[HighKing33]

Yourfile Downloader repeatedly prompts me to install program upon booting up my notebook. The program itself uploaded without my permission while I was attempting to watch a film on a German language site, I cancelled it as soon as I noticed this taking place but I've been left with this lingering problem. None of the anti-malware programs I am using recognise this program as even being present on my computer so I am concerned that I may have to go through registry files in order to purge the computer of this malware. I am hoping someone can offer assistance with this process because it is well beyond my ken.

 

Thank you in advance and yes, I know I should be wary of watching media online

[Advertisements]

Here are the results of the OTL quick scan:

 

OTL logfile created on: 20/11/2014 18:54:33 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\David\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
1023.37 Mb Total Physical Memory | 437.10 Mb Available Physical Memory | 42.71% Memory free
2.40 Gb Paging File | 1.92 Gb Available in Paging File | 80.06% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.43 Gb Total Space | 4.07 Gb Free Space | 5.70% Space Free | Partition Type: NTFS
 
Computer Name: GOOGENSPIEL | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/11/20 18:24:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David\My Documents\Downloads\OTL.exe
PRC - [2013/06/22 00:55:37 | 000,182,184 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2009/09/22 17:00:00 | 000,028,672 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\V0640Mon.exe
PRC - [2009/05/21 09:55:38 | 001,025,264 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\gs_agent\dsc.exe
PRC - [2009/05/21 09:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/14 00:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/03/15 10:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2007/02/13 18:32:42 | 001,174,152 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2006/03/20 19:43:16 | 000,331,776 | ---- | M] () -- C:\Program Files\AGEIA Technologies\TrayIcon.exe
PRC - [2006/01/19 10:29:52 | 000,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2005/09/01 17:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2005/01/27 01:02:00 | 000,086,016 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2004/10/30 14:59:54 | 000,385,024 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2004/09/13 16:33:20 | 000,155,648 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe
PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2004/09/07 16:08:02 | 000,389,120 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2004/09/07 16:03:40 | 000,245,760 | ---- | M] (Intel) -- C:\Program Files\Intel\Wireless\Bin\1XConfig.exe
PRC - [2004/08/19 14:40:08 | 000,045,056 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/02/06 00:52:52 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/06 00:52:32 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013/01/11 00:06:10 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll
MOD - [2013/01/11 00:04:15 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll
MOD - [2013/01/11 00:04:02 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll
MOD - [2006/03/20 19:43:16 | 000,331,776 | ---- | M] () -- C:\Program Files\AGEIA Technologies\TrayIcon.exe
MOD - [2005/09/01 17:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
MOD - [2005/07/26 18:46:42 | 000,069,632 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
MOD - [2005/06/29 12:44:42 | 000,090,223 | ---- | M] () -- C:\Program Files\Dell\QuickSet\preflibcl.dll
MOD - [2005/01/27 01:02:00 | 000,086,016 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
MOD - [2004/09/07 16:03:46 | 000,073,728 | ---- | M] () -- C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2014/11/11 20:00:11 | 000,114,288 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/01/28 13:16:19 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/06/22 00:55:37 | 000,182,184 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007/02/13 18:32:42 | 001,174,152 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2006/01/19 10:29:52 | 002,041,536 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/19 10:29:52 | 000,100,032 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2005/07/25 19:25:18 | 000,491,520 | ---- | M] ( ) [On_Demand | Stopped] -- C:\WINDOWS\system32\lxcfcoms.exe -- (lxcf_device)
SRV - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (bvrp_pci)
DRV - [2014/11/13 22:16:28 | 000,114,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV - [2014/11/11 23:04:49 | 000,035,992 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hitmanpro37.sys -- (hitmanpro37)
DRV - [2009/12/03 17:00:00 | 000,273,760 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0640Vid.sys -- (V0640Vid)
DRV - [2009/09/03 05:13:24 | 000,160,256 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0640Afx.sys -- (V0640Afx)
DRV - [2009/08/21 10:33:14 | 000,143,936 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV - [2008/04/13 18:46:08 | 000,049,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008/04/13 18:46:07 | 000,013,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/08/16 18:45:25 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2005/08/04 04:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/08/03 10:44:16 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\APPDRV.SYS -- (APPDRV)
DRV - [2005/03/10 22:56:06 | 000,273,168 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/11/16 16:03:52 | 000,108,791 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2004/10/21 20:56:04 | 003,210,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51)
DRV - [2004/08/31 08:53:04 | 000,011,354 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2004/08/12 08:44:04 | 000,234,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA)
DRV - [2004/06/17 20:57:02 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004/06/17 20:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 20:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/05/26 20:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004/02/13 16:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...urceid=ie7&rlz=
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co...urceid=ie7&rlz=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 77 AF 9B 87 DB CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0152E5AD-CF11-4069-8D12-4D58AECAFBF7}: "URL" = http://search.yahoo....=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...urceid=ie7&rlz=
IE - HKCU\..\SearchScopes\{FBC420F5-B441-4222-B2B4-3825606C1F51}: "URL" = http://www.google.co...rchTerms}&meta=
IE - HKCU\..\SearchScopes\{FDF68B4E-1398-4A28-9948-F3BFB17C32EB}: "URL" = http://uk.search.yah...=UTF-8&meta=vc=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaultthis.engineName: "Google"
FF - prefs.js..browser.search.defaulturl: "https://www.google.com/search"
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..keyword.URL: "https://www.google.com/search"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\Sony\Media Go\npmediago.dll File not found
FF - HKCU\Software\MozillaPlugins\sony.com/MediaGoDetector: C:\Program Files\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2014/11/11 19:59:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/11/11 19:59:35 | 000,000,000 | ---D | M]
 
[2011/04/09 17:36:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Extensions
[2014/11/12 13:06:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\botdovfj.default-1415362472343\extensions
[2014/11/13 23:56:07 | 000,002,823 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\botdovfj.default-1415362472343\searchplugins\Google.xml
[2014/11/11 19:59:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/11/11 20:00:23 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2006/10/08 18:40:47 | 000,114,688 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npmozax.dll
 
O1 HOSTS File: ([2011/08/29 16:44:58 | 000,437,934 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1                activate.adobe.com
O1 - Hosts: 127.0.0.1                practivate.adobe.com
O1 - Hosts: 127.0.0.1                ereg.adobe.com
O1 - Hosts: 127.0.0.1                activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1                wip3.adobe.com
O1 - Hosts: 127.0.0.1                3dns-3.adobe.com
O1 - Hosts: 127.0.0.1                3dns-2.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1                ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1                activate-sea.adobe.com
O1 - Hosts: 127.0.0.1                wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1                activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1                               adobe.activate.com
O1 - Hosts: 127.0.0.1                               adobeereg.com                        
O1 - Hosts: 127.0.0.1                               www.adobeereg.com                    
O1 - Hosts: 127.0.0.1                               wwis-dubc1-vip60.adobe.com           
O1 - Hosts: 127.0.0.1                               125.252.224.90                       
O1 - Hosts: 127.0.0.1                               125.252.224.91
O1 - Hosts: 127.0.0.1                               hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1    www.007guard.com
O1 - Hosts: 127.0.0.1    007guard.com
O1 - Hosts: 127.0.0.1    008i.com
O1 - Hosts: 127.0.0.1    www.008k.com
O1 - Hosts: 15052 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup File not found
O4 - HKLM..\Run: [Live! Central 2] C:\Program Files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [LuckyTab] C:\Program Files\LuckyTab\LuckyTab.exe File not found
O4 - HKLM..\Run: [LXCFCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.DLL ()
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)
O4 - HKLM..\Run: [V0640Mon.exe] C:\WINDOWS\V0640Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [YourFileDownloader Installer Starter] C:\Documents and Settings\David\Local Settings\Temp\YourFileDownloaderj3at9AroYo.exe (http://yourfile-downloader.com)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" File not found
O4 - HKCU..\Run: [d469325f.exe] C:\Documents and Settings\David\Local Settings\Application Data\d469325f.exe File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creat...13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.co...ploader_v10.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} http://zllin.info/ad/us00/00.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creat...15116/CTPID.cab (Creative Software AutoUpdate Support Package 1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD2CAC1D-56B9-4877-9D6E-5C1F7EC3E0CF}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\IntelWireless: DllName - (C:\Program Files\Intel\Wireless\Bin\LgNotify.dll) - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O24 - Desktop Components:0 (Desktop Uninstall) - C:\WINDOWS\warnhp.html
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\David\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\David\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/11/13 23:47:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Temp
[2014/11/13 22:38:14 | 000,000,000 | ---D | C] -- C:\Documents
[2014/11/13 22:38:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RogueKiller
[2014/11/13 21:52:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2014/11/11 19:59:17 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2014/11/11 18:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2014/11/11 18:08:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2014/11/07 15:54:21 | 000,114,904 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/11/07 15:53:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/11/07 15:53:47 | 000,054,360 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2014/11/07 15:53:46 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2014/11/07 15:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
[2014/11/07 15:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2014/11/07 12:21:49 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/11/07 12:14:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Desktop\Old Firefox Data
[2014/11/06 22:12:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Comodo
[2014/11/06 22:12:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Google
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/11/20 18:52:49 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/11/20 18:52:46 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/11/20 18:52:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/11/20 18:52:27 | 1073,152,000 | -HS- | M] () -- C:\hiberfil.sys
[2014/11/20 18:39:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/11/13 23:56:08 | 000,000,712 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2014/11/13 22:52:44 | 000,026,624 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2014/11/13 22:16:28 | 000,114,904 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/11/13 19:52:00 | 000,000,326 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/11/12 13:11:07 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/11/12 13:11:07 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2014/11/11 23:04:49 | 000,035,992 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2014/11/11 23:01:21 | 000,003,646 | ---- | M] () -- C:\WINDOWS\System32\.crusader
[2014/11/11 18:09:09 | 000,001,610 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2014/11/07 15:53:57 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2014/11/07 12:28:40 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/10/26 17:37:11 | 000,483,592 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2014/10/26 17:37:11 | 000,080,830 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/11/13 22:38:15 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2014/11/11 23:01:21 | 000,003,646 | ---- | C] () -- C:\WINDOWS\System32\.crusader
[2014/11/11 20:43:24 | 000,035,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2014/11/11 18:23:57 | 1073,152,000 | -HS- | C] () -- C:\hiberfil.sys
[2014/11/11 18:09:09 | 000,001,610 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2014/11/07 15:53:57 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2014/02/13 20:01:09 | 000,039,916 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2013/01/22 00:12:20 | 000,565,471 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2732957387-2579213963-1751557781-1006-0.dat
[2012/12/19 00:01:02 | 000,215,682 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/09/11 00:03:07 | 000,060,304 | ---- | C] () -- C:\Documents and Settings\David\g2mdlhlpx.exe
[2007/09/13 11:53:18 | 000,000,023 | ---- | C] () -- C:\Documents and Settings\David\presets.ini
[2006/11/26 19:04:38 | 000,000,122 | ---- | C] () -- C:\Documents and Settings\David\default.pls
[2006/02/16 00:51:58 | 000,002,928 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/30 23:48:54 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\David\Local Settings\Application Data\fusioncache.dat
[2006/01/30 19:19:37 | 000,093,184 | ---- | C] () -- C:\Documents and Settings\David\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/24 14:05:55 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
 
