[islandcat]

wil try this thanks

[Advertisements]

Not working well for me but will keep trying and let you know.

[islandcat]

Not working well for me but will keep trying and let you know.

[Teima]

Hi. Would you mind elaborating on the issues as to which you are having at the moment?

[islandcat]

Not having any luck with the advanced uninstaller. Not working for me. I can get it from you but gets hung up trying to uninstall????

[Teima]

Step One

 

I would assume you still have OTL on your machine. Right-click on OTL.exe and select Run As Administrator to start the program. If prompted by UAC, please allow it.

 

• Please check the box next to Scan All Users.

• Make sure Use SafeList is selected under Extra Registry.

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

/md5start
taxtron.*
/md5stop

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your reply. If both log won't fit in the same post, you may post them in two separate posts.

 

[islandcat]

Will do thanks

[islandcat]

OTL logfile created on: 06/04/2014 10:01:10 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Nadja\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16521)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
 
3.60 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 59.69% Memory free
7.20 Gb Paging File | 5.35 Gb Available in Paging File | 74.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 252.89 Gb Total Space | 208.37 Gb Free Space | 82.40% Space Free | Partition Type: NTFS
Drive D: | 25.47 Gb Total Space | 11.74 Gb Free Space | 46.11% Space Free | Partition Type: NTFS
Drive F: | 4.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
 
Computer Name: NADJA-PC | User Name: Nadja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2014/04/06 09:55:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Nadja\Downloads\OTL (1).exe
PRC - [2014/04/01 16:31:26 | 003,774,312 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe
PRC - [2014/03/20 16:36:34 | 007,957,408 | ---- | M] (Innovative Solutions) -- C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\healthcheck.exe
PRC - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
PRC - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
PRC - [2014/02/12 19:32:14 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2014/02/03 11:56:10 | 000,444,920 | ---- | M] () -- C:\Program Files (x86)\FastMediaConverter\FastMediaConverterApp.exe
PRC - [2013/12/18 11:42:32 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/06/26 20:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2013/06/26 20:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2012/06/25 20:47:15 | 000,329,056 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
PRC - [2011/12/09 15:45:00 | 000,548,864 | ---- | M] (Vimicro) -- C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
PRC - [2011/08/25 20:43:44 | 000,337,776 | ---- | M] ( ) -- C:\Program Files (x86)\LockKey\LockKey.exe
PRC - [2011/01/28 23:29:36 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
 
 
========== Services (SafeList) ==========
 
SRV - [2014/03/11 21:17:30 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/03/05 09:24:48 | 000,857,912 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2014/03/05 09:24:46 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
SRV - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
SRV - [2013/12/18 11:42:32 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/09/05 11:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/06/26 20:21:50 | 000,207,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2013/06/26 20:21:46 | 000,523,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ [binary data]
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7
IE - HKLM\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bigseekpr...?q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co...=LENN&bmod=LENN
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes,DefaultScope = {C7F0B873-5B5F-4BA0-B584-B564480612B1}
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...rc=IE-SearchBox
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{216BF4C3-4FD5-45B9-B909-738DFE102E42}: "URL" = http://search.condui...&q={searchTerms}
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...1I7LENN_enCA516
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{C7F0B873-5B5F-4BA0-B584-B564480612B1}: "URL" = http://search.condui...8313882947&UM=2
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bigseekpr...?q={searchTerms}
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Nadja\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
 
[2013/06/09 16:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nadja\AppData\Roaming\Mozilla\Extensions
File not found (No name found) -- C:\PROGRAM FILES (X86)\BETTERSURF\BETTERSURFPLUS\FF
 
