 

< End of report >

 

 

Extras Text:

 

OTL Extras logfile created on: 25/08/2014 09:24:45 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\Raymond Sleet\My Documents\Downloads

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

 

767.35 Mb Total Physical Memory | 460.47 Mb Available Physical Memory | 60.01% Memory free

1.83 Gb Paging File | 1.36 Gb Available in Paging File | 74.37% Paging File free

Paging file location(s): C:\pagefile.sys 1152 2224 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 28.00 Gb Total Space | 5.60 Gb Free Space | 20.02% Space Free | Partition Type: NTFS

Drive D: | 27.93 Gb Total Space | 27.91 Gb Free Space | 99.92% Space Free | Partition Type: NTFS

 

Computer Name: GLOBAL | User Name: Raymond Sleet | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.html [@ = OperaStable] -- Reg Error: Key error. File not found

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

http [open] -- Reg Error: Key error.

https [open] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 1

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 

========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)

"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL -- (AOL LLC)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Program Files\AOL 9.0a\waol.exe" = C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"C:\Program Files\eBay\Turbo Lister2\Tl.exe" = C:\Program Files\eBay\Turbo Lister2\Tl.exe:*:Enabled:eBay Turbo Lister 2 -- (eBay Inc.)

"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)

"C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe:*:Enabled:AOL -- (AOL LLC)

"C:\Program Files\Common Files\AOL\1132993503\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1132993503\ee\aolsoftware.exe:*:Enabled:AOL Shared Components -- (AOL LLC)

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"C:\Program Files\AOL\RC\regClient.exe" = C:\Program Files\AOL\RC\regClient.exe:*:Enabled:AOL

"C:\Program Files\AOL 9.0a\waol.exe" = C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL

"C:\Program Files\AOL 9.0 VR\waol.exe" = C:\Program Files\AOL 9.0 VR\waol.exe:*:Enabled:AOL

"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed -- (AOL LLC)

"C:\Program Files\Common Files\AOL\1132993503\ee\AOLServiceHost.exe" = C:\Program Files\Common Files\AOL\1132993503\ee\AOLServiceHost.exe:*:Enabled:AOL -- (America Online, Inc.)

"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)

"C:\Program Files\Common Files\AOL\System Information\sinf.exe" = C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL System Information -- (AOL LLC)

"C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL -- (AOL Inc.)

"C:\Program Files\AOL 9.0 VRa\waol.exe" = C:\Program Files\AOL 9.0 VRa\waol.exe:*:Enabled:AOL

"C:\Program Files\AOL 9.0 VRb\waol.exe" = C:\Program Files\AOL 9.0 VRb\waol.exe:*:Enabled:AOL

"C:\Program Files\Internet Explorer\iexplore.exe" = C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer -- (Microsoft Corporation)

"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)

"C:\Program Files\Common Files\AOL\1206370937\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1206370937\ee\aolsoftware.exe:*:Enabled:AOL Shared Components

"C:\Program Files\Common Files\AOL\1348676577\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1348676577\ee\aolsoftware.exe:*:Enabled:AOL Shared Components -- (AOL LLC)

"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console -- (Microsoft Corporation)

"C:\Program Files\AVG\AVG2014\avgnsx.exe" = C:\Program Files\AVG\AVG2014\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG2014\avgdiagex.exe" = C:\Program Files\AVG\AVG2014\avgdiagex.exe:*:Enabled:AVG Diagnostics 2014 -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG2014\avgmfapx.exe" = C:\Program Files\AVG\AVG2014\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)

"C:\Program Files\AVG\AVG2014\avgemcx.exe" = C:\Program Files\AVG\AVG2014\avgemcx.exe:*:Enabled:Personal Email Scanner -- (AVG Technologies CZ, s.r.o.)

 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser

"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{21CF3E6E-1659-433E-B6CE-165D793560DA}" = VAIO Grid Wallpaper

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{2366D960-F00F-11D3-99D3-00C04FCCB775}" = VAIO System Information

"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25

"{28656860-4728-433C-8AD4-D1A930437BC8}" = Nuance PDF Viewer Plus

"{29F61465-428A-11D4-B646-00C04F790F76}" = DVgate

"{2B9FBAE1-5016-4F14-B452-E6874A3C1284}" = VAIO Clock Screen Saver

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{390DD8BB-BB57-4942-A029-2D913E4E9D74}" = Microsoft Security Client

"{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}" = Brother MFL-Pro Suite DCP-7055