========== ZeroAccess Check ==========
 
[2004/08/10 13:09:48 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 00:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 12:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 00:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2014/02/13 19:42:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2011/04/14 18:50:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton
[2007/10/28 02:29:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Channel4
[2014/11/11 22:59:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2009/09/28 21:08:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kontiki
[2011/01/11 01:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NETg
[2010/03/30 01:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2011/04/13 20:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2014/11/13 22:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RogueKiller
[2007/12/29 23:14:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2012/02/16 18:26:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/08 21:10:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2011/04/14 18:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Ableton
[2006/01/30 22:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Final Draft
[2012/12/18 22:28:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\FMRTEv5
[2012/03/14 12:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Herya
[2011/05/05 11:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\MPEG Streamclip
[2010/03/01 16:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\OpenOffice.org
[2012/02/19 20:52:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Opumeqe
[2012/02/14 00:02:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Sony
[2012/12/17 00:12:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Sports Interactive
[2006/03/22 23:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Template
[2006/08/28 21:57:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Ulead Systems
[2014/11/20 18:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\uTorrent
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8CE646EE

< End of report >

[HighKing33]

Here are the results of the OTL quick scan:

 

OTL logfile created on: 20/11/2014 18:54:33 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Documents and Settings\David\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
 
1023.37 Mb Total Physical Memory | 437.10 Mb Available Physical Memory | 42.71% Memory free
2.40 Gb Paging File | 1.92 Gb Available in Paging File | 80.06% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.43 Gb Total Space | 4.07 Gb Free Space | 5.70% Space Free | Partition Type: NTFS
 
Computer Name: GOOGENSPIEL | User Name: David | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/11/20 18:24:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David\My Documents\Downloads\OTL.exe
PRC - [2013/06/22 00:55:37 | 000,182,184 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2009/09/22 17:00:00 | 000,028,672 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\V0640Mon.exe
PRC - [2009/05/21 09:55:38 | 001,025,264 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\gs_agent\dsc.exe
PRC - [2009/05/21 09:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/04/14 00:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/03/15 10:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2007/02/13 18:32:42 | 001,174,152 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2006/03/20 19:43:16 | 000,331,776 | ---- | M] () -- C:\Program Files\AGEIA Technologies\TrayIcon.exe
PRC - [2006/01/19 10:29:52 | 000,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2005/09/01 17:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2005/01/27 01:02:00 | 000,086,016 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2004/10/30 14:59:54 | 000,385,024 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2004/09/13 16:33:20 | 000,155,648 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe
PRC - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2004/09/07 16:08:02 | 000,389,120 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2004/09/07 16:03:40 | 000,245,760 | ---- | M] (Intel) -- C:\Program Files\Intel\Wireless\Bin\1XConfig.exe
PRC - [2004/08/19 14:40:08 | 000,045,056 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/02/06 00:52:52 | 000,073,544 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/02/06 00:52:32 | 001,044,808 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2013/01/11 00:06:10 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll
MOD - [2013/01/11 00:04:15 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll
MOD - [2013/01/11 00:04:02 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll
MOD - [2006/03/20 19:43:16 | 000,331,776 | ---- | M] () -- C:\Program Files\AGEIA Technologies\TrayIcon.exe
MOD - [2005/09/01 17:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
MOD - [2005/07/26 18:46:42 | 000,069,632 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
MOD - [2005/06/29 12:44:42 | 000,090,223 | ---- | M] () -- C:\Program Files\Dell\QuickSet\preflibcl.dll
MOD - [2005/01/27 01:02:00 | 000,086,016 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
MOD - [2004/09/07 16:03:46 | 000,073,728 | ---- | M] () -- C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2014/11/11 20:00:11 | 000,114,288 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/01/28 13:16:19 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/06/22 00:55:37 | 000,182,184 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2007/02/13 18:32:42 | 001,174,152 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2006/01/19 10:29:52 | 002,041,536 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
SRV - [2006/01/19 10:29:52 | 000,100,032 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2005/07/25 19:25:18 | 000,491,520 | ---- | M] ( ) [On_Demand | Stopped] -- C:\WINDOWS\system32\lxcfcoms.exe -- (lxcf_device)
SRV - [2004/09/07 16:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbnet.sys -- (ewusbnet)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (bvrp_pci)
DRV - [2014/11/13 22:16:28 | 000,114,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV - [2014/11/11 23:04:49 | 000,035,992 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hitmanpro37.sys -- (hitmanpro37)
DRV - [2009/12/03 17:00:00 | 000,273,760 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0640Vid.sys -- (V0640Vid)
DRV - [2009/09/03 05:13:24 | 000,160,256 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\V0640Afx.sys -- (V0640Afx)
DRV - [2009/08/21 10:33:14 | 000,143,936 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV - [2008/04/13 18:46:08 | 000,049,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008/04/13 18:46:07 | 000,013,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/08/16 18:45:25 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\symlcbrd.sys -- (symlcbrd)
DRV - [2005/08/04 04:10:18 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/08/03 10:44:16 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\APPDRV.SYS -- (APPDRV)
DRV - [2005/03/10 22:56:06 | 000,273,168 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/11/16 16:03:52 | 000,108,791 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2004/10/21 20:56:04 | 003,210,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51)
DRV - [2004/08/31 08:53:04 | 000,011,354 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2004/08/12 08:44:04 | 000,234,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA)
DRV - [2004/06/17 20:57:02 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004/06/17 20:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 20:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/05/26 20:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004/02/13 16:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...urceid=ie7&rlz=
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co...urceid=ie7&rlz=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 77 AF 9B 87 DB CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0152E5AD-CF11-4069-8D12-4D58AECAFBF7}: "URL" = http://search.yahoo....=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...urceid=ie7&rlz=
IE - HKCU\..\SearchScopes\{FBC420F5-B441-4222-B2B4-3825606C1F51}: "URL" = http://www.google.co...rchTerms}&meta=
IE - HKCU\..\SearchScopes\{FDF68B4E-1398-4A28-9948-F3BFB17C32EB}: "URL" = http://uk.search.yah...=UTF-8&meta=vc=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaultthis.engineName: "Google"
FF - prefs.js..browser.search.defaulturl: "https://www.google.com/search"
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..keyword.URL: "https://www.google.com/search"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\Sony\Media Go\npmediago.dll File not found
FF - HKCU\Software\MozillaPlugins\sony.com/MediaGoDetector: C:\Program Files\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2014/11/11 19:59:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 33.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/11/11 19:59:35 | 000,000,000 | ---D | M]
 
[2011/04/09 17:36:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Extensions
[2014/11/12 13:06:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\botdovfj.default-1415362472343\extensions
[2014/11/13 23:56:07 | 000,002,823 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\botdovfj.default-1415362472343\searchplugins\Google.xml
[2014/11/11 19:59:18 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014/11/11 20:00:23 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2006/10/08 18:40:47 | 000,114,688 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\npmozax.dll
 