========== Chrome  ==========
 
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.condui...=CT3298581&UM=2
CHR - default_search_provider: suggest_url = http://suggest.searc...4194832272&UM=2,
CHR - homepage: http://search.condui...4194832272&UM=2
CHR - plugin: Windows Live? Photo Gallery (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - Extension: MixiDJ V45 = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.26.7.519_0\
CHR - Extension: MixiDJ V45 = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.26.7.519_0\nativeMessaging\nmHost
CHR - Extension: MixiDJ V45 = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.26.9.505_0\
CHR - Extension: MixiDJ V45 = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehjklkgijkjfcfmmjmjlmcccholamaf\10.26.9.505_0\nativeMessaging\nmHost
CHR - Extension: Skype Click to Call = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.0.14735.1561_1\
CHR - Extension: Google Wallet = C:\Users\Nadja\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
 
O1 HOSTS File: ([2009/06/10 14:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE (Vimicro)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Dolby Advanced Audio v2] C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [LockKey] C:\Program Files (x86)\LockKey\LockKey.exe ( )
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Lenovo)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455}  (ExentInf Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 75.153.176.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3C03C674-1DC3-4B6A-A6BD-52C1955F01A2}: DhcpNameServer = 192.168.1.201
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{563C6CDC-41DA-4C6F-94FF-EE30D963B67B}: DhcpNameServer = 192.168.1.254 75.153.176.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/04/01 16:35:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/04/01 16:35:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2014/03/28 13:01:00 | 000,000,000 | ---D | C] -- C:\Windows\Fonts\AdvUninstal
[2014/03/28 13:00:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Innovative Solutions
[2014/03/28 13:00:44 | 000,000,000 | ---D | C] -- C:\Users\Nadja\AppData\Local\Innovative Solutions
[2014/03/28 13:00:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Uninstaller PRO
[2014/03/28 13:00:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Innovative Solutions
[2014/03/28 13:00:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Innovative Solutions
[2014/03/15 00:53:30 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2014/03/15 00:53:27 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2014/03/15 00:53:23 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2014/03/15 00:53:22 | 001,964,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014/03/15 00:53:22 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2014/03/15 00:53:21 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014/03/15 00:53:13 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014/03/15 00:53:12 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2014/03/15 00:53:11 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2014/03/15 00:47:39 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2014/03/15 00:44:44 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wer.dll
 
========== Files - Modified Within 30 Days ==========
 
[2014/04/06 10:04:18 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/04/06 10:04:17 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/04/06 09:58:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/04/06 09:45:51 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Health-Check-auto.job
[2014/04/06 09:45:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/04/06 09:45:18 | 2901,434,368 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/01 16:35:50 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/03/31 19:24:07 | 000,000,344 | ---- | M] () -- C:\Windows\tasks\Health-Check-deep.job
[2014/03/31 19:24:07 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\Health-Check.job
[2014/03/28 13:00:44 | 000,001,652 | ---- | M] () -- C:\Users\Nadja\Desktop\Advanced Uninstaller PRO 11.lnk
[2014/03/19 14:19:42 | 000,001,123 | ---- | M] () -- C:\Users\Public\Desktop\TaxTron 2013.lnk
[2014/03/15 00:05:04 | 000,767,670 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014/03/11 21:17:27 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/03/11 21:17:26 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2014/04/01 16:35:50 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/03/28 13:00:54 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\Health-Check-auto.job
[2014/03/28 13:00:52 | 000,000,344 | ---- | C] () -- C:\Windows\tasks\Health-Check-deep.job
[2014/03/28 13:00:47 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\Health-Check.job
[2014/03/28 13:00:44 | 000,001,652 | ---- | C] () -- C:\Users\Nadja\Desktop\Advanced Uninstaller PRO 11.lnk
[2014/03/28 13:00:44 | 000,001,536 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Uninstaller PRO 11.lnk
[2014/03/28 13:00:35 | 000,042,496 | ---- | C] () -- C:\Windows\SysWow64\AdvUninstCPL.cpl
[2014/03/19 14:19:42 | 000,001,123 | ---- | C] () -- C:\Users\Public\Desktop\TaxTron 2013.lnk
[2013/07/19 19:25:33 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2013/05/07 14:28:35 | 000,767,670 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/12/28 15:42:47 | 000,000,632 | RHS- | C] () -- C:\Users\Nadja\ntuser.pol
[2012/12/26 01:04:56 | 000,000,000 | ---- | C] () -- C:\Windows\firstboot.dat
[2012/06/25 20:47:27 | 000,472,416 | ---- | C] () -- C:\Windows\SysWow64\Lenovo.VerifaceStub.dll
[2012/06/25 20:47:26 | 002,086,240 | ---- | C] () -- C:\Windows\SysWow64\LenovoVeriface.Interface.dll
[2012/06/25 20:47:26 | 001,500,512 | ---- | C] () -- C:\Windows\SysWow64\Apblend.dll
[2012/06/25 20:47:26 | 001,171,456 | ---- | C] () -- C:\Windows\SysWow64\PicNotify.dll
[2012/06/25 20:47:08 | 001,044,480 | ---- | C] () -- C:\Windows\SysWow64\3DImageRenderer.dll
[2012/06/25 20:33:56 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012/06/25 20:28:42 | 000,001,779 | ---- | C] () -- C:\Windows\vm332Rmv.ini
[2012/06/25 20:28:42 | 000,001,779 | ---- | C] () -- C:\Windows\SysWow64\vm332Rmv.ini
 