"{3B24B725-D81F-442D-8CE5-2AF05A4A4CC9}" = Music Visualizer Library 1.4.00

"{3C67D8C0-F0EC-11D3-99D3-00C04FCCB775}" = VAIO Action Setup

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840

"{4B6F4C00-E935-11D3-A98A-0080986030D9}" = Smart Capture

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2

"{6990A2BF-D1D2-11D3-81BC-00609789C908}" = Sony DV Shared Library

"{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}" = Nuance PaperPort 12

"{6EF2FDAB-7FBF-4AB9-92CD-594BDDB6A56B}" = PaperPort Image Printer

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71D6CE84-B7DC-4166-8E0D-56C1C37BFB5A}" = SonicStage 1.5.00

"{761C9026-14F0-4352-8658-934558272404}" = VAIO Edit Components LE

"{764FBCE2-1593-11D4-A51F-0800460222F0}" = VAIO Web Phone

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{802EF464-4992-42B3-8434-45151AD3C933}" = VAIO Serenus Wallpaper

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.06)

"{ACEC9C3E-0100-4EBE-B298-35A2145828A0}" = VAIO Brezza Wallpaper

"{B9B23371-84ED-4DFD-B473-4B82BE712D47}" = OpenMG Secure Module 3.1

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C9811F26-3EF6-449A-9736-BB79A125D894}" = AVG 2014

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CFD0CD4E-18D1-4FD9-A64C-1E96D31F6745}" = ISP Selector

"{D4A49B00-02F8-11D5-B64D-00C04F790F76}" = MovieShaker 3.3

"{E2069DE3-5924-4766-A385-CDA273885A31}" = DigitalPrint 1.1

"{E62AFEB8-BF5A-4287-A19B-198BB17F6276}" = AVG 2014

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"{F8D0829C-9C6F-11D3-8080-00C04FA329AA}" = Microsoft Works 6.0

"Adobe Flash Player ActiveX" = Adobe Flash Player 14 ActiveX

"AOL Broadband Toolbar" = AOL Broadband Toolbar

"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)

"AVG" = AVG 2014

"Beatnik Player" = Beatnik Player

"CCleaner" = CCleaner

"DG834" = DG834

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie8" = Windows Internet Explorer 8

"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2

"InstallShield_{CFD0CD4E-18D1-4FD9-A64C-1E96D31F6745}" = ISP Selector

"LiveReg" = LiveReg (Symantec Corporation)

"LiveUpdate1.7" = LiveUpdate 1.7 (Symantec Corporation)

"Lucent Technologies Soft Modem" = Lucent Technologies Soft Modem AMR

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Motion JPEG Software Decoder" = Motion JPEG Software Decoder

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers

"RealPlayer 6.0" = RealPlayer Basic

"sp6" = Logitech SetPoint 6.32

"Windows XP Service Pack" = Windows XP Service Pack 3

 

========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

 

========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 09/08/2014 01:28:49 | Computer Name = GLOBAL | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2014/08/09 06:28:42.703]: [00002192]: CUsbScnDev: DeviceIoControl()

 failed. ErrorCode = 5  

 

Error - 11/08/2014 13:28:28 | Computer Name = GLOBAL | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2014/08/11 18:28:21.734]: [00002080]: CUsbScnDev: DeviceIoControl()

 failed. ErrorCode = 5  

 

Error - 13/08/2014 09:32:29 | Computer Name = GLOBAL | Source = Application Error | ID = 1000

Description = Faulting application setup.exe, version 36.0.1985.143, faulting module

 setup.exe, version 36.0.1985.143, fault address 0x00017ba3.

 

Error - 14/08/2014 02:46:28 | Computer Name = GLOBAL | Source = MPSampleSubmission | ID = 5000

Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),

 P2 4.2.223.0, P3 timeout, P4 1.1.10802.0, P5 fixed, P6 1 _ 1024, P7 5 _ not boot,

 P8 NIL, P9 NIL, P10 NIL.

 

Error - 17/08/2014 04:15:41 | Computer Name = GLOBAL | Source = Application Hang | ID = 1002

Description = Hanging application chrome.exe, version 34.0.1847.137, hang module

 hungapp, version 0.0.0.0, hang address 0x00000000.