O1 HOSTS File: ([2011/08/29 16:44:58 | 000,437,934 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1                activate.adobe.com
O1 - Hosts: 127.0.0.1                practivate.adobe.com
O1 - Hosts: 127.0.0.1                ereg.adobe.com
O1 - Hosts: 127.0.0.1                activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1                wip3.adobe.com
O1 - Hosts: 127.0.0.1                3dns-3.adobe.com
O1 - Hosts: 127.0.0.1                3dns-2.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1                adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1                ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1                activate-sea.adobe.com
O1 - Hosts: 127.0.0.1                wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1                activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1                               adobe.activate.com
O1 - Hosts: 127.0.0.1                               adobeereg.com                        
O1 - Hosts: 127.0.0.1                               www.adobeereg.com                    
O1 - Hosts: 127.0.0.1                               wwis-dubc1-vip60.adobe.com           
O1 - Hosts: 127.0.0.1                               125.252.224.90                       
O1 - Hosts: 127.0.0.1                               125.252.224.91
O1 - Hosts: 127.0.0.1                               hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1    www.007guard.com
O1 - Hosts: 127.0.0.1    007guard.com
O1 - Hosts: 127.0.0.1    008i.com
O1 - Hosts: 127.0.0.1    www.008k.com
O1 - Hosts: 15052 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup File not found
O4 - HKLM..\Run: [Live! Central 2] C:\Program Files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [LuckyTab] C:\Program Files\LuckyTab\LuckyTab.exe File not found
O4 - HKLM..\Run: [LXCFCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.DLL ()
O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)
O4 - HKLM..\Run: [V0640Mon.exe] C:\WINDOWS\V0640Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [YourFileDownloader Installer Starter] C:\Documents and Settings\David\Local Settings\Temp\YourFileDownloaderj3at9AroYo.exe (http://yourfile-downloader.com)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" File not found
O4 - HKCU..\Run: [d469325f.exe] C:\Documents and Settings\David\Local Settings\Application Data\d469325f.exe File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creat...13/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.co...ploader_v10.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} http://zllin.info/ad/us00/00.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creat...15116/CTPID.cab (Creative Software AutoUpdate Support Package 1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD2CAC1D-56B9-4877-9D6E-5C1F7EC3E0CF}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\IntelWireless: DllName - (C:\Program Files\Intel\Wireless\Bin\LgNotify.dll) - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O24 - Desktop Components:0 (Desktop Uninstall) - C:\WINDOWS\warnhp.html
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\David\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\David\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 13:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1f4a8ee2-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1f4a8ee8-3fa4-11e0-9095-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{28c2717a-3f94-11e0-908f-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell - "" = AutoRun
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b4e277e-3f9a-11e0-9091-001422ec86d2}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/11/13 23:47:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Temp
[2014/11/13 22:38:14 | 000,000,000 | ---D | C] -- C:\Documents
[2014/11/13 22:38:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\RogueKiller
[2014/11/13 21:52:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2014/11/11 19:59:17 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2014/11/11 18:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2014/11/11 18:08:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2014/11/07 15:54:21 | 000,114,904 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/11/07 15:53:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/11/07 15:53:47 | 000,054,360 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2014/11/07 15:53:46 | 000,023,256 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2014/11/07 15:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes Anti-Malware
[2014/11/07 15:53:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2014/11/07 12:21:49 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/11/07 12:14:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Desktop\Old Firefox Data
[2014/11/06 22:12:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Comodo
[2014/11/06 22:12:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Local Settings\Application Data\Google
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/11/20 18:52:49 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2014/11/20 18:52:46 | 000,000,300 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/11/20 18:52:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/11/20 18:52:27 | 1073,152,000 | -HS- | M] () -- C:\hiberfil.sys
[2014/11/20 18:39:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/11/13 23:56:08 | 000,000,712 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2014/11/13 22:52:44 | 000,026,624 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2014/11/13 22:16:28 | 000,114,904 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
[2014/11/13 19:52:00 | 000,000,326 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/11/12 13:11:07 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/11/12 13:11:07 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\David\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2014/11/11 23:04:49 | 000,035,992 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2014/11/11 23:01:21 | 000,003,646 | ---- | M] () -- C:\WINDOWS\System32\.crusader
[2014/11/11 18:09:09 | 000,001,610 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2014/11/07 15:53:57 | 000,000,777 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2014/11/07 12:28:40 | 000,000,308 | ---- | M] () -- C:\WINDOWS\tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
[2014/10/26 17:37:11 | 000,483,592 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2014/10/26 17:37:11 | 000,080,830 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/11/13 22:38:15 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2014/11/11 23:01:21 | 000,003,646 | ---- | C] () -- C:\WINDOWS\System32\.crusader
[2014/11/11 20:43:24 | 000,035,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro37.sys
[2014/11/11 18:23:57 | 1073,152,000 | -HS- | C] () -- C:\hiberfil.sys
[2014/11/11 18:09:09 | 000,001,610 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
[2014/11/07 15:53:57 | 000,000,777 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2014/02/13 20:01:09 | 000,039,916 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2013/01/22 00:12:20 | 000,565,471 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2732957387-2579213963-1751557781-1006-0.dat
[2012/12/19 00:01:02 | 000,215,682 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/09/11 00:03:07 | 000,060,304 | ---- | C] () -- C:\Documents and Settings\David\g2mdlhlpx.exe
[2007/09/13 11:53:18 | 000,000,023 | ---- | C] () -- C:\Documents and Settings\David\presets.ini
[2006/11/26 19:04:38 | 000,000,122 | ---- | C] () -- C:\Documents and Settings\David\default.pls
[2006/02/16 00:51:58 | 000,002,928 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/30 23:48:54 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\David\Local Settings\Application Data\fusioncache.dat
[2006/01/30 19:19:37 | 000,093,184 | ---- | C] () -- C:\Documents and Settings\David\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/24 14:05:55 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
 
========== ZeroAccess Check ==========
 
[2004/08/10 13:09:48 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 00:12:05 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 12:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 00:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2014/02/13 19:42:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2011/04/14 18:50:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ableton
[2007/10/28 02:29:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Channel4
[2014/11/11 22:59:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\HitmanPro
[2009/09/28 21:08:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kontiki
[2011/01/11 01:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NETg
[2010/03/30 01:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2011/04/13 20:59:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2014/11/13 22:38:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RogueKiller
[2007/12/29 23:14:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2012/02/16 18:26:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/08 21:10:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2011/04/14 18:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Ableton
[2006/01/30 22:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Final Draft
[2012/12/18 22:28:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\FMRTEv5
[2012/03/14 12:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Herya
[2011/05/05 11:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\MPEG Streamclip
[2010/03/01 16:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\OpenOffice.org
[2012/02/19 20:52:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Opumeqe
[2012/02/14 00:02:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Sony
[2012/12/17 00:12:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Sports Interactive
[2006/03/22 23:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Template
[2006/08/28 21:57:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Ulead Systems
[2014/11/20 18:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\uTorrent
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8CE646EE

< End of report >

[Essexboy]

Hi sorry for the delay could I have a fresh look at your system please

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Select additions at the bottom
• Press Scan button.
  
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please attach both logs generated.

[HighKing33]

Hi, thanks for your help.

 

I should note that I managed to delete the yourfiledownloader.exe files that were prompting the install upon start-up by going into the settings folders highlighted after the OTL scan results above but my system is still behaving strangely, e.g. a documents and settings window opens automatically on my desktop after start-up.

 

Here are the two logs generated: FRST.txt

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-11-2014
Ran by David (administrator) on GOOGENSPIEL on 24-11-2014 21:04:28
Running from C:\Documents and Settings\David\My Documents\Downloads
Loaded Profile: David (Available profiles: David & Administrator)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation ) C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
(Intel® Corporation) C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Symantec Corporation) C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Dell Inc.) C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Intel) C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
() C:\Program Files\Dell\QuickSet\quickset.exe
() C:\Program Files\Dell\Media Experience\DMXLauncher.exe
(Sonic Solutions) C:\WINDOWS\system32\dla\tfswctrl.exe
(InstallShield Software Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
() C:\Program Files\AGEIA Technologies\TrayIcon.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Creative Technology Ltd.) C:\WINDOWS\V0640Mon.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Gteko Ltd.) C:\Program Files\DellSupport\DSAgnt.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(BVRP Software) C:\Program Files\Digital Line Detect\DLG.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(OldTimer Tools) C:\Documents and Settings\David\My Documents\Downloads\OTL.exe
(Symantec Corporation) C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
(Symantec Corporation) C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [155648 2004-09-13] (Alps Electric Co., Ltd.)
HKLM\...\Run: [ATIPTA] => C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2005-08-05] (ATI Technologies, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IntelWireless] => C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [385024 2004-10-30] (Intel Corporation)
HKLM\...\Run: [Dell QuickSet] => C:\Program Files\Dell\QuickSet\quickset.exe [684032 2005-09-01] ()
HKLM\...\Run: [DMXLauncher] => C:\Program Files\Dell\Media Experience\DMXLauncher.exe [86016 2005-01-27] ()
HKLM\...\Run: [dla] => C:\WINDOWS\system32\dla\tfswctrl.exe [127035 2004-12-06] (Sonic Solutions)
HKLM\...\Run: [ISUSPM Startup] => "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-06-10] (InstallShield Software Corporation)
HKLM\...\Run: [MSKDetectorExe] => C:\Program Files\McAfee\SpamKiller\MSKDetct.exe [1121792 2005-08-12] (McAfee, Inc.)
HKLM\...\Run: [Synchronization Manager] => C:\WINDOWS\system32\mobsync.exe [143360 2008-04-14] (Microsoft Corporation)
HKLM\...\Run: [AGEIA PhysX SysTray] => C:\Program Files\AGEIA Technologies\TrayIcon.exe [331776 2006-03-20] ()
HKLM\...\Run: [LXCFCATS] => rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16                                                                                                                         (the data entry has 59 more characters).
HKLM\...\Run: [dscactivate] => C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [16384 2007-11-15] ( )
HKLM\...\Run: [DellSupportCenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [413696 2008-03-28] (Apple Inc.)
HKLM\...\Run: [DVDLauncher] => C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [49152 2006-04-06] (CyberLink Corp.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [Live! Central 2] => C:\Program Files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe [426140 2009-11-04] (Creative Technology Ltd)
HKLM\...\Run: [V0640Mon.exe] => C:\WINDOWS\V0640Mon.exe [28672 2009-09-22] (Creative Technology Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)
HKLM\...\Run: [YourFileDownloader Installer Starter] => "C:\DOCUME~1\David\LOCALS~1\Temp\YourFileDownloadervuYSPLKS6F.exe" -startup <===== ATTENTION
HKLM\...\Run: [LuckyTab] => C:\Program Files\LuckyTab\LuckyTab.exe
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
Winlogon\Notify\IntelWireless: C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [DellSupport] => C:\Program Files\DellSupport\DSAgnt.exe [460784 2007-03-15] (Gteko Ltd.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [d469325f.exe] => C:\Documents and Settings\David\Local Settings\Application Data\d469325f.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [DellSupportCenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Policies\Explorer: [ClassicShell] 0
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {1f4a8ee2-3fa4-11e0-9095-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {1f4a8ee8-3fa4-11e0-9095-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {28c2717a-3f94-11e0-908f-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {9b4e277e-3f9a-11e0-9091-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-18\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co...urceid=ie7&rlz=
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x5C77AF9B87DBCC01
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {0152E5AD-CF11-4069-8D12-4D58AECAFBF7} URL = http://search.yahoo....=utf-8&fr=b1ie7
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {FBC420F5-B441-4222-B2B4-3825606C1F51} URL = http://www.google.co...rchTerms}&meta=
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {FDF68B4E-1398-4A28-9948-F3BFB17C32EB} URL = http://uk.search.yah...=UTF-8&meta=vc=
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: DriveLetterAccess -> {5CA3D70E-1895-11CF-8E15-001234567890} -> C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> No Name - {C4069E3A-68F1-403E-B40E-20066696354B} -  No File
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> No Name - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} -  No File
DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creat...13/CTPIDPDE.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.co...ploader_v10.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} http://zllin.info/ad/us00/00.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creat...15116/CTPID.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\Parameters: [NameServer] 208.67.220.220,208.67.222.222