========== ZeroAccess Check ==========
 
[2009/07/13 21:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/07/25 19:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/25 18:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 18:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 20:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 18:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Custom Scans ==========
 
< MD5 for: TAXTRON.EXE  >
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\Program Files (x86)\TaxTron\TaxTron 2013\bin\TaxTron.exe
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\ProgramData\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\Users\All Users\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe
 
< MD5 for: TAXTRON.MTX  >
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia1\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia2\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia3\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia4\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia5\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia6\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia7\TaxTron.mtx

< End of report >

[islandcat]

OTL report 2. Please remember this is not my desktop computer this is my daughters laptop. thanks

 

OTL Extras logfile created on: 06/04/2014 10:01:10 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Nadja\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16521)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
 
3.60 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 59.69% Memory free
7.20 Gb Paging File | 5.35 Gb Available in Paging File | 74.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 252.89 Gb Total Space | 208.37 Gb Free Space | 82.40% Space Free | Partition Type: NTFS
Drive D: | 25.47 Gb Total Space | 11.74 Gb Free Space | 46.11% Space Free | Partition Type: NTFS
Drive F: | 4.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
 
Computer Name: NADJA-PC | User Name: Nadja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{066C81FC-CADA-440F-8FFB-5013D6B9A120}" = rport=138 | protocol=17 | dir=out | app=system |
"{10A5F925-26F9-4F1D-BFE3-1D50454B5584}" = lport=445 | protocol=6 | dir=in | app=system |
"{147EC636-4FAD-40E1-B0F0-31AE78A7F537}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{1773AA73-9008-4C52-8AE1-3F8F32E528DC}" = rport=137 | protocol=17 | dir=out | app=system |
"{1AAFF528-F753-4371-B8FD-6705A876528D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{28F54E42-9DC1-40CA-B3EF-CDBD3AE33218}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{2C26DDCC-D347-49D4-8E89-E48D24E028AA}" = lport=10243 | protocol=6 | dir=in | app=system |
"{3403B6E2-C06D-4AAA-B5F4-CEA823ADB348}" = rport=139 | protocol=6 | dir=out | app=system |
"{41A9D19E-63EE-492A-963F-D50975AA7935}" = lport=138 | protocol=17 | dir=in | app=system |
"{4632999F-38B8-4EE4-957E-13E3E797FA06}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4D6082D8-2DAB-444F-8C37-343EB7E742D5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6FFA0C0C-2246-4760-87D7-CB341A9135CB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7B4D6CCB-FDCE-40F1-8B19-16C16FA59DEB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{835685C5-A494-4E6B-B9F8-5A22C4220D3D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9D9C1DE2-276F-4C06-8531-49C4B308F585}" = lport=137 | protocol=17 | dir=in | app=system |
"{A14395DA-6BFA-4CCF-9771-F7AEDB63A23D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A1FD607C-A82C-4CE9-893C-255709D19CC7}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B9E8B066-6EAB-4612-BABC-B0F5249619EE}" = rport=445 | protocol=6 | dir=out | app=system |
"{D7000426-A000-4EC9-8694-5D7FB9E8ACC0}" = lport=139 | protocol=6 | dir=in | app=system |