 

Error - 19/08/2014 07:07:47 | Computer Name = GLOBAL | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2014/08/19 12:07:41.734]: [00002924]: CUsbScnDev: DeviceIoControl()

 failed. ErrorCode = 5  

 

Error - 19/08/2014 09:13:15 | Computer Name = GLOBAL | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2014/08/19 14:13:15.578]: [00002924]: CUsbScnDev: DeviceIoControl()

 failed. ErrorCode = 5  

 

Error - 20/08/2014 02:26:06 | Computer Name = GLOBAL | Source = MPSampleSubmission | ID = 5000

Description = EventType mptelemetry, P1 0x80070020, P2 patchapplication, P3 am bde,

 P4 11.1.4590.0, P5 mpsigstub.exe, P6 4.2.223.0, P7 microsoft security essentials,

 P8 NIL, P9 NIL, P10 NIL.

 

Error - 23/08/2014 02:49:58 | Computer Name = GLOBAL | Source = MPSampleSubmission | ID = 5000

Description = EventType mptelemetry, P1 0x80070490, P2 packagesnotapplicable, P3

 unspecified, P4 11.1.4590.0, P5 mpsigstub.exe, P6 unspecified, P7 unspecified, 

P8 NIL, P9 NIL, P10 NIL.

 

Error - 24/08/2014 02:08:25 | Computer Name = GLOBAL | Source = MPSampleSubmission | ID = 5000

Description = EventType mptelemetry, P1 0x80070020, P2 patchapplication, P3 am bde,

 P4 11.1.4590.0, P5 mpsigstub.exe, P6 4.2.223.0, P7 microsoft security essentials,

 P8 NIL, P9 NIL, P10 NIL.

 

[ System Events ]

Error - 23/08/2014 02:50:03 | Computer Name = GLOBAL | Source = Microsoft Antimalware | ID = 2001

Description = %%860 has encountered an error trying to update signatures.     New Signature

 Version:      Previous Signature Version: 1.181.261.0     Update Source: %%859     Update Stage:

 %%854     Source Path: http://www.microsoft.com     Signature Type: %%800     Update Type: %%803

 

User:

 NT AUTHORITY\SYSTEM     Current Engine Version:      Previous Engine Version: 1.1.10903.0

 

Error

 code: 0x80070643     Error description: Fatal error during installation. 

 

Error - 23/08/2014 02:53:20 | Computer Name = GLOBAL | Source = Windows Update Agent | ID = 20

Description = Installation Failure: Windows failed to install the following update

 with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138

 (Definition 1.183.167.0).

 

Error - 24/08/2014 01:49:05 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The General Purpose USB Driver (adildr.sys) service failed to start

 due to the following error:   %%2

 

Error - 24/08/2014 01:49:05 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The AOL Spyware Protection Service service failed to start due to 

the following error:   %%3

 

Error - 24/08/2014 02:09:03 | Computer Name = GLOBAL | Source = Microsoft Antimalware | ID = 2001

Description = %%860 has encountered an error trying to update signatures.     New Signature

 Version:      Previous Signature Version: 1.181.261.0     Update Source: %%859     Update Stage:

 %%854     Source Path: http://www.microsoft.com     Signature Type: %%800     Update Type: %%803

 

User:

 NT AUTHORITY\SYSTEM     Current Engine Version:      Previous Engine Version: 1.1.10903.0

 

Error

 code: 0x80070643     Error description: Fatal error during installation. 

 

Error - 24/08/2014 02:11:59 | Computer Name = GLOBAL | Source = Windows Update Agent | ID = 20

Description = Installation Failure: Windows failed to install the following update

 with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138

 (Definition 1.183.284.0).

 

Error - 24/08/2014 14:00:14 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The General Purpose USB Driver (adildr.sys) service failed to start

 due to the following error:   %%2

 

Error - 24/08/2014 14:00:14 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The AOL Spyware Protection Service service failed to start due to 

the following error:   %%3

 

Error - 25/08/2014 01:21:17 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The General Purpose USB Driver (adildr.sys) service failed to start

 due to the following error:   %%2

 

Error - 25/08/2014 01:21:17 | Computer Name = GLOBAL | Source = Service Control Manager | ID = 7000

Description = The AOL Spyware Protection Service service failed to start due to 

the following error:   %%3

 

 

< End of report >

 

 

[ruggie_uk]

Hi Nately, just a courtesy note to let you know that you are still being taken care of. As it's bank holiday, I am actually on holiday but have brought a computer with me so will realistically not get a chance to go through your log until tomorrow as I am sure you appreciate they do take a while to analyse.
Regards

[Nately]

Many Thanks - Regards

[ruggie_uk]

Good evening Nately, sorry for the delay, back home now and ready to rock and roll

Windows XP End Of Life

You are currently using Windows XP SP3.