FireFox:
========
FF ProfilePath: C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\viez8hgk.default-1416602605359
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @playstation.com/PsndlCheck,version=1.00 -> C:\Program Files\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll No File
FF Plugin HKU\S-1-5-21-2732957387-2579213963-1751557781-1006: sony.com/MediaGoDetector -> C:\Program Files\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npmozax.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Adblock Plus - C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\viez8hgk.default-1416602605359\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-19]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (PriceLess) - C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\iihonnlnepjdppkhgkfonkmhhicbacof [2014-11-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [100032 2006-01-19] (Symantec Corporation)
S3 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [76848 2007-03-07] ()
R2 EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [86016 2004-09-07] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182184 2013-06-22] (Oracle Corporation)
R3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE [2041536 2006-01-19] (Symantec Corporation)
S3 lxcf_device; C:\WINDOWS\system32\lxcfcoms.exe [491520 2005-07-25] ( )
R2 NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [356352 2005-06-09] (Dell Inc.) [File not signed]
R2 RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [139264 2004-09-07] (Intel Corporation) [File not signed]
R2 S24EventMonitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [360521 2004-09-07] (Intel Corporation ) [File not signed]
R2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-08-13] (SupportSoft, Inc.)
R2 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1174152 2007-02-13] (Symantec Corporation)
R2 WLANKEEPER; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [225353 2004-09-07] (Intel® Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\WINDOWS\System32\DRIVERS\61883.sys [48128 2008-04-13] (Microsoft Corporation)
S4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation)
R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [17056 2006-01-24] (Meetinghouse Data Communications) [File not signed]
R1 APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [16128 2005-08-03] (Dell Inc) [File not signed]
S3 AVCSTRM; C:\WINDOWS\System32\DRIVERS\avcstrm.sys [13696 2008-04-13] (Microsoft Corporation)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R0 drvmcdb; C:\WINDOWS\System32\drivers\drvmcdb.sys [87488 2004-12-01] (Sonic Solutions) [File not signed]
R2 drvnddm; C:\WINDOWS\System32\drivers\drvnddm.sys [40480 2004-11-23] (Sonic Solutions) [File not signed]
R3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [35992 2014-11-11] ()
R3 HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [200064 2004-06-17] (Conexant Systems, Inc.)
R3 IWCA; C:\WINDOWS\System32\DRIVERS\iwca.sys [234496 2004-08-12] (Intel Corporation)
S3 MSTAPE; C:\WINDOWS\System32\DRIVERS\mstape.sys [49024 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R1 omci; C:\WINDOWS\System32\DRIVERS\omci.sys [17153 2004-02-13] (Dell Inc) [File not signed]
R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20640 2005-04-25] (Sonic Solutions) [File not signed]
R2 s24trans; C:\WINDOWS\System32\DRIVERS\s24trans.sys [11354 2004-08-31] (Intel Corporation) [File not signed]
R1 sscdbhk5; C:\WINDOWS\System32\drivers\sscdbhk5.sys [5627 2004-07-14] (Sonic Solutions) [File not signed]
R1 ssrtln; C:\WINDOWS\System32\drivers\ssrtln.sys [23545 2004-07-14] (Sonic Solutions) [File not signed]
R3 STAC97; C:\WINDOWS\System32\drivers\STAC97.sys [273168 2005-03-10] (SigmaTel, Inc.)
R2 symlcbrd; C:\WINDOWS\system32\drivers\symlcbrd.sys [10344 2006-08-16] (Symantec Corporation)
R2 tfsnboio; C:\WINDOWS\System32\dla\tfsnboio.sys [25883 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsncofs; C:\WINDOWS\System32\dla\tfsncofs.sys [34843 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsndrct; C:\WINDOWS\System32\dla\tfsndrct.sys [4123 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsndres; C:\WINDOWS\System32\dla\tfsndres.sys [2239 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnifs; C:\WINDOWS\System32\dla\tfsnifs.sys [86586 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnopio; C:\WINDOWS\System32\dla\tfsnopio.sys [15227 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnpool; C:\WINDOWS\System32\dla\tfsnpool.sys [6363 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnudf; C:\WINDOWS\System32\dla\tfsnudf.sys [98714 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnudfa; C:\WINDOWS\System32\dla\tfsnudfa.sys [100603 2004-12-06] (Sonic Solutions) [File not signed]
S3 USBAAPL; C:\WINDOWS\System32\Drivers\usbaapl.sys [30464 2007-10-31] (Apple, Inc.) [File not signed]
S3 V0640Afx; C:\WINDOWS\System32\DRIVERS\V0640Afx.sys [160256 2009-09-03] (Creative Technology Ltd.)
S3 V0640Vid; C:\WINDOWS\System32\DRIVERS\V0640Vid.sys [273760 2009-12-03] (Creative Technology Ltd.)
R3 w29n51; C:\WINDOWS\System32\DRIVERS\w29n51.sys [3210496 2004-10-21] (Intel® Corporation)
S3 bvrp_pci; No ImagePath
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-24 21:04 - 2014-11-24 21:04 - 00000000 ____D () C:\FRST
2014-11-13 23:47 - 2014-11-13 23:54 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Temp
2014-11-13 22:38 - 2014-11-13 22:52 - 00026624 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
2014-11-13 22:38 - 2014-11-13 22:38 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\RogueKiller
2014-11-11 23:01 - 2014-11-11 23:01 - 00003646 _____ () C:\WINDOWS\system32\.crusader
2014-11-11 20:43 - 2014-11-11 23:04 - 00035992 _____ () C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2014-11-11 19:59 - 2014-11-11 20:00 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-11 18:22 - 2014-11-11 18:22 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Desktop\Old Firefox Data
2014-11-11 18:21 - 2014-11-11 18:21 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\Mozilla
2014-11-11 18:21 - 2014-11-11 18:21 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Mozilla
2014-11-11 18:19 - 2014-11-11 18:19 - 00000000 __SHD () C:\Documents and Settings\Administrator.GOOGENSPIEL\IETldCache
2014-11-11 18:18 - 2014-11-11 18:23 - 00000178 ___SH () C:\Documents and Settings\Administrator.GOOGENSPIEL\ntuser.ini
2014-11-11 18:18 - 2014-11-11 18:22 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Temp
2014-11-11 18:18 - 2014-11-11 18:19 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL
2014-11-11 18:18 - 2006-01-24 14:12 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Corel
2014-11-11 18:18 - 2006-01-24 14:05 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\BVRP Software
2014-11-11 18:18 - 2006-01-24 14:04 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Intel
2014-11-11 18:18 - 2006-01-24 14:01 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}
2014-11-11 18:18 - 2006-01-24 14:01 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Sun
2014-11-11 18:18 - 2006-01-24 13:52 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Dell
2014-11-11 18:18 - 2004-08-10 13:08 - 00000671 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Internet Explorer.lnk
2014-11-11 18:18 - 2004-08-10 13:08 - 00000642 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Outlook Express.lnk
2014-11-11 18:18 - 2004-08-10 13:04 - 00001503 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Remote Assistance.lnk
2014-11-11 18:18 - 2004-08-10 13:02 - 00000000 ___RD () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Accessories
2014-11-11 18:09 - 2014-11-11 18:09 - 00001610 _____ () C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
2014-11-11 18:09 - 2014-11-11 18:09 - 00000000 ____D () C:\Program Files\HitmanPro
2014-11-11 18:08 - 2014-11-11 22:59 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\HitmanPro
2014-11-07 15:54 - 2014-11-21 20:05 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-07 15:53 - 2014-11-07 15:53 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-11-07 15:53 - 2014-10-01 11:11 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-11-07 15:53 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-11-07 12:21 - 2014-11-13 23:48 - 00000000 ____D () C:\AdwCleaner
2014-11-07 12:14 - 2014-11-07 12:14 - 00000000 ____D () C:\Documents and Settings\David\Desktop\Old Firefox Data
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-24 21:06 - 2006-01-30 13:05 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Temp
2014-11-24 21:03 - 2004-08-10 13:02 - 01506904 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-24 20:59 - 2014-02-06 19:52 - 00000300 _____ () C:\WINDOWS\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-24 20:59 - 2004-08-10 12:59 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-11-24 20:59 - 2004-08-10 12:51 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-11-24 20:58 - 2004-08-10 13:08 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-24 20:58 - 2004-08-10 12:59 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-11-22 20:26 - 2011-05-25 18:14 - 00032520 _____ () C:\WINDOWS\SchedLgU.Txt
2014-11-22 20:26 - 2006-08-02 20:32 - 00761100 _____ () C:\lxcf.log
2014-11-22 20:26 - 2006-01-30 13:05 - 00000178 ___SH () C:\Documents and Settings\David\ntuser.ini
2014-11-22 19:39 - 2013-10-24 12:05 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-11-20 18:39 - 2007-12-29 23:24 - 00000000 ____D () C:\Program Files\uTorrent
2014-11-20 18:39 - 2007-12-29 23:24 - 00000000 ____D () C:\Documents and Settings\David\Application Data\uTorrent
2014-11-13 23:56 - 2011-04-09 17:36 - 00000712 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-13 23:56 - 2006-07-07 12:40 - 00000712 _____ () C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2014-11-13 19:52 - 2014-02-06 19:52 - 00000326 _____ () C:\WINDOWS\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-12 23:09 - 2013-05-31 00:18 - 00000000 ____D () C:\Documents and Settings\David\Application Data\vlc
2014-11-12 22:59 - 2009-10-02 00:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$
2014-11-12 15:04 - 2009-10-20 21:30 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Nero
2014-11-12 13:22 - 2006-11-22 18:36 - 00000000 ____D () C:\Program Files\Nero
2014-11-12 13:11 - 2006-01-30 13:05 - 00000803 _____ () C:\Documents and Settings\David\Start Menu\Programs\Internet Explorer.lnk
2014-11-12 12:56 - 2006-03-01 16:55 - 00000000 ____D () C:\Program Files\DivX
2014-11-12 12:52 - 2012-05-07 16:04 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-11 16:30 - 2006-12-18 00:22 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB923694$
2014-11-07 12:28 - 2014-02-06 19:52 - 00000308 _____ () C:\WINDOWS\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-02 21:43 - 2014-09-12 22:53 - 00000000 ____D () C:\Documents and Settings\David\Desktop\D&D
2014-11-02 21:32 - 2012-12-24 03:02 - 00250405 _____ () C:\WINDOWS\setupapi.log
2014-10-26 17:37 - 2004-08-10 12:57 - 00575118 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Documents and Settings\David\Local Settings\Temp\2BTzyQBlf6.exe
C:\Documents and Settings\David\Local Settings\Temp\CTPBSeq.exe
C:\Documents and Settings\David\Local Settings\Temp\DataCard_Setup.exe
C:\Documents and Settings\David\Local Settings\Temp\Dl8cmfqvtv.exe
C:\Documents and Settings\David\Local Settings\Temp\donT5DzoIE.exe
C:\Documents and Settings\David\Local Settings\Temp\InstallAX_11_7_700_202.exe
C:\Documents and Settings\David\Local Settings\Temp\InstallAX_11_9_900_117.exe
C:\Documents and Settings\David\Local Settings\Temp\lowproc.exe
C:\Documents and Settings\David\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\David\Local Settings\Temp\ResetDevice.exe
C:\Documents and Settings\David\Local Settings\Temp\SIntf16.dll
C:\Documents and Settings\David\Local Settings\Temp\SIntf32.dll
C:\Documents and Settings\David\Local Settings\Temp\SIntfNT.dll
C:\Documents and Settings\David\Local Settings\Temp\sqlite3.dll
C:\Documents and Settings\David\Local Settings\Temp\stubhelper.dll
C:\Documents and Settings\David\Local Settings\Temp\vlc-2.1.3-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