"{D8F20EF3-EDB0-402E-8497-A4944CB6B89A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFDCED33-FCE9-4286-A24C-5CEEDE89092F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E16ADC99-3E62-4F32-822A-3803F3961B2D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{F7DEB314-0D7F-4356-8612-9825ECF6040B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{108265CB-0A53-43AF-9BC7-58C878D522A6}" = protocol=1 | dir=in | [email protected],-28543 |
"{1C4EE3EE-52A9-4680-ADDA-36ADDACD501D}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{356F0B1D-9052-48ED-AECC-DEEABF11B855}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3C26916F-0690-490C-8432-36E9F8BFFA09}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3F0C60AA-F1AD-4114-AF8C-1E42C736DA15}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{4687034D-FD4B-4C4E-A821-0FAAA242B8B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5301987A-3669-4B80-AE12-72CD7930C826}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{64334253-8218-429F-9755-0815CCBA989D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6CB211D2-B415-46B1-BB88-1CB7AD50EB22}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{78A629F1-CBB4-4979-AC76-C7EB6136A60D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7C4F51A5-997F-44B3-8859-C07696D1BAD8}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7EEFA9E9-76CC-4077-AD89-51FB6384B4EE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8825BDC8-50E1-45E8-AA82-4ED72EB77BA3}" = protocol=6 | dir=out | app=system |
"{9E75E3A2-0D80-4635-BF73-FBB536D51DF9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A4802DFE-B9CF-4266-A7D5-395739CE932A}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{A78DFB1A-AD27-4641-A598-13303FD7B04E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A7912785-CA2A-4839-8430-D76F4B731840}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{B0447B52-4DB8-47F8-9C63-919A53C37064}" = protocol=58 | dir=in | [email protected],-28545 |
"{B49B0E08-69AB-4968-85F1-547A2E946ECB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B7485712-29DD-4E46-922E-3CB45D914F44}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BDB113CF-A77A-47D2-A046-FE3E4902BC9A}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{CD148FDB-9A67-4057-B785-7382140CC808}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{CFFB6950-58BF-423D-A289-59354F5C2E84}" = protocol=1 | dir=out | [email protected],-28544 |
"{D115406D-CA18-4643-8B52-277771CAF8DB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{D2DADC88-4E5F-45D7-A869-F03A72E6B472}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E6E9363D-18CA-4BAE-ABC3-F3C5D6BAFFCA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{E93FF0DA-64ED-4C73-8B19-12CD836A84F5}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{ED710512-4178-4344-A3DF-E638C3D93F0B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FC9B165D-95A0-4D74-AAEA-44748C2B9B29}" = protocol=58 | dir=out | [email protected],-28546 |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"{0398090D-9539-A2BB-89AF-C78292FDD100}" = CCC Help English
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{097E024D-BE30-4D95-B5F3-B6AE9C1568D4}" = PowerXpressHybrid
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0BCB196F-838B-099B-DAF9-D895F47D1169}" = CCC Help French
"{10617854-88B2-BB05-D763-44DE4ECBE52D}" = CCC Help German
"{13DFBB9D-B02A-D176-72EF-0BE8C0E344F3}" = CCC Help Hungarian
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros WLAN Client Installation Program
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{319F9E73-E40C-14CB-94A6-8E58DD18E683}" = CCC Help Turkish
"{31D696FB-AA4B-F81D-8851-74D1359E1799}" = CCC Help Greek
"{3270ADD1-4DED-ECA5-3AE1-FB6B12F2A167}" = CCC Help Polish