• Support for this operating system ceased on 8th April 2014.
• This will make your computer extremely vulnerable to future attacks and malware as there will be no security updates past this point and it will constantly pose a securityrisk.
• I highly recommend that you have your computer upgraded to Windows Vista or above(Windows 7 SP1, Windows 8.1) The new operating system would require a clean install so your important documents would need backing up first before you upgraded.

Step 1

OTL fix

Ensure OTL is located on your desktop. If it is not, then please download from http://oldtimer.geekstogo.com/OTL.exe and save it to your desktop.

Please double click on OTL.exe to start it.

Copy the text in the following box (do not include the word Quote). To do this, highlight everything
inside the quote box (except the word Quote) , right click and click Copy.

:Commands
[CreateRestorePoint]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Reg Error: Value error.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = Reg Error: Value error.
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found
[2014/08/05 11:43:35 | 000,000,000 | ---D | M] (Amazon Shopping Assistant by Spigot) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]
[2014/08/05 11:43:39 | 000,000,000 | ---D | M] (Ebay Shopping Assistant by Spigot) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]
[2014/08/05 11:43:24 | 000,000,000 | ---D | M] (Slick Savings) -- C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\extensions\[email protected]
O2 - BHO: (no name) - {210A34B7-A8CB-4A43-8392-7EBCF86276B6} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: paypal ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: sony-europe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sonystyle-europe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: vaio-link.com ([]* in Trusted sites)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.m...ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1

:Files
ipconfig /flushdns /c

:Commands
[ResetHosts]
[EmptyTemp]

Next, right click in the box named Custom Scans/Fixes and select paste.



This will insert the code into OTL.

Now click Run Fix

OTL will generate a report when it has finished. Please paste the contents of this report in your next post.

Step 2

ASWmbr Scan

Download aswMBR.exe ( 511KB ) to your desktop. If you already have this application, this is a new version I need you to download.

Double click the aswMBR.exe to run it



Click the "Scan" button to start scan

If your computer supports Virtualization Technology, select Yes to use it for rootkit detection. When it offers to download the virus database allow that as well



On completion of the scan click Save Log, save it to your desktop and post in your next reply



The tool will also produce a copy of the mbrdump labeled MBR.dat. Please upload that file here.

Step 3

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.


NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

• XP users: Double click the AdwCleaner icon to start the program.
• Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:
  
  
• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove. Please Do Not delete anything at this time.
• Click the Report button to get the log.
• Copy and Paste it into your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[R0].txt.
• Click the X in the upper right corner of the program or click the File menu and click Exit to close the program.
• NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.
  
  
  
  Items for your next post:
  
  
• OTL Log
• ASWmbr report
• ADWCleaner Log

[Nately]

Thank You - Hope this OK

 

# AdwCleaner v3.308 - Report created 27/08/2014 at 18:50:30

# Updated 20/08/2014 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Raymond Sleet - GLOBAL

# Running from : C:\Documents and Settings\Raymond Sleet\My Documents\Downloads\AdwCleaner.exe

# Option : Scan

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

File Found : C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www.azlyrics.com_0.localstorage-journal

Folder Found : C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\Extensions\[email protected]

 

***** [ Scheduled Tasks ] *****

 

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v8.0.6001.18702

 

 

-\\ Mozilla Firefox v

 

[ File : C:\Documents and Settings\Raymond Sleet\Application Data\Mozilla\Firefox\Profiles\nvv1uinz.default\prefs.js ]

 

 

-\\ Google Chrome v

 

[ File : C:\Documents and Settings\Raymond Sleet\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

 

 

*************************

 

AdwCleaner[R0].txt - [8629 octets] - [05/08/2014 12:08:31]

AdwCleaner[R1].txt - [8568 octets] - [05/08/2014 12:21:52]

AdwCleaner[R2].txt - [1336 octets] - [27/08/2014 18:50:30]

AdwCleaner[S0].txt - [8807 octets] - [05/08/2014 12:28:02]

 

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1456 octets] ##########

 

[ruggie_uk]

Hi,

 

Just need these two logs now please.

 

• OTL Log
• ASWmbr report

[Nately]

I do not know how to do this - also the topic keeps being ended by the owner of the site - I do not know why - very stressful - Thank You anyway

[ruggie_uk]

I assure you the topic is not being ended.

 

I can talk you through each bit step by step if that would help.

 

At the top of this topic, to the right there is a button that says follow this topic, if you click it you will be notified of anything that gets added here.

[Dakeyras]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.