 

Addition.txt:

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-11-2014
Ran by David at 2014-11-24 21:07:49
Running from C:\Documents and Settings\David\My Documents\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)


==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 11 ActiveX (HKLM\...\{01CC2860-A3CD-4D57-98A5-B202CA6B04ED}) (Version: 11.9.900.117 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.8.800.168 - Adobe Systems Incorporated)
Adobe Premiere 6.0 (HKLM\...\Adobe Premiere 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.6.606 - Adobe Systems, Inc.)
Advanced Audio FX Engine (HKLM\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Advanced RealMedia Export Plug-in for Premiere 6.0 (HKLM\...\RNCompiler 6.0) (Version:  - )
AGEIA PhysX v2.3.3 (HKLM\...\AGEIA PhysX v2.3.3) (Version:  - )
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - )
AoA Audio Extractor (HKLM\...\{D1725D54-279A-40C5-A70D-23C1785DB920}_is1) (Version:  - AoAMedia.com)
Apple Application Support (HKLM\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Control Panel (HKLM\...\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}) (Version: 6.14.10.5160 - )
ATI Display Driver (HKLM\...\ATI Display Driver) (Version: 8.162-050803a2-025823C-Dell - )
Broadcom Management Programs 2 (HKLM\...\InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}) (Version: 7.82.01 - Broadcom)
Broadcom Management Programs 2 (Version: 7.82.01 - Broadcom) Hidden
Conexant D110 MDC V.9x Modem (HKLM\...\CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1) (Version:  - )
Creative Live! Cam Socialize (VF0640) (1.00.04.00) (HKLM\...\Creative VF0640) (Version:  - Creative Technology Ltd.)
Creative Live! Central 2 (HKLM\...\Creative Live! Central 2) (Version: 2.00.29 - Creative Technology Ltd)
Creative System Information (HKLM\...\SysInfo) (Version:  - )
Dell Driver Reset Tool (HKLM\...\{5905F42D-3F5F-4916-ADA6-94A3646AEE76}) (Version: 1.02.0000 - Dell Inc.)
Dell Media Experience (HKLM\...\{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}) (Version: 3.00 - Dell)
Dell Support Center (Support Software) (HKLM\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.2.09085 - Dell)
Dell System Restore (HKLM\...\{74F7662C-B1DB-489E-A8AC-07A06B24978B}) (Version: 2.00.0000 - Dell Inc.)
DellSupport (HKLM\...\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}) (Version: 6.0.3062 - Dell)
Digital Line Detect (HKLM\...\{E646DCF0-5A68-11D5-B229-002078017FBF}) (Version: 1.14 - BVRP Software, Inc)
Final Draft 6 (HKLM\...\{CC8B19D1-91D2-4D5B-B331-F885F432745E}) (Version: 6.0.10 - Final Draft, Inc.)
Final Draft v6.0.2.5 Update (HKLM\...\Final Draft v6.0.2.5 Update) (Version:  - )
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)
Intel® PROSet/Wireless Software (HKLM\...\ProInst) (Version: 9.00.0000 - Intel Corporation)
Internal Network Card Power Management (HKLM\...\{1F528948-0E80-4C96-B455-DE4167CB1DF7}) (Version: 1.7.1 - )
iPod for Windows 2005-02-07 (HKLM\...\InstallShield_{78B50D1D-642C-4B89-BCC7-352EAE3614D7}) (Version: 3.1.0 - Apple Computer, Inc.)
iPod for Windows 2005-02-07 (Version: 3.1.0 - Apple Computer, Inc.) Hidden
iPod for Windows 2006-01-10 (HKLM\...\InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}) (Version: 4.7.0 - Apple Computer, Inc.)
iPod for Windows 2006-01-10 (Version: 4.7.0 - Apple Computer, Inc.) Hidden
iTunes (HKLM\...\{C4780F70-8F21-4F0C-95FE-32FF3E2F9247}) (Version: 11.1.4.62 - Apple Inc.)
J2SE Runtime Environment 5.0 Update 3 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0150030}) (Version: 1.5.0.30 - Sun Microsystems, Inc.)
Java 2 Runtime Environment, SE v1.4.2_03 (HKLM\...\{7148F0A8-6813-11D6-A77B-00B0D0142030}) (Version: 1.4.2_03 - Sun Microsystems, Inc.)
Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java™ 6 Update 22 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
Lexmark 730 Series (HKLM\...\Lexmark 730 Series) (Version:  - )
LiveUpdate 3.0 (Symantec Corporation) (HKLM\...\LiveUpdate) (Version: 3.0.0.154 - Symantec Corporation)
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
mCore (Version: 1.19.0000 - Intel Corporation) Hidden
MCU (Version: 1.00.0000 - Dell) Hidden
mDrWiFi (Version: 1.19.0000 - Intel Corporation) Hidden
Media Go (HKLM\...\{8D92969D-A6A3-44C8-9D63-D377E94F44B5}) (Version: 2.6.205 - Sony)
Media Go Video Playback Engine 2.0.114.09020 (HKLM\...\{49D9CE9D-C8B7-B941-90E1-608044A0FC8D}) (Version: 2.0.114.09020 - Sony)
mHlpDell (Version: 1.19.0000 - Intel) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB2742597) (HKLM\...\M2742597) (Version:  - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version:  - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version:  - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works 7.0 (HKLM\...\{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}) (Version: 07.02.0620 - Microsoft Corporation)
mIWA (Version: 1.19.0000 - Intel Corporation) Hidden
mIWCA (Version: 1.19.0000 - Intel Corporation) Hidden
mLogView (Version: 1.19.0000 - Intel Corporation) Hidden
mMHouse (Version: 1.19.0000 - Intel Corporation) Hidden
Modem Helper (HKLM\...\{7F142D56-3326-11D5-B229-002078017FBF}) (Version: 2.41 - BVRP Software)
Mozilla Firefox 33.1 (x86 en-GB) (HKLM\...\Mozilla Firefox 33.1 (x86 en-GB)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
mPfMgr (Version: 1.19.0000 - Intel Corporation) Hidden
mPfWiz (Version: 1.19.0000 - Intel Corporation) Hidden
mProSafe (Version: 9.00.0000 - Intel) Hidden
mSSO (Version: 1.19.0000 - Intel Corporation) Hidden
MSXML 6 Service Pack 2 (KB954459) (HKLM\...\{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}) (Version: 6.20.1099.0 - Microsoft Corporation)
mToolkit (Version: 1.19.0000 - Intel Corporation) Hidden
mWlsSafe (Version: 9.00.0000 - Intel) Hidden
mXML (Version: 1.19.0000 - Intel Corporation) Hidden
mZConfig (Version: 1.19.0000 - Intel Corporation) Hidden
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.16 - BVRP Software, Inc)
NWZ-A860 WALKMAN Guide (HKLM\...\{B4B239C1-1DF0-48A9-9A67-F4492866A56A}) (Version: 2.0.2.04130 - Sony Corporation)
OpenOffice.org 3.3 (HKLM\...\{82AF3E91-57E1-4754-84D0-40A46E2479AB}) (Version: 3.3.9567 - OpenOffice.org)
Pazera Free Audio Extractor 1.4 (HKLM\...\{6899C238-3E4A-4A04-B251-A0C9EDC7EDBC}_is1) (Version: 1.4 - Jacek Pazera)
PlayStation®Network Downloader (HKLM\...\{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}) (Version: 2.07.00849 - Sony Computer Entertainment Inc.)
PlayStation®Store (HKLM\...\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}) (Version: 4.18.0.15698 - Sony Computer Entertainment Inc.)
PowerDVD 5.9 (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version:  - )
QuickSet (HKLM\...\{C5074CC4-0E26-4716-A307-960272A90040}) (Version: 5.8.0 - )
QuickTime (HKLM\...\{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}) (Version: 7.4.5.67 - Apple Inc.)
Skill Builder DX (HKLM\...\{40C2D00A-9235-4EA2-8AB9-2CAB7A842B49}) (Version:  - )
Sonic DLA (HKLM\...\{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}) (Version: 4.95 - Sonic Solutions)
Sonic MyDVD LE (HKLM\...\{21657574-BD54-48A2-9450-EB03B2C7FC29}) (Version: 6.1.1 - Sonic Solutions)
Sonic RecordNow Audio (HKLM\...\{AB708C9B-97C8-4AC9-899B-DBF226AC9382}) (Version: 2.0.0 - Sonic Solutions)
Sonic RecordNow Copy (HKLM\...\{B12665F4-4E93-4AB4-B7FC-37053B524629}) (Version: 2.0.0.1 - Sonic Solutions)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Symantec KB-DocID:2003093015493306 (Version: 1.0.0.1 - Symantec Corporation) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
WinAce Archiver (HKLM\...\WinAce Archiver) (Version: 2.6 - e-merge GmbH)
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.5.0554.0 - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version:  - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version:  - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version:  - )
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version:  - )
Yahoo! Internet Mail (HKLM\...\Yahoo! Mail) (Version:  - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{030B4A80-1B7C-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{030B4A81-1B7C-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{030B4A82-1B7C-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{1F6F8D20-1B7D-11CF-9D53-00AA003C9CB6}\InprocServer32 -> C:\WINDOWS\system32\comct232.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\WINDOWS\system32\Mscomct2.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\WINDOWS\system32\Mscomct2.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{38911D8E-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\WINDOWS\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{38911D90-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\WINDOWS\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{38911D92-E448-11D0-84A3-00DD01104159}\InprocServer32 -> C:\WINDOWS\system32\comct332.ocx (Microsoft Corporation )
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 -> C:\WINDOWS\system32\msinet.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 -> C:\WINDOWS\system32\msinet.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 -> C:\WINDOWS\system32\msinet.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{5ACBB957-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{5ACBB958-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\WINDOWS\system32\Mscomct2.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\InprocServer32 -> C:\WINDOWS\system32\Mscomct2.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{B66834C6-2E60-11CE-8748-524153480004}\InprocServer32 -> C:\WINDOWS\system32\comctl32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE34-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE39-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3A-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3E-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32 -> C:\WINDOWS\system32\mscomctl.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32 -> C:\WINDOWS\system32\comdlg32.ocx (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006_Classes\CLSID\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\InprocServer32 -> C:\WINDOWS\system32\Mscomct2.ocx (Microsoft Corporation)