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3B9A1DFF-5AB1-7DF4-723A-7044DBD5252A}" = CCC Help Chinese Traditional
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{4033C622-B359-43B7-8BBE-9448B95FAE47}" = Catalyst Control Center - Branding
"{45A8BDA1-3CB1-8189-D281-5C741417E68F}" = CCC Help Russian
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B4DB3EA-FC9D-6915-A58A-BB214CF6CE8E}" = CCC Help Thai
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{51838B1D-A84E-A939-5C81-75C7ED1ED23D}" = CCC Help Japanese
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{6057E21C-ABE9-4059-AE3E-3BEB9925E660}" = Windows Live Messenger
"{6165AAAB-F6A7-F3E2-71F4-ED4539FA963D}" = CCC Help Finnish
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E3905C4-6BB8-4322-AD2A-9BAC0B423185}" = TaxTron 2013
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7EBAD305-38BF-B090-1698-52567129707C}" = CCC Help Dutch
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8AE8D405-EE01-62FF-300B-2BCEDF39A2F5}" = CCC Help Portuguese
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0409-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - English
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{94EC19B3-85F0-BA63-3333-FED0EB2C2346}" = AMD VISION Engine Control Center
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{9FE73119-F35A-51F7-C6EB-5BC1A59C6342}" = Catalyst Control Center InstallProxy
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A1888A6B-077E-44FE-5261-D88FD5E2ED98}" = CCC Help Italian
"{A5CD312F-0FA0-7205-0576-220C552A5C5B}" = CCC Help Korean
"{A6763955-1785-517C-E051-A1F1E9BEFB87}" = Catalyst Control Center Profiles Mobile
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.9)
"{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}" = Lenovo EasyCamera
"{AF192694-4B15-4AC1-92F3-1B02E98C08BD}" = LockKey
"{AFE5D988-1C04-29DC-D992-66CECC6BDF11}" = CCC Help Spanish
"{B641BFD0-A114-2D4D-6429-01F0F7396ED7}" = CCC Help Danish
"{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}" = Dolby Advanced Audio v2
"{BB285C9F-C821-4770-8970-56C4AB52C87E}" = Skype Click to Call
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C91BA8BE-C12B-71CA-AB0D-4260BD55D6BB}" = Catalyst Control Center Graphics Previews Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D027CF57-0205-CCD4-40E7-E8A57C047903}" = CCC Help Norwegian
"{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D94EA359-4C2D-DFDF-EA2E-6C8FE818D186}" = CCC Help Swedish
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E87022D3-C8C9-4C76-8E27-BC7F18F9B8FB}" = Google Drive
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}" = VAFPlayer
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F329C3CE-81FE-EE21-6684-4629C59689DB}" = CCC Help Chinese Standard
"{F4317B17-8BA1-B046-E301-436275BBF621}" = Catalyst Control Center Localization All
"{F75137CD-5051-34F4-1217-F0B98A75D188}" = CCC Help Czech
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 12 ActiveX
"AU11_is1" = Advanced Uninstaller PRO - Version 11
"avast" = avast! Free Antivirus
"bi_uninstaller" = Bundled software uninstaller
"DealBulldog" = DealBulldog
"DomaIQ Uninstaller" = DomaIQ
"FastMediaConverter" = FastMediaConverter
"Google Chrome" = Google Chrome
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Lenovo YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}" = LockKey
"InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.00.0.1000
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"TaxTron 2013" = TaxTron 2013
"VeriFace" = VeriFace
"VLC media player" = VLC media player 2.0.2
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1218720105-1143995056-975841209-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 13/02/2014 11:07:44 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 9000
Description =
 