==================== Restore Points  =========================

21-08-2014 10:09:29 System Checkpoint
28-08-2014 11:14:51 System Checkpoint
29-08-2014 13:01:43 System Checkpoint
05-09-2014 12:57:49 System Checkpoint
06-09-2014 14:01:23 System Checkpoint
08-09-2014 11:16:00 System Checkpoint
09-09-2014 21:10:30 System Checkpoint
11-09-2014 12:01:03 System Checkpoint
15-09-2014 16:25:37 System Checkpoint
22-09-2014 14:02:26 System Checkpoint
27-09-2014 15:28:55 System Checkpoint
01-10-2014 10:49:26 System Checkpoint
06-10-2014 14:14:34 System Checkpoint
17-10-2014 14:21:46 System Checkpoint
07-11-2014 14:43:07 Removed RealDownloader
11-11-2014 16:57:42 System Checkpoint
11-11-2014 22:56:54 Checkpoint by HitmanPro
11-11-2014 23:01:15 Checkpoint by HitmanPro
13-11-2014 21:52:25 Removed Bonjour
16-11-2014 00:04:32 System Checkpoint
18-11-2014 16:54:44 System Checkpoint
20-11-2014 12:42:06 System Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2004-08-10 12:51 - 2011-08-29 16:44 - 00437934 ____R C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1                activate.adobe.com
127.0.0.1                practivate.adobe.com
127.0.0.1                ereg.adobe.com
127.0.0.1                activate.wip3.adobe.com
127.0.0.1                wip3.adobe.com
127.0.0.1                3dns-3.adobe.com
127.0.0.1                3dns-2.adobe.com
127.0.0.1                adobe-dns.adobe.com
127.0.0.1                adobe-dns-2.adobe.com
127.0.0.1                adobe-dns-3.adobe.com
127.0.0.1                ereg.wip3.adobe.com
127.0.0.1                activate-sea.adobe.com
127.0.0.1                wwis-dubc1-vip60.adobe.com
127.0.0.1                activate-sjc0.adobe.com
127.0.0.1                               adobe.activate.com
127.0.0.1                               adobeereg.com                        
127.0.0.1                               www.adobeereg.com                    
127.0.0.1                               wwis-dubc1-vip60.adobe.com           
127.0.0.1                               125.252.224.90                       
127.0.0.1                               125.252.224.91
127.0.0.1                               hl2rcv.adobe.com
127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============


(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
Task: C:\WINDOWS\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe
Task: C:\WINDOWS\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe

==================== Loaded Modules (whitelisted) =============

2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2004-09-07 16:03 - 2004-09-07 16:03 - 00073728 _____ () C:\Program Files\Intel\Wireless\Bin\D8021Xps.DLL
2006-08-28 21:35 - 2007-03-19 10:58 - 00128512 _____ () C:\Program Files\WinRAR\rarext.dll
2006-01-24 14:05 - 2005-09-01 17:24 - 00684032 _____ () C:\Program Files\Dell\QuickSet\quickset.exe
2006-01-24 14:05 - 2005-06-29 12:44 - 00090223 _____ () C:\Program Files\Dell\QuickSet\preflibcl.dll
2006-01-24 14:05 - 2005-07-26 18:46 - 00069632 _____ () C:\Program Files\Dell\QuickSet\dadkeyb.dll
2005-01-27 01:02 - 2005-01-27 01:02 - 00086016 _____ () C:\Program Files\Dell\Media Experience\DMXLauncher.exe
2006-03-20 19:43 - 2006-03-20 19:43 - 00331776 _____ () C:\Program Files\AGEIA Technologies\TrayIcon.exe
2014-11-11 20:00 - 2014-11-11 20:00 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2006-08-12 17:08 - 2006-01-19 10:29 - 00159744 _____ () C:\Program Files\Symantec\LiveUpdate\UNRAR.DLL

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:8CE646EE

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2732957387-2579213963-1751557781-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator.GOOGENSPIEL
David (S-1-5-21-2732957387-2579213963-1751557781-1006 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\David
Guest (S-1-5-21-2732957387-2579213963-1751557781-501 - Limited - Disabled)
HelpAssistant (S-1-5-21-2732957387-2579213963-1751557781-1005 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-2732957387-2579213963-1751557781-1002 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: 1394 Net Adapter
Description: 1394 Net Adapter
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: NIC1394
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/21/2014 07:39:48 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/20/2014 11:47:45 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/20/2014 11:42:45 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/19/2014 00:22:12 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/19/2014 00:17:12 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/17/2014 02:55:11 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/17/2014 02:50:11 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/12/2014 11:10:26 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/12/2014 11:05:26 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.

Error: (11/12/2014 03:09:28 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: Information Level: error

Internet connection not detected.


System errors:
=============
Error: (11/22/2014 08:26:52 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service lxcf_device with arguments ""
in order to run the server:
{323CE21C-A448-40AA-BA74-7FCF1E44106F}

Error: (11/22/2014 08:26:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxcf_device service failed to start due to the following error:
%%1053

Error: (11/22/2014 08:26:30 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Timeout (30000 milliseconds) waiting for the lxcf_device service to connect.

Error: (11/22/2014 08:26:30 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service lxcf_device with arguments ""
in order to run the server:
{323CE21C-A448-40AA-BA74-7FCF1E44106F}

Error: (11/22/2014 05:38:57 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service lxcf_device with arguments ""
in order to run the server:
{323CE21C-A448-40AA-BA74-7FCF1E44106F}

Error: (11/22/2014 05:38:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxcf_device service failed to start due to the following error:
%%1053

Error: (11/22/2014 05:38:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Timeout (30000 milliseconds) waiting for the lxcf_device service to connect.

Error: (11/22/2014 05:38:41 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service lxcf_device with arguments ""
in order to run the server:
{323CE21C-A448-40AA-BA74-7FCF1E44106F}

Error: (11/21/2014 10:43:13 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service lxcf_device with arguments ""
in order to run the server:
{323CE21C-A448-40AA-BA74-7FCF1E44106F}

Error: (11/21/2014 10:42:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The lxcf_device service failed to start due to the following error:
%%1053


Microsoft Office Sessions:
=========================
Error: (11/21/2014 07:39:48 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/20/2014 11:47:45 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/20/2014 11:42:45 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/19/2014 00:22:12 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/19/2014 00:17:12 AM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/17/2014 02:55:11 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/17/2014 02:50:11 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/12/2014 11:10:26 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/12/2014 11:05:26 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.

Error: (11/12/2014 03:09:28 PM) (Source: Automatic LiveUpdate Scheduler) (EventID: 101) (User: NT AUTHORITY)
Description: errorInternet connection not detected.


==================== Memory info ===========================

Processor:  Intel® Pentium® M processor 1.86GHz
Percentage of memory in use: 77%
Total physical RAM: 1023.37 MB
Available physical RAM: 229.14 MB
Total Pagefile: 2460.43 MB
Available Pagefile: 1737.9 MB
Total Virtual: 2047.88 MB
Available Virtual: 1930.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:71.43 GB) (Free:3.93 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 74.5 GB) (Disk ID: D0F4738C)
Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
Partition 2: (Active) - (Size=71.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=3 GB) - (Type=DB)

==================== End Of Log ============================

[Essexboy]

OK lets get at it, you appear to have thrown everything at this bar the kitchen sink

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

HKLM\...\Run: [YourFileDownloader Installer Starter] => "C:\DOCUME~1\David\LOCALS~1\Temp\YourFileDownloadervuYSPLKS6F.exe" -startup <===== ATTENTION
HKLM\...\Run: [LuckyTab] => C:\Program Files\LuckyTab\LuckyTab.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [d469325f.exe] => C:\Documents and Settings\David\Local Settings\Application Data\d469325f.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> No Name - {C4069E3A-68F1-403E-B40E-20066696354B} - No File
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> No Name - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
2014-11-11 18:18 - 2006-01-24 14:01 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Comodo
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Application Data\Comodo
CHR Profile: C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (PriceLess) - C:\Documents and Settings\David\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\iihonnlnepjdppkhgkfonkmhhicbacof [2014-11-06]
C:\Program Files\LuckyTab
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Scan.
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

[HighKing33]

Thanks again,

 

Here is the logfile from the AdwCleaner scan:

 

# AdwCleaner v4.101 - Report created 24/11/2014 at 21:54:15
# Updated 09/11/2014 by Xplode
# Database : 2014-11-07.1 [Local]
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : David - GOOGENSPIEL
# Running from : C:\Documents and Settings\David\My Documents\Downloads\adwcleaner_4.101(1).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v33.1 (x86 en-GB)


-\\ Chromium v


*************************

AdwCleaner[R0].txt - [24721 octets] - [07/11/2014 12:22:00]
AdwCleaner[R1].txt - [24875 octets] - [07/11/2014 12:26:15]
AdwCleaner[R2].txt - [6887 octets] - [13/11/2014 20:38:12]
AdwCleaner[R3].txt - [1736 octets] - [13/11/2014 21:37:40]
AdwCleaner[R4].txt - [1226 octets] - [13/11/2014 22:26:43]
AdwCleaner[R5].txt - [1287 octets] - [13/11/2014 23:34:02]
AdwCleaner[R6].txt - [1357 octets] - [24/11/2014 21:44:48]
AdwCleaner[S0].txt - [25392 octets] - [07/11/2014 12:26:27]
AdwCleaner[S1].txt - [7089 octets] - [13/11/2014 20:55:46]
AdwCleaner[S2].txt - [1348 octets] - [13/11/2014 23:48:07]
AdwCleaner[S3].txt - [1278 octets] - [24/11/2014 21:54:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1338 octets] ##########

[Essexboy]

Do you still have the document opening problem on startup ?

Could I have a fresh FRST scan please and how the computer is behaving

[HighKing33]

Hi,

 

No my notebook is behaving as per normal.

 

Here is a fresh FRST scan:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-11-2014
Ran by David (administrator) on GOOGENSPIEL on 25-11-2014 20:30:01
Running from C:\Documents and Settings\David\My Documents\Downloads
Loaded Profile: David (Available profiles: David & Administrator)
Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation ) C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
(Intel® Corporation) C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Symantec Corporation) C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Dell Inc.) C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtsvc.exe
(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Intel) C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(ATI Technologies, Inc.) C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
() C:\Program Files\Dell\QuickSet\quickset.exe
() C:\Program Files\Dell\Media Experience\DMXLauncher.exe
(Sonic Solutions) C:\WINDOWS\system32\dla\tfswctrl.exe
(InstallShield Software Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
() C:\Program Files\AGEIA Technologies\TrayIcon.exe
(SupportSoft, Inc.) C:\Program Files\Dell Support Center\bin\sprtcmd.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
(Creative Technology Ltd.) C:\WINDOWS\V0640Mon.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Gteko Ltd.) C:\Program Files\DellSupport\DSAgnt.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(BVRP Software) C:\Program Files\Digital Line Detect\DLG.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [155648 2004-09-13] (Alps Electric Co., Ltd.)
HKLM\...\Run: [ATIPTA] => C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2005-08-05] (ATI Technologies, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [IntelWireless] => C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [385024 2004-10-30] (Intel Corporation)
HKLM\...\Run: [Dell QuickSet] => C:\Program Files\Dell\QuickSet\quickset.exe [684032 2005-09-01] ()
HKLM\...\Run: [DMXLauncher] => C:\Program Files\Dell\Media Experience\DMXLauncher.exe [86016 2005-01-27] ()
HKLM\...\Run: [dla] => C:\WINDOWS\system32\dla\tfswctrl.exe [127035 2004-12-06] (Sonic Solutions)
HKLM\...\Run: [ISUSPM Startup] => "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-06-10] (InstallShield Software Corporation)
HKLM\...\Run: [MSKDetectorExe] => C:\Program Files\McAfee\SpamKiller\MSKDetct.exe [1121792 2005-08-12] (McAfee, Inc.)
HKLM\...\Run: [Synchronization Manager] => C:\WINDOWS\system32\mobsync.exe [143360 2008-04-14] (Microsoft Corporation)
HKLM\...\Run: [AGEIA PhysX SysTray] => C:\Program Files\AGEIA Technologies\TrayIcon.exe [331776 2006-03-20] ()
HKLM\...\Run: [LXCFCATS] => rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16                                                                                                                         (the data entry has 59 more characters).
HKLM\...\Run: [dscactivate] => C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [16384 2007-11-15] ( )
HKLM\...\Run: [DellSupportCenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [413696 2008-03-28] (Apple Inc.)
HKLM\...\Run: [DVDLauncher] => C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [49152 2006-04-06] (CyberLink Corp.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [Live! Central 2] => C:\Program Files\Creative\Creative Live! Cam\Live! Central 2\CTLVCentral2.exe [426140 2009-11-04] (Creative Technology Ltd)
HKLM\...\Run: [V0640Mon.exe] => C:\WINDOWS\V0640Mon.exe [28672 2009-09-22] (Creative Technology Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
Winlogon\Notify\IntelWireless: C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [DellSupport] => C:\Program Files\DellSupport\DSAgnt.exe [460784 2007-03-15] (Gteko Ltd.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [DellSupportCenter] => C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Run: [SpybotSD TeaTimer] => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\Policies\Explorer: [ClassicShell] 0
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {1f4a8ee2-3fa4-11e0-9095-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {1f4a8ee8-3fa4-11e0-9095-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {28c2717a-3f94-11e0-908f-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\...\MountPoints2: {9b4e277e-3f9a-11e0-9091-001422ec86d2} - E:\AutoRun.exe
HKU\S-1-5-18\...\RunOnce: [RunNarrator] => C:\WINDOWS\system32\Narrator.exe [53760 2008-04-14] (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co...urceid=ie7&rlz=
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x5C77AF9B87DBCC01
HKU\S-1-5-21-2732957387-2579213963-1751557781-1006\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {0152E5AD-CF11-4069-8D12-4D58AECAFBF7} URL = http://search.yahoo....=utf-8&fr=b1ie7
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {FBC420F5-B441-4222-B2B4-3825606C1F51} URL = http://www.google.co...rchTerms}&meta=
SearchScopes: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> {FDF68B4E-1398-4A28-9948-F3BFB17C32EB} URL = http://uk.search.yah...=UTF-8&meta=vc=
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO: DriveLetterAccess -> {5CA3D70E-1895-11CF-8E15-001234567890} -> C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2732957387-2579213963-1751557781-1006 -> &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macr...director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creat...13/CTPIDPDE.cab
DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.co...ploader_v10.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
DPF: {E53458D2-5A83-4BD1-8DE2-EEEBE73BAB77} http://zllin.info/ad/us00/00.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creat...15116/CTPID.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\Parameters: [NameServer] 208.67.220.220,208.67.222.222