Error - 13/02/2014 11:07:44 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 7040
Description =
 
Error - 13/02/2014 11:07:44 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 7042
Description =
 
Error - 13/02/2014 11:07:44 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 9002
Description =
 
Error - 13/02/2014 11:07:44 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 3029
Description =
 
Error - 13/02/2014 11:07:46 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 3029
Description =
 
Error - 13/02/2014 11:07:46 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 3028
Description =
 
Error - 13/02/2014 11:07:46 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 3058
Description =
 
Error - 13/02/2014 11:07:46 PM | Computer Name = Nadja-PC | Source = Windows Search Service | ID = 7010
Description =
 
Error - 15/02/2014 11:12:37 PM | Computer Name = Nadja-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 25/02/2014 9:50:38 PM | Computer Name = Nadja-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1096
Description = The processing of Group Policy failed. Windows could not apply the
 registry-based policy settings for the Group Policy object LocalGPO. Group Policy
 settings will not be resolved until this event is resolved. View the event details
 for more information on the file name and path that caused the failure.
 
Error - 10/03/2014 7:14:22 PM | Computer Name = Nadja-PC | Source = DCOM | ID = 10005
Description =
 
Error - 10/03/2014 7:14:22 PM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7000
Description = The Google Update Service (gupdate) service failed to start due to
 the following error:   %%109
 
Error - 10/03/2014 8:48:50 PM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the ShellHWDetection service.
 
Error - 10/03/2014 9:53:05 PM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the wscsvc service.
 
Error - 10/03/2014 11:11:00 PM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the Spooler service.
 
Error - 10/03/2014 11:37:48 PM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the Wlansvc service.
 
Error - 12/03/2014 12:15:55 AM | Computer Name = Nadja-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
 response from the Netman service.
 
Error - 15/03/2014 2:48:55 AM | Computer Name = Nadja-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:31:56 PM on ?11/?03/?2014 was unexpected.
 
Error - 15/03/2014 2:49:31 AM | Computer Name = Nadja-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1096
Description = The processing of Group Policy failed. Windows could not apply the
 registry-based policy settings for the Group Policy object LocalGPO. Group Policy
 settings will not be resolved until this event is resolved. View the event details
 for more information on the file name and path that caused the failure.
 
 
< End of report >
 

[Teima]

Step One

 

Run OTL

• Under the Custom Scans/Fixes box at the bottom, copy and paste in the following.

:Commands
[CREATERESTOREPOINT]

:OTL
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN34442974194832272&ctid=CT3298581&UM=2
CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}&CUI=UN34442974194832272&UM=2,
CHR - homepage: http://search.conduit.com/?ctid=CT3298581&SearchSource=48&CUI=UN34442974194832272&UM=2
[2013/06/09 16:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nadja\AppData\Roaming\Mozilla\Extensions
File not found (No name found) -- C:\PROGRAM FILES (X86)\BETTERSURF\BETTERSURFPLUS\FF
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{216BF4C3-4FD5-45B9-B909-738DFE102E42}: "URL" = http://search.conduit.com/Results.aspx?ctid=CT3300025&SearchSource=45&UM=2&q={searchTerms}
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{C7F0B873-5B5F-4BA0-B584-B564480612B1}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298581&CUI=UN33275348313882947&UM=2
IE - HKU\S-1-5-21-1218720105-1143995056-975841209-1001\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bigseekpro.com/search/toolbar/dealbulldogmb/{7D8D5472-100C-C7D5-7093-5881F0B72BC5}?q={searchTerms}
IE - HKLM\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bigseekpro.com/search/toolbar/dealbulldogmb/{7D8D5472-100C-C7D5-7093-5881F0B72BC5}?q={searchTerms}
[2014/03/19 14:19:42 | 000,001,123 | ---- | C] () -- C:\Users\Public\Desktop\TaxTron 2013.lnk
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\Program Files (x86)\TaxTron\TaxTron 2013\bin\TaxTron.exe
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\ProgramData\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe
[2014/01/17 15:19:27 | 002,428,960 | ---- | M] (TaxTron) MD5=3F37E2E64C8BD05F9B622052AF37D92B -- C:\Users\All Users\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia1\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia2\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia3\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia4\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia5\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia6\TaxTron.mtx
[2010/01/07 12:08:54 | 000,007,050 | ---- | M] () MD5=133D7C4405FCF84EE8232F9ACEC2686A -- C:\Users\Nadja\AppData\Local\Temp\mia7\TaxTron.mtx

:Commands
[EMPTYTEMP]

• Click run fix.