FireFox:
========
FF ProfilePath: C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\viez8hgk.default-1416602605359
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @playstation.com/PsndlCheck,version=1.00 -> C:\Program Files\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files\Sony\Media Go\npmediago.dll No File
FF Plugin HKU\S-1-5-21-2732957387-2579213963-1751557781-1006: sony.com/MediaGoDetector -> C:\Program Files\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npmozax.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: Adblock Plus - C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\viez8hgk.default-1416602605359\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-21]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-19]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [100032 2006-01-19] (Symantec Corporation)
S3 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [76848 2007-03-07] ()
R2 EvtEng; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [86016 2004-09-07] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182184 2013-06-22] (Oracle Corporation)
R3 LiveUpdate; C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE [2041536 2006-01-19] (Symantec Corporation)
S3 lxcf_device; C:\WINDOWS\system32\lxcfcoms.exe [491520 2005-07-25] ( )
R2 NICCONFIGSVC; C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe [356352 2005-06-09] (Dell Inc.) [File not signed]
R2 RegSrvc; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [139264 2004-09-07] (Intel Corporation) [File not signed]
R2 S24EventMonitor; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [360521 2004-09-07] (Intel Corporation ) [File not signed]
R2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968 2008-08-13] (SupportSoft, Inc.)
R2 Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [1174152 2007-02-13] (Symantec Corporation)
R2 WLANKEEPER; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [225353 2004-09-07] (Intel® Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\WINDOWS\System32\DRIVERS\61883.sys [48128 2008-04-13] (Microsoft Corporation)
S4 abp480n5; C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation)
R2 AegisP; C:\WINDOWS\System32\DRIVERS\AegisP.sys [17056 2006-01-24] (Meetinghouse Data Communications) [File not signed]
R1 APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [16128 2005-08-03] (Dell Inc) [File not signed]
S3 AVCSTRM; C:\WINDOWS\System32\DRIVERS\avcstrm.sys [13696 2008-04-13] (Microsoft Corporation)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R0 drvmcdb; C:\WINDOWS\System32\drivers\drvmcdb.sys [87488 2004-12-01] (Sonic Solutions) [File not signed]
R2 drvnddm; C:\WINDOWS\System32\drivers\drvnddm.sys [40480 2004-11-23] (Sonic Solutions) [File not signed]
R3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
S3 hitmanpro37; C:\WINDOWS\system32\drivers\hitmanpro37.sys [35992 2014-11-11] ()
R3 HSFHWICH; C:\WINDOWS\System32\DRIVERS\HSFHWICH.sys [200064 2004-06-17] (Conexant Systems, Inc.)
R3 IWCA; C:\WINDOWS\System32\DRIVERS\iwca.sys [234496 2004-08-12] (Intel Corporation)
S3 MSTAPE; C:\WINDOWS\System32\DRIVERS\mstape.sys [49024 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R1 omci; C:\WINDOWS\System32\DRIVERS\omci.sys [17153 2004-02-13] (Dell Inc) [File not signed]
R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [20640 2005-04-25] (Sonic Solutions) [File not signed]
R2 s24trans; C:\WINDOWS\System32\DRIVERS\s24trans.sys [11354 2004-08-31] (Intel Corporation) [File not signed]
R1 sscdbhk5; C:\WINDOWS\System32\drivers\sscdbhk5.sys [5627 2004-07-14] (Sonic Solutions) [File not signed]
R1 ssrtln; C:\WINDOWS\System32\drivers\ssrtln.sys [23545 2004-07-14] (Sonic Solutions) [File not signed]
R3 STAC97; C:\WINDOWS\System32\drivers\STAC97.sys [273168 2005-03-10] (SigmaTel, Inc.)
R2 symlcbrd; C:\WINDOWS\system32\drivers\symlcbrd.sys [10344 2006-08-16] (Symantec Corporation)
R2 tfsnboio; C:\WINDOWS\System32\dla\tfsnboio.sys [25883 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsncofs; C:\WINDOWS\System32\dla\tfsncofs.sys [34843 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsndrct; C:\WINDOWS\System32\dla\tfsndrct.sys [4123 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsndres; C:\WINDOWS\System32\dla\tfsndres.sys [2239 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnifs; C:\WINDOWS\System32\dla\tfsnifs.sys [86586 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnopio; C:\WINDOWS\System32\dla\tfsnopio.sys [15227 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnpool; C:\WINDOWS\System32\dla\tfsnpool.sys [6363 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnudf; C:\WINDOWS\System32\dla\tfsnudf.sys [98714 2004-12-06] (Sonic Solutions) [File not signed]
R2 tfsnudfa; C:\WINDOWS\System32\dla\tfsnudfa.sys [100603 2004-12-06] (Sonic Solutions) [File not signed]
S3 USBAAPL; C:\WINDOWS\System32\Drivers\usbaapl.sys [30464 2007-10-31] (Apple, Inc.) [File not signed]
S3 V0640Afx; C:\WINDOWS\System32\DRIVERS\V0640Afx.sys [160256 2009-09-03] (Creative Technology Ltd.)
S3 V0640Vid; C:\WINDOWS\System32\DRIVERS\V0640Vid.sys [273760 2009-12-03] (Creative Technology Ltd.)
R3 w29n51; C:\WINDOWS\System32\DRIVERS\w29n51.sys [3210496 2004-10-21] (Intel® Corporation)
S3 bvrp_pci; No ImagePath
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-24 21:04 - 2014-11-25 20:30 - 00000000 ____D () C:\FRST
2014-11-13 23:47 - 2014-11-13 23:54 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Application Data\Temp
2014-11-13 22:38 - 2014-11-13 22:52 - 00026624 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
2014-11-13 22:38 - 2014-11-13 22:38 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\RogueKiller
2014-11-11 23:01 - 2014-11-11 23:01 - 00003646 _____ () C:\WINDOWS\system32\.crusader
2014-11-11 20:43 - 2014-11-11 23:04 - 00035992 _____ () C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2014-11-11 19:59 - 2014-11-11 20:00 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-11 18:22 - 2014-11-11 18:22 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Desktop\Old Firefox Data
2014-11-11 18:21 - 2014-11-11 18:21 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\Mozilla
2014-11-11 18:21 - 2014-11-11 18:21 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Mozilla
2014-11-11 18:19 - 2014-11-11 18:19 - 00000000 __SHD () C:\Documents and Settings\Administrator.GOOGENSPIEL\IETldCache
2014-11-11 18:18 - 2014-11-11 18:23 - 00000178 ___SH () C:\Documents and Settings\Administrator.GOOGENSPIEL\ntuser.ini
2014-11-11 18:18 - 2014-11-11 18:22 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Temp
2014-11-11 18:18 - 2014-11-11 18:19 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL
2014-11-11 18:18 - 2006-01-24 14:12 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Corel
2014-11-11 18:18 - 2006-01-24 14:05 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Local Settings\Application Data\BVRP Software
2014-11-11 18:18 - 2006-01-24 14:04 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Intel
2014-11-11 18:18 - 2006-01-24 14:01 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Application Data\Sun
2014-11-11 18:18 - 2006-01-24 13:52 - 00000000 ____D () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Dell
2014-11-11 18:18 - 2004-08-10 13:08 - 00000671 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Internet Explorer.lnk
2014-11-11 18:18 - 2004-08-10 13:08 - 00000642 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Outlook Express.lnk
2014-11-11 18:18 - 2004-08-10 13:04 - 00001503 _____ () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Remote Assistance.lnk
2014-11-11 18:18 - 2004-08-10 13:02 - 00000000 ___RD () C:\Documents and Settings\Administrator.GOOGENSPIEL\Start Menu\Programs\Accessories
2014-11-11 18:09 - 2014-11-11 18:09 - 00001610 _____ () C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk
2014-11-11 18:09 - 2014-11-11 18:09 - 00000000 ____D () C:\Program Files\HitmanPro
2014-11-11 18:08 - 2014-11-11 22:59 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\HitmanPro
2014-11-07 15:54 - 2014-11-21 20:05 - 00114904 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-11-07 15:53 - 2014-11-07 15:53 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-07 15:53 - 2014-11-07 15:53 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes
2014-11-07 15:53 - 2014-10-01 11:11 - 00054360 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-11-07 15:53 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-11-07 12:21 - 2014-11-24 21:54 - 00000000 ____D () C:\AdwCleaner
2014-11-07 12:14 - 2014-11-07 12:14 - 00000000 ____D () C:\Documents and Settings\David\Desktop\Old Firefox Data
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\SUPPORT_388945a0
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\HelpAssistant
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Guest
2014-11-06 22:12 - 2014-11-06 22:12 - 00000000 ____D () C:\Documents and Settings\Administrator

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-25 20:30 - 2006-01-30 13:05 - 00000000 ____D () C:\Documents and Settings\David\Local Settings\Temp
2014-11-25 20:29 - 2004-08-10 13:02 - 01566447 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-25 20:26 - 2014-02-06 19:52 - 00000300 _____ () C:\WINDOWS\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-25 20:26 - 2004-08-10 12:51 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-11-25 20:25 - 2004-08-10 13:08 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-25 20:25 - 2004-08-10 12:59 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-11-25 20:25 - 2004-08-10 12:59 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-11-25 11:25 - 2011-05-25 18:14 - 00032520 _____ () C:\WINDOWS\SchedLgU.Txt
2014-11-25 11:25 - 2006-08-02 20:32 - 00761970 _____ () C:\lxcf.log
2014-11-25 11:25 - 2006-01-30 13:05 - 00000178 ___SH () C:\Documents and Settings\David\ntuser.ini
2014-11-24 21:39 - 2013-10-24 12:05 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-11-24 21:34 - 2004-08-10 13:08 - 00000000 ____D () C:\Documents and Settings\LocalService\Local Settings\Temp
2014-11-20 18:39 - 2007-12-29 23:24 - 00000000 ____D () C:\Program Files\uTorrent
2014-11-20 18:39 - 2007-12-29 23:24 - 00000000 ____D () C:\Documents and Settings\David\Application Data\uTorrent
2014-11-13 23:56 - 2011-04-09 17:36 - 00000712 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
2014-11-13 23:56 - 2006-07-07 12:40 - 00000712 _____ () C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2014-11-13 19:52 - 2014-02-06 19:52 - 00000326 _____ () C:\WINDOWS\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-12 23:09 - 2013-05-31 00:18 - 00000000 ____D () C:\Documents and Settings\David\Application Data\vlc
2014-11-12 22:59 - 2009-10-02 00:27 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB952287$
2014-11-12 15:04 - 2009-10-20 21:30 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Nero
2014-11-12 13:22 - 2006-11-22 18:36 - 00000000 ____D () C:\Program Files\Nero
2014-11-12 13:11 - 2006-01-30 13:05 - 00000803 _____ () C:\Documents and Settings\David\Start Menu\Programs\Internet Explorer.lnk
2014-11-12 12:56 - 2006-03-01 16:55 - 00000000 ____D () C:\Program Files\DivX
2014-11-12 12:52 - 2012-05-07 16:04 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-11 16:30 - 2006-12-18 00:22 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB923694$
2014-11-07 12:28 - 2014-02-06 19:52 - 00000308 _____ () C:\WINDOWS\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2732957387-2579213963-1751557781-1006.job
2014-11-02 21:43 - 2014-09-12 22:53 - 00000000 ____D () C:\Documents and Settings\David\Desktop\D&D
2014-11-02 21:32 - 2012-12-24 03:02 - 00250405 _____ () C:\WINDOWS\setupapi.log
2014-10-26 17:37 - 2004-08-10 12:57 - 00575118 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

Some content of TEMP:
====================
C:\Documents and Settings\David\Local Settings\Temp\Quarantine.exe
C:\Documents and Settings\David\Local Settings\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

 

 

Thanks again

[Essexboy]

Nice, it looks good

In that case methinks I will send you on your merry way

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:


Remove tools

Download and run Delfix




: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe

[HighKing33]

Thanks again,

 

I'll do all the above and give you a heads up tomorrow.

 

Love the chromotic dragons in the avatar by the way!

[Essexboy]

Aye I got the Dragons to scare malware

Keep safe now

[HighKing33]

Everything looks good, the computer is running very smoothly.

 

Can't thank you enough. All the best!

[Essexboy]

My pleasure

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.