• OTL may ask to reboot the machine. Please click the OK button if prompted.

• Once done a report will be displayed. Copy and paste the contents of that report within your next response.

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[admin]

Topic re-opened at original posters request.

 

 

i was late getting back to respond to your post on malware forum and it got closed. Says to contact staff member. Sorry I am usually prompt. Thanks

 

[islandcat]

OTL report

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== OTL ==========
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to remove the default_search_provider items.
Use Chrome's Settings page to change the HomePage.
C:\Users\Nadja\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Users\Nadja\AppData\Roaming\Mozilla\Extensions folder moved successfully.
Registry key HKEY_USERS\S-1-5-21-1218720105-1143995056-975841209-1001\Software\Microsoft\Internet Explorer\SearchScopes\{216BF4C3-4FD5-45B9-B909-738DFE102E42}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{216BF4C3-4FD5-45B9-B909-738DFE102E42}\ not found.
Registry key HKEY_USERS\S-1-5-21-1218720105-1143995056-975841209-1001\Software\Microsoft\Internet Explorer\SearchScopes\{C7F0B873-5B5F-4BA0-B584-B564480612B1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7F0B873-5B5F-4BA0-B584-B564480612B1}\ not found.
Registry key HKEY_USERS\S-1-5-21-1218720105-1143995056-975841209-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ not found.
C:\Users\Public\Desktop\TaxTron 2013.lnk moved successfully.
C:\Program Files (x86)\TaxTron\TaxTron 2013\bin\TaxTron.exe moved successfully.
C:\ProgramData\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe moved successfully.
File C:\Users\All Users\{C52CAF34-2313-41D7-BEA5-8AEA04FDC922}\OFFLINE\5BEF76F9\D143EBA3\TaxTron.exe not found.
File C:\Users\Nadja\AppData\Local\Temp\mia1\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia2\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia3\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia4\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia5\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia6\TaxTron.mtx not found.
File C:\Users\Nadja\AppData\Local\Temp\mia7\TaxTron.mtx not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Nadja
->Temp folder emptied: 91547 bytes
->Temporary Internet Files folder emptied: 22104056 bytes
->Java cache emptied: 4074150 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 812 bytes

User: nadja2

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48887 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42321441 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 65.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 04152014_093124

Files\Folders moved on Reboot...
File move failed. C:\Users\Nadja\AppData\Local\Temp\Low\JavaDeployReg.log scheduled to be moved on reboot.
File move failed. C:\Users\Nadja\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
File\Folder C:\Users\Nadja\AppData\Local\Temp\~DF513DFC7F7A8C785B.TMP not found!
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z1EMKTBA\8n77RrR4jg0[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z1EMKTBA\fastbutton[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z1EMKTBA\like[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z1EMKTBA\page-3[2].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z1EMKTBA\postmessageRelay[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H4V6CKOP\277391-otl-tutorial-how-to-use-oldtimer-listit[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H4V6CKOP\fastbutton[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\H4V6CKOP\like[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DUZNTE7F\8n77RrR4jg0[1].htm moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DUZNTE7F\cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw[1].woff moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DUZNTE7F\k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM[1].woff moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DUZNTE7F\xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk[1].woff moved successfully.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3752DVI3\PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0[1].woff moved successfully.
File move failed. C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\4A72F430-B40C-4D36-A068-CE33ADA5ADF9.dat scheduled to be moved on reboot.
C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat scheduled to be moved on reboot.
File move failed. C:\Users\Nadja\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\Low\SkypeClickToCall\Logs\AutoUpdateSvc.log scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[islandcat]

Did i do this